SFC VASP Licence Hong Kong Complete VATP Licensing Guide (2026)

Executive Summary Who Needs the Licence

Obtaining an SFC VASP licence in Hong Kong is now mandatory for every centralised virtual asset trading platform that carries on business in or actively markets services to investors in the territory. Since the new licensing regime took effect on 1 June 2023, the Securities and Futures Commission (SFC) has progressively tightened its supervisory expectations through updated handbooks, targeted circulars on stablecoins and shared liquidity, and a swift-licensing track for qualifying deemed applicants. The regime applies equally to exchanges already operating in Hong Kong (“pre-existing VATPs”) and to new entrants seeking market access for the first time.

Whether you are an Asia-based exchange operator, a fintech founder planning a Hong Kong launch, or an in-house compliance officer mapping your firm’s licensing obligations, this guide provides a practical, step-by-step walkthrough of the entire VATP application process updated for 2026 regulatory expectations. Every threshold, date and procedural requirement cited below is grounded in primary SFC, HKMA or legislative sources; readers should always verify the latest position against the SFC Licensing Handbook for VATPs and the SFC’s public registers.

Key Terminology VATP vs VASP vs SFO Regulated Activities

• VATP (Virtual Asset Trading Platform): The SFC’s formal term for a centralised platform licensed under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO, Cap. 615) to operate a virtual asset exchange in Hong Kong.
• VASP (Virtual Asset Service Provider): A broader, internationally used term covering entities that provide virtual asset services. In Hong Kong’s statutory context, a VASP operating a centralised trading platform is regulated as a VATP.
• SFO Regulated Activities (Type 1 / Type 7): Some VATPs that trade virtual assets classified as “securities” may also require licences under the Securities and Futures Ordinance (SFO) for dealing in securities (Type 1) or providing automated trading services (Type 7).

Quick Next Steps for Asia-Based Applicants

1. Determine your status: Establish whether your platform qualifies as a “pre-existing VATP” one that was operating in Hong Kong before 1 June 2023 and filed a deeming application within the prescribed window.
2. Review the SFC’s public lists: Check the SFC VATP lists to verify current licensed and deemed-to-be-licensed platforms.
3. Study the Licensing Handbook: Download and review the VATP Licensing Handbook explained for a complete breakdown of regulatory expectations.
4. Identify your local entity and senior management: A Hong Kong-incorporated company with fit-and-proper directors and key personnel is essential.
5. Build your AML/CFT and custody framework: Begin drafting policies, procedures and technology architecture well before the formal application.

Who Needs an SFC VATP Licence?

Pre-Existing VATPs Deeming Arrangements

Platforms that were operating a centralised virtual asset exchange in Hong Kong before 1 June 2023 could apply under the transitional arrangements to be “deemed-to-be-licensed.” These operators were permitted to continue business during a non-contravention period that ended on 1 June 2024. After that date, only platforms that had submitted a valid application and had not been refused or withdrawn retained deemed status while the SFC processed their application. Any platform that missed the transitional window must apply as a new entrant.

New Entrants Full Application

Non-pre-existing VATPs receive no benefit of deeming. They must submit a comprehensive application meeting all Handbook standards corporate governance, financial resources, AML/CFT, custody and technology before they may lawfully operate. The SFC assesses new entrants under the same substantive criteria but without the benefit of continued operation during review.

Licence Types and Regulated Activities

• AMLO VATP licence: The primary licence permitting operation of a centralised virtual asset trading platform under Cap. 615 (AMLO, as amended).
• SFO Type 1 (dealing in securities): Required where the platform trades virtual assets that constitute “securities” under the SFO.
• SFO Type 7 (automated trading services): Required where the platform provides automated matching or execution services for securities-type virtual assets.

How to Apply for an SFC VATP Licence 9 Clear Steps

The following walkthrough distils the SFC’s published requirements into nine actionable stages. Each step references the relevant section of the Licensing Handbook or associated circulars.

1. Eligibility Check and Pre-Application Assessment

   Confirm whether your platform is pre-existing or new-entrant. Identify your target client base (professional investors only, or retail subject to enhanced safeguards), the scope of virtual assets you intend to list, and whether any assets may qualify as “securities” under the SFO. Map your current operations against the Handbook’s requirements to identify gaps. This self-assessment typically takes four to eight weeks and should produce a remediation roadmap before formal submission.

2. Choose Corporate and Governance Structure

   The applicant must be a Hong Kong-incorporated company or, where the SFC permits, a Hong Kong branch of an overseas entity. Key governance requirements include appointing at least two responsible officers (ROs) who are ordinarily resident in Hong Kong, a board of directors with appropriate experience in financial services, and clearly identified ultimate controllers and associated entities. All directors and controllers are subject to the SFC’s fit-and-proper assessment, including background checks, financial probity reviews and evaluation of experience in regulated markets. Industry observers note that setting up a Hong Kong entity for VASPs early in the process avoids downstream delays.

