A Comprehensive Guide to Hong Kong's Upcoming Virtual Asset VASP Licensing Regime
TechFlow Selected TechFlow Selected
A Comprehensive Guide to Hong Kong's Upcoming Virtual Asset VASP Licensing Regime
This article will help you better understand Hong Kong's Virtual Asset Service Provider (VASP) licensing regime, which will take effect on June 1, by covering the revision background of the VASP system, definitions of virtual assets and virtual asset services, VASP license application requirements, exchange compliance requirements, the dual-license system, and transitional arrangements.
Navigating Web3 tides with focused insightsAuthor:Attorney Liao Wang and Attorney Gu Jiening, guest writers for Beosin
In response to the "Policy Statement on the Development of Virtual Assets in Hong Kong" issued in October 2022, aiming to position Hong Kong as an international virtual asset hub, the Legislative Council of Hong Kong passed the latest amendment to the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) on December 7, 2022. This marks the official implementation of Hong Kong’s new licensing regime for virtual asset service providers (VASPs), effective from June 1, 2023.
On February 20, 2023, the Securities and Futures Commission (SFC) released the VASP Consultation Paper, followed by the VASP Consultation Summary on May 23, confirming that the "Guidelines for Virtual Asset Trading Platform Operators" (VASP Guidelines) would take effect on June 1, 2023. After more than half a year of preparation, this signifies Hong Kong's proactive embrace of the new VASP regime with an open attitude toward the virtual asset market. From that date onward:
-
All centralized virtual asset exchanges operating in Hong Kong or actively marketing their services to Hong Kong investors—regardless of whether they offer trading in security tokens—must obtain a license from the SFC and be subject to its supervision.
-
The SFC will finalize arrangements in the second half of the year to allow licensed virtual asset exchanges to serve retail investors, but only non-security tokens with high liquidity included in traditional financial indices may be offered to retail clients.
-
Regarding stablecoins, regulatory frameworks will be implemented in 2023/24, establishing a licensing and authorization system for stablecoin-related activities. Prior to such regulation, the SFC considers that stablecoins should not be made available for retail trading.
This article aims to help readers better understand Hong Kong’s upcoming VASP licensing regime—effective June 1—by examining key aspects including the background of the VASP regime revision, definitions of virtual assets and virtual asset services, VASP license application requirements, exchange compliance obligations, dual licensing framework, and transitional arrangements.
1. Background of the VASP Regime Revision
In the VASP Consultation Paper, the SFC clearly explained the rationale behind establishing the new VASP regime: during the prolonged crypto winter, consecutive market collapses have heightened risks in the virtual asset sector—especially the FTX collapse, which caused massive losses for millions of investors. The increasing interconnection between virtual and traditional financial markets underscores the importance and necessity of effective regulation over the virtual asset industry. Major jurisdictions globally are shifting their regulatory approaches—from permissive oversight (mainly focused on anti-money laundering and payments) to comprehensive regulation (centered on investor protection).
The SFC has been ahead of many other jurisdictions, having gradually established a "voluntary licensing" regime for security token platforms as early as 2018. Under this framework, the SFC had no authority to regulate platforms solely trading non-security virtual assets or tokens. Under the voluntary licensing model, platforms dealing exclusively with non-security tokens were not required to hold licenses. Only two virtual asset exchanges obtained licenses under this regime: OSL Digital Securities Limited (under BC Technology Group) and Hash Blockchain Limited (under HashKey Group), both receiving Type 1 (dealing in securities) and Type 7 (providing automated trading services) licenses.
Today, the virtual asset industry has undergone significant transformation. The original "voluntary licensing" regime can no longer adequately cover today’s market landscape—dominated by retail investors and primarily focused on non-security token trading. To comprehensively regulate all centralized virtual asset trading platforms in Hong Kong and align with the latest standards set by the Financial Action Task Force (FATF), the Hong Kong government revised the AMLO and introduced a new mandatory VASP licensing regime, aiming to strike a more appropriate balance between investor protection and market development. Once the VASP regime takes effect, all centralized virtual asset exchanges operating in Hong Kong or actively promoting services to Hong Kong investors—regardless of whether they provide security token trading—will require an SFC license and be subject to regulatory oversight.
