Hong Kong SFC Crypto Regulation: Licensing Rules

The rules cover market entry, governance, client assets, AML/CFT controls, custody, token admission and safeguards for retail investors.

This reference is for investors, platform operators and industry stakeholders who need a concise view of Hong Kong's current crypto licensing rules and what an SFC licence actually covers.

Key Takeaways

• Hong Kong's virtual asset service provider licensing regime under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) took effect on June 1, 2023, rather than in 2022.

• Security-token platforms can require Type 1 and Type 7 licences under the Securities and Futures Ordinance (SFO), while non-security-token exchange services fall under the AMLO virtual asset service regime.

• Licensed VATPs must have at least two SFC-approved Responsible Officers, with at least one ordinarily resident in Hong Kong.

• The SFC's official list contained 13 licensed virtual asset trading platforms as of September 10, 2026.

• Retail investors may use licensed VATPs, but token admission, due diligence, onboarding and investor-protection requirements restrict which crypto assets can be made available.

How Does Hong Kong's Regulatory Framework Cover Crypto Exchanges?

Hong Kong uses a dual-track licensing framework built around the Securities and Futures Ordinance and AMLO. Centralised trading platforms providing security-token trading through automated trading services generally fall under Type 1 regulated activity for dealing in securities and Type 7 for providing automated trading services.

A virtual asset exchange trading non-security tokens falls under the AMLO virtual asset service licensing regime.

Because a crypto asset's legal classification can change, the Securities and Futures Commission states that platforms may find it appropriate to apply under both licensing regimes to reduce regulatory gaps and ensure business continuity. Applications are submitted through the SFC's WINGS licensing system.

Hong Kong's broader treatment of regulated digital assets also extends to products such as Hong Kong Bitcoin and Ethereum spot ETFs and regulated virtual asset related products available through licensed corporations.

The framework aims to balance investor protection, market development and regulatory clarity while keeping centralised platforms under ongoing supervision.

Hong Kong Crypto License Requirements for Market Entry

A Hong Kong crypto license involves financial, governance and operational requirements rather than simple company registration.

The SFC requires platform operators to provide monthly business reports within two weeks after each calendar month and may request additional information. Annual independent compliance reviews also form part of ongoing supervision.

Governance requirements extend to competency, internal controls, risk management and regulatory accountability. A Responsible Officer is expected to supervise regulated activities and ensure that the virtual asset service complies with applicable requirements.

The regulatory process can be extensive because the SFC reviews ownership, management competence, financial resources, technical infrastructure, cybersecurity, custody arrangements and detailed procedures before market entry.

Licensing timelines therefore vary. An approximate 12-month process may be encountered in practice, but it shouldn't be treated as a guaranteed statutory processing period.

Anti-Money Laundering Rules for Virtual Asset Transfers

Licensed VASPs must maintain anti-money laundering and counter-terrorist financing controls, including customer due diligence, sanctions screening, transaction monitoring and recordkeeping.

The SFC's AML/CFT Guideline for licensed firms and VASPs applies specific requirements to virtual asset transfers. Platforms must implement Know-Your-Customer procedures and conduct ongoing due diligence throughout a customer relationship.

Virtual asset transfers are also subject to Travel Rule requirements. Required originator and recipient information must accompany applicable transfers. The HK$8,000 threshold relates to certain customer due diligence and identity-verification requirements and should not be interpreted as meaning that all Travel Rule obligations apply only above HK$8,000.

In practice, licensed providers need systems capable of real-time transaction monitoring, identifying suspicious activity and maintaining records. These controls are intended to reduce money laundering and terrorist financing risks in the virtual asset market.

AML/CFT records generally need to be retained for at least five years. Serious non-compliance with AMLO requirements can also expose regulated entities and responsible personnel to regulatory or criminal consequences, depending on the breach.

How Does Hong Kong Protect Retail Investors and Client Assets?

Hong Kong permits licensed VATPs to serve retail investors, but access comes with safeguards covering onboarding, token due diligence, governance, disclosure and custody.