3. Minimum Financial Resources and Capital Buffers

   The Handbook and the Financial Resources Rules prescribe minimum paid-up share capital and liquid-capital requirements. Applicants must demonstrate that the entity holds sufficient capital to absorb operational risks, maintain insurance coverage and meet ongoing financial-return obligations. Capital adequacy is assessed at the point of application and is subject to continuous monitoring post-licence. Detailed thresholds are set out in the Handbook; applicants should verify current figures directly with the SFC.

4. Staffing and Senior Management

   The SFC expects clearly defined roles: Chief Executive, Chief Operating Officer, Chief Risk Officer, Chief Financial Officer and a local head of compliance. Each senior officer must be individually approved as fit and proper, demonstrating relevant experience in regulated financial markets, virtual assets or technology governance. The compliance head must be based in Hong Kong and have direct reporting lines to the board. Inadequate senior management is a frequently cited ground for SFC queries early recruitment and vetting are strongly advisable.

5. Prepare Core Application Documents

   Assemble a comprehensive document pack including: a detailed business plan; audited financial statements; proof of paid-up capital; directors’ and ROs’ curriculum vitae and fit-and-proper declarations; AML/CFT policies and procedures; custody arrangements and segregation models; technology and cybersecurity architecture documentation; risk-management framework; token admission and review policies; and draft client agreements. Use the VATP application checklist to ensure completeness before submission.

6. Build Compliance Programmes

   Before lodging the application, the platform must have operational not merely drafted compliance programmes covering AML/KYC client due diligence, ongoing transaction monitoring, sanctions screening, custody and cold-storage protocols, and independent control functions. The SFC expects these to be tested and evidenced, not aspirational. Programmes must align with the Handbook’s prescriptive standards on each topic.

7. External Assessments and Third-Party Reports

   The SFC requires independent external assessments in several areas: cybersecurity penetration testing and vulnerability assessments, external audit of financial statements, and independent custodian confirmations where third-party custodians are used. Recent SFC guidance has clarified expectations for external assessment reports, including scope, methodology and qualifications of assessors. Applicants should engage qualified assessors early, as report preparation can take several months.

8. Submit via WINGS-LIC and SFC Engagement

   The formal application is lodged through the SFC’s WINGS electronic system. After submission, the SFC typically issues requests for supplementary information within four to twelve weeks. For deemed applicants, the SFC may also conduct on-site inspections as part of its assessment programme. Applicants should designate a responsive point of contact and anticipate multiple rounds of SFC queries.

9. Post-Submission: Second-Phase Assessment and Swift Licensing

   Following initial review, the SFC moves to a second-phase assessment that may include detailed operational walkthroughs, on-site visits, and a rectification plan addressing any identified deficiencies. The SFC has introduced a swift licensing track for deemed applicants that can demonstrate material compliance readiness, enabling a faster path to full licence grant subject to satisfactory resolution of findings. Industry observers expect the SFC to continue refining these expedited pathways through 2026.

Core Compliance Programmes the SFC Expects

AML/CFT and KYC

Licensed VATPs must implement robust client due diligence at onboarding, including identity verification, source-of-funds checks and enhanced due diligence for politically exposed persons (PEPs). Ongoing transaction monitoring, suspicious-transaction reporting and sanctions screening are mandatory under AMLO. Record-keeping requirements are strict: at least five years from the end of the business relationship.

Custody and Client Asset Protection

The SFC mandates segregation of client assets from proprietary assets, robust hot-wallet and cold-wallet governance (including multi-signature controls), independent attestations of asset holdings, and adequate insurance or compensation arrangements. Third-party custodians must meet the SFC’s standards for independence, security and financial standing.

Market Conduct and Surveillance

Platforms must maintain comprehensive token admission and review policies, real-time market surveillance systems to detect manipulation and wash trading, and where shared liquidity arrangements exist data-sharing protocols with counterparty platforms. The joint HKMA–SFC circular on intermediary activities provides additional guidance where tokenised securities or stablecoins are involved.

How Hong Kong Compares Requirements, Timelines, Market Access

Hong Kong’s regime stands out for its prescriptive investor-protection framework, comprehensive custody expectations and integrated AML/CFT requirements. For platforms considering stablecoins or tokenised securities, parallel requirements under the Stablecoins Ordinance and HKMA guidance add additional compliance layers that applicants must plan for from the outset.

SFC VASP Licence Hong Kong Licensing Timeline

While timelines vary according to the complexity and completeness of each application, the following indicative stages apply to most applicants:

• Pre-application preparation: 4–8 weeks (gap analysis, document assembly, governance setup).
• WINGS submission and SFC initial review: 4–12 weeks (supplementary information requests common).
• Second-phase assessment, on-site inspections and rectification: Variable often several months, depending on remediation required.
• Final decision and licence grant: Total elapsed time typically 6–12+ months for new applicants. Deemed applicants may benefit from SFC swift licensing arrangements where they can demonstrate material compliance readiness.