2. Virtual Assets and Virtual Asset Services
Under the context of the mandatory VASP licensing regime, it is crucial to clarify what constitutes a virtual asset and what qualifies as a virtual asset service.
2.1 What Is a Virtual Asset?
According to Section 53ZRA of the AMLO and the VASP Guidelines, a virtual asset (VA) is broadly defined as:
(a) A cryptographically secured digital representation of value that meets the following criteria:
(1) Expressed as a unit of account or a store of economic value;
(2) Meets at least one of the following:
A. Used or intended to be used as a medium of exchange accepted by the public for one or more of the following purposes: (I) payment for goods or services; (II) debt settlement; (III) investment; or
B. Provides rights, entitlements, or access to vote on matters related to the management, operation, governance, or changes to the terms of arrangements concerning any cryptographically secured digital representation of value;
(3) Capable of being transferred, stored, or traded electronically; and
(4) Possesses other characteristics specified by the SFC from time to time via notice in the Gazette;
(b) Any digital representation of value designated as a virtual asset by the Financial Services and Treasury Bureau of Hong Kong through publication in the Gazette.
(c) Any security token, i.e., a cryptographically secured digital representation of value that constitutes a "security" as defined in Part 1, Division 1, Schedule 1 of the Securities and Futures Ordinance (SFO).
Section 53ZRA of the AMLO excludes the following from the definition of VA:
(1) Digital currencies issued by central banks, entities performing central bank functions, or authorized entities acting on behalf of central banks (CBDCs);
(2) Limited-purpose digital tokens (non-transferable, non-exchangeable, and non-fungible in nature, e.g., gift cards, customer loyalty rewards, electronic payment instruments);
(3) Stored value facilities (regulated under the Payment Systems and Stored Value Facilities Ordinance);
(4) Securities or futures contracts (regulated under the SFO).
The AMLO’s definition of VA covers most major cryptocurrencies in the market, including BTC, ETH, stablecoins, utility tokens, and governance tokens. Regarding stablecoins, the SFC stated in the Consultation Summary: The Hong Kong Monetary Authority released the "Summary of Responses to the Discussion Paper on Crypto Assets and Stablecoins" in January 2023, announcing plans to implement stablecoin regulations in 2023/24, establishing a licensing and authorization regime for stablecoin-related activities. Until then, the SFC believes stablecoins should not be made available for retail trading.
NFTs derive their attributes from the underlying assets, and there is currently no clear definition under the VASP regime. On June 6, 2022, when the SFC reminded investors of NFT risks, it noted that if an NFT is a genuine digital representation of a collectible (e.g., artwork, music, or video), related activities fall outside the SFC’s regulatory scope. However, some NFTs blur the line between collectibles and financial assets and may possess characteristics of "securities" under the SFO, thereby becoming subject to regulation.
2.2 What Are Virtual Asset Services?
According to Schedule 3B of the AMLO and the VASP Guidelines, virtual asset services refer to operating a virtual asset exchange, specifically:
(a) Providing, via electronic facilities, a service where:
(1) Offers to buy or sell virtual assets are regularly made or accepted in a manner that forms or results in binding transactions; or
Individuals are regularly introduced or identified to each other to negotiate or complete virtual asset trades, or are introduced with a reasonable expectation that such negotiations or trades will occur in a way that forms or results in binding transactions; and
(2) Client funds or client virtual assets are held directly or indirectly by the service provider; and
(b) Any off-platform virtual asset trading activities and ancillary services provided by the platform operator to its customers, and any actions taken in connection with such off-platform trading.