Virtual asset trading platforms must conduct due diligence before admitting a virtual asset for trading and continue reviewing the asset afterward. That matters because not every crypto asset available in global markets is automatically suitable for the Hong Kong public.

The SFC also expects market-surveillance systems capable of detecting manipulative or abusive trading behavior. These controls support market efficiency and reduce risks associated with misconduct on centralised platforms.

Custody requirements cover private keys, cold-wallet infrastructure, operational security and segregation of client assets. Licensed platforms must keep client virtual assets separate from their own operational funds and maintain controls designed to protect client assets against theft, misuse or loss.

The framework has used a 98% cold-storage and 2% hot-wallet benchmark for client virtual assets, although individual custody arrangements remain subject to applicable SFC requirements.

For example, an investor checking a token's availability through a market interface such as Gate Markets still needs to confirm whether the relevant platform, crypto asset and trading service are permitted in the investor's jurisdiction. Market availability by itself doesn't establish regulatory approval.

Automated Trading Services and Security Tokens

Platforms that trade security tokens may fall under licensing requirements that differ from those applying only to non-security tokens.

A platform dealing in securities can require a Type 1 licence, while providing automated trading services can require a Type 7 licence under the Securities and Futures Ordinance. These regulated activities can apply where tokenised assets qualify as traditional securities, interests in collective investment schemes or other regulated financial assets.

By contrast, a centralised virtual asset service dealing only in non-security tokens can fall under the AMLO VASP regime.

This distinction creates two licensing regimes that may overlap. A platform intending to trade security tokens alongside other crypto assets may therefore need approval under both regulatory tracks.

Hong Kong, the HKMA and Stablecoin Regulation

Stablecoin issuance sits alongside, rather than entirely inside, the SFC's VATP regime.

Hong Kong's Stablecoins Ordinance took effect on August 1, 2025, placing specified fiat-referenced stablecoin issuers under supervision of the Hong Kong Monetary Authority. The HKMA stablecoin framework includes requirements around reserve assets, redemption, governance and risk management.

The Securities and Futures Commission, meanwhile, supervises relevant stablecoin activities conducted by SFC-licensed VATPs and licensed corporations.

This means crypto exchanges do not automatically need the same HKMA licence as a stablecoin issuer. The exact regulatory requirements depend on whether the business is issuing a stablecoin, operating a virtual asset exchange, providing custody services, distributing virtual asset related products or conducting another regulated activity.

Hong Kong's regulated digital-asset market has also expanded into areas such as Ethereum ETF staking, showing how traditional financial institutions and digital assets are increasingly operating within the same regulatory framework.

FAQ

Do crypto exchanges need an SFC license in Hong Kong?

Yes. Centralised virtual asset trading platforms carrying on regulated business in Hong Kong, or actively marketing such services to Hong Kong investors, must hold the required SFC licence or licences.

Can retail investors trade crypto on licensed Hong Kong exchanges?

Yes. Retail investors may access licensed virtual asset trading platforms, subject to SFC rules covering onboarding, token admission, disclosure, due diligence, custody and investor protection.

How can an investor check whether a Hong Kong crypto exchange is licensed?

The official SFC list of licensed virtual asset trading platforms identifies operators holding licences. An application, transitional arrangement or similar status shouldn't be treated as equivalent to a full licence.

Does the SFC regulate stablecoin issuers?

Not as the principal issuer regulator. The Hong Kong Monetary Authority supervises issuers covered by the Stablecoins Ordinance, while the SFC regulates relevant stablecoin activities conducted through SFC-licensed trading platforms and licensed corporations.

Are security tokens and non-security tokens licensed under the same rules?

No. Security-token trading can trigger Type 1 and Type 7 licensing requirements under the Securities and Futures Ordinance, while centralised exchange services involving non-security virtual assets fall under the AMLO virtual asset service regime. A platform may therefore need licences under both frameworks.

Disclaimer: This content is for general informational purposes and does not constitute legal advice. Regulatory requirements may change and can differ according to the service, asset and jurisdiction.