Common Pitfalls And How to Avoid Them

• Inadequate AML/CFT framework: Draft policies alone are insufficient the SFC expects tested, operational programmes with documented results.
• Weak custody controls: Failure to segregate client assets or to implement robust cold-storage governance is a common refusal ground.
• Senior management gaps: Missing or unqualified ROs, compliance heads or risk officers delay the process significantly.
• Incomplete documentation: Partial submissions trigger extended query cycles; use the VATP application checklist to ensure nothing is omitted.
• Insufficient financial resources: Applicants must demonstrate capital adequacy from the outset and maintain it continuously.
• Unresolved overseas regulatory issues: The SFC will investigate the applicant’s regulatory record in all jurisdictions; outstanding enforcement actions or sanctions create material risk.
• Market-surveillance gaps: Platforms without real-time manipulation detection and wash-trade monitoring face heightened scrutiny.

Estimated Costs (Indicative)

The total cost of obtaining an SFC VATP licence varies significantly depending on the applicant’s existing infrastructure, scope of services and remediation needs. The following ranges are indicative only and should be confirmed with current SFC fee schedules and qualified advisers:

• SFC filing and application fees: Relatively modest statutory fees.
• Local incorporation and paid-up capital: Varies by corporate structure and minimum capital requirements.
• Compliance staffing (first year): Industry estimates suggest annual costs of US$200,000+ for a core compliance team including AML, risk and technology officers.
• Technology and custody infrastructure: Cold-storage setup, surveillance systems, cybersecurity hardening budgets range widely.
• External assessments: Cybersecurity penetration testing, independent audits and custodian confirmations typically cost US$50,000–US$200,000+ depending on scope.
• Legal and advisory fees: One-off setup costs of US$50,000–US$500,000+ depending on complexity, with ongoing advisory retainers thereafter.

Download: VATP Application Checklist and Document Template (PDF)

Global Law Experts has prepared a downloadable pack to help applicants organise their VATP licence submission. The pack includes:

• Corporate documents list: Comprehensive schedule of entity, director and controller documents required.
• Sample AML policy outline: Structured template aligned with AMLO and Handbook requirements.
• Token admission checklist: Step-by-step assessment framework for virtual asset listing decisions.
• Custody proof template: Model documentation for segregation, cold-storage and insurance arrangements.
• Sample organisational chart: Suggested reporting-line structure meeting SFC governance expectations.

Client Case Study Swift Licensing Remediation for an Asia-Based Exchange

An Asia-headquartered centralised exchange with an existing deemed-to-be-licensed status engaged specialist counsel to address multiple SFC inspection findings ahead of the swift licensing assessment. The platform’s challenges included gaps in its AML/CFT transaction-monitoring capability, an incomplete custody segregation model and the absence of a locally based Chief Risk Officer.

Over a focused twelve-week remediation programme, the exchange recruited two Hong Kong-based senior officers, implemented real-time surveillance and sanctions-screening technology, restructured its custody architecture with independent cold-storage attestations, and completed two external cybersecurity assessments. The SFC granted the full VATP licence within five months of remediation completion significantly faster than the typical new-applicant timeline. The exchange resumed retail-eligible operations with no enforcement conditions, re-entering the Hong Kong market with strengthened compliance credentials.

Next Steps What to Read and Check Right Now

• Download the checklist: Obtain the VATP application checklist to begin organising your document pack.
• Review the SFC VATP lists: Verify your platform’s status and identify currently licensed operators on the SFC public register.
• Study the Licensing Handbook: Read the VATP Licensing Handbook explained for a section-by-section breakdown of SFC expectations.
• Prepare core governance and AML documents: Begin drafting policies and recruiting senior management early these are the most common bottlenecks.
• Understand post-licence obligations: Familiarise yourself with post‑licence compliance obligations (KYC, custody, reporting) to plan for ongoing costs and staffing from the outset.

Sources

• SFC Licensing Handbook for Virtual Asset Trading Platforms (latest edition)
• SFC Circular on Transitional Arrangements of the New Licensing Regime for VATPs (31 May 2023)
• SFC Statement on the End of Non-Contravention Period for Virtual Asset Trading Platforms
• SFC Lists of Virtual Asset Trading Platforms (Public Register)
• SFC Circulars on Second-Phase Assessment and Swift Licensing (2024–2025)
• SFC Circular on WINGS Submission Requirements for VATPs
• HKMA & SFC Joint Circular on Intermediaries’ Virtual Asset-Related Activities (22 December 2023)
• Hong Kong Government Stablecoins Ordinance Commencement Press Release (June 2025)
• LegCo Anti-Money Laundering and Counter-Terrorist Financing (Amendment) Ordinance 2022