Therefore, both (1) centralized virtual asset exchanges operating in Hong Kong and (2) offshore-based centralized exchanges actively marketing their services to Hong Kong investors fall within the scope of virtual asset services if engaging in the above activities. According to Section 53ZRD of the AMLO, any entity conducting virtual asset services must obtain a VASP license from the SFC.
Currently, aside from the above-defined virtual asset services, other business activities such as market making, proprietary trading, futures contracts, and derivatives are not permitted. However, the Financial Services and Treasury Bureau may later include additional services via gazette announcements.
3. VASP License Application
Under the new VASP regime, the SFC will issue licenses and conduct supervision based on the AMLO and VASP Guidelines. Applying for a VASP license imposes stringent requirements on both the company and its personnel:
A. Company Requirements: 1. Must be a company incorporated in Hong Kong with a fixed office location; 2. Minimum capital of HK$5 million and liquid capital exceeding HK$3 million; 3. Subsidiaries or affiliated companies must hold a Hong Kong trust TCSP license for virtual asset custody.
B. Personnel Requirements: 1. Applicants, responsible officers (ROs), licensed representatives, directors, and ultimate beneficial owners must pass the SFC’s fit-and-proper test; 2. At least two ROs with experience in virtual asset services must be appointed, satisfying the following: at least one RO must be an executive director of the VASP; at least one RO must habitually reside in Hong Kong; and at least one RO must always supervise operations; 3. At least one RO must also be a licensed representative; 4. An auditor with experience in virtual asset businesses is required.
C. Compliance Requirements: In addition to meeting corporate and personnel qualifications, applicants must establish a comprehensive compliance framework, including a business viability assessment report, AML/CTF, and client asset management systems. Per detailed VASP Guidelines, additional requirements include fitness standards, competence criteria, ongoing training, business conduct principles, financial soundness, platform operations involving virtual assets, prevention of market manipulation and misconduct, client transaction practices, client asset protection, management and internal controls, cybersecurity, conflict of interest mitigation, record keeping, auditor independence, and continuous reporting and notification duties.
4. Exchange Compliance Requirements
Per the VASP Guidelines, centralized virtual asset exchanges must meet the following compliance obligations:
A. Safeguarding Client Assets
Platform operators must hold client funds and virtual assets in trust through a wholly-owned subsidiary (i.e., a “linked entity”) holding a TCSP trust license. No more than 2% of client virtual assets should be stored in hot wallets.
Moreover, since accessing virtual assets requires private keys, secure key management is essential. Platform operators must establish written internal policies and governance procedures for securely generating, storing, and backing up all cryptographic seeds and keys.
Additionally, platform operators must not deposit, transfer, lend, pledge, re-pledge, or otherwise trade client virtual assets, nor create any encumbrances over them. They must also maintain insurance coverage for risks associated with holding client virtual assets.
B. Know Your Customer (KYC)
Platform operators must take all reasonable steps to verify each client’s true identity, financial status, investment experience, and investment objectives. Before offering any services, operators must ensure clients fully understand virtual assets, including associated risks.
C. Anti-Money Laundering / Counter-Terrorist Financing (AML/CTF)
Platform operators must establish robust AML/CTF policies, procedures, and monitoring mechanisms. They may use blockchain analytics tools to trace virtual asset records on public ledgers.
D. Conflict of Interest Prevention
Platform operators must not engage in proprietary trading or market-making activities and must establish employee trading policies to eliminate, avoid, manage, or disclose actual or potential conflicts of interest.
E. Listing Virtual Assets for Trading
Platform operators must establish a dedicated function responsible for setting, implementing, and enforcing criteria for listing virtual assets, suspending or delisting assets, and client opt-in rights.
Furthermore, operators must conduct thorough due diligence before listing any virtual asset and ensure continued compliance with listing criteria.
F. Prevention of Market Manipulation and Misconduct
Platform operators must establish written policies and monitoring measures to detect, prevent, and report market manipulation or suspicious trading activities. Monitoring systems should enable trading restrictions or suspensions upon detection of misconduct. Operators must deploy effective market surveillance systems from reputable independent vendors capable of identifying, monitoring, detecting, and preventing manipulative behaviors, and must grant the SFC access to these systems.
G. Accounting and Auditing
Platform operators must exercise due care in selecting auditors, considering their experience, track record, and capability in auditing virtual asset-related businesses. An annual auditor’s report must be submitted, including a statement on compliance with applicable regulations. Additionally, operators must submit monthly activity reports to the SFC within two weeks after each calendar month and upon request.
H. Risk Management
Platform operators must establish a robust risk management framework to identify, measure, monitor, and manage all business and operational risks. Customers must pre-fund their accounts, and no leverage or financing may be offered for purchasing virtual assets.
5. Dual Licensing Regime
Based on different regulatory authorities, the SFC will regulate security token trading on virtual asset exchanges under the SFO (requiring Type 1 and Type 7 licenses), while regulating non-security token trading under the AMLO (requiring a VASP license).
Given that the nature of virtual assets may evolve over time—for example, transitioning from non-security to security tokens—virtual asset exchanges should seek dual licensing under both the SFO and the AMLO to avoid breaching licensing requirements (i.e., applying for both a VASP license and Type 1/Type 7 licenses).
To streamline the process, applicants seeking licenses under both regimes need only submit a single online application form indicating their intent to apply for both licenses simultaneously.
The SFC expects that dual-licensed operators will satisfy both sets of reporting and notification requirements through a single submission.
6. Transitional Arrangements
The AMLO provides transitional arrangements for "existing virtual asset exchanges," allowing a transition period until June 1, 2024. Eligibility applies to exchanges already operating in Hong Kong before June 1, 2023, with meaningful and substantial business presence, including (1) licensed or license-applying exchanges under the SFO, and (2) unlicensed exchanges operating under the SFO with non-security tokens.
Eligible exchanges must meet conditions listed in Schedule 3G of the AMLO to continue operations in Hong Kong from June 1, 2023, to May 31, 2024, and will become subject to the VASP licensing regime starting June 1, 2024.
Operators submitting a license application to the SFC within nine months after June 1, 2023, and confirming their commitment to comply with SFC regulations, may be treated as provisionally licensed until the SFC makes a final decision. During this period, they may continue operations until the earliest of: (i) 12 months post-application, (ii) withdrawal of application, (iii) rejection by the SFC, or (iv) issuance of a license.
If an application is rejected, the operator must cease virtual asset services within three months of notification or by June 1, 2024, whichever is later. During this wind-down period, operators may only take actions purely necessary to close operations. Extensions may be requested from the SFC, granted at the SFC’s discretion based on the operator’s circumstances.
For "new virtual asset exchanges" planning to operate in Hong Kong after June 1, 2023, a VASP license must be obtained from the SFC prior to commencing services.
7. The End of "Regulatory Arbitrage"
Under the AMLO, violations and non-compliance—including providing virtual asset services without a license or failing to meet AML/CTF requirements—are subject to penalties. Notably, actively marketing services to the Hong Kong public constitutes providing virtual asset services, regardless of where the service provider is located.
After June 1, 2023, operating a virtual asset service without a VASP license is a criminal offense. Upon conviction on indictment, offenders face fines up to HK$5 million and seven years’ imprisonment, plus daily fines of HK$100,000 for ongoing violations. On summary conviction, fines up to HK$5 million and two years’ imprisonment apply, with daily fines of HK$10,000 for continuing offenses.
Failure to comply with statutory AML/CTF obligations renders licensed operators and responsible individuals criminally liable, punishable upon conviction by up to HK$1 million fine and two years’ imprisonment. In addition to criminal penalties, they may face disciplinary actions from the SFC, including license suspension or revocation, censure, corrective orders, and monetary penalties.
Moreover, various forms of misconduct during exchange operations may result in additional disciplinary fines imposed by the SFC.
Compared to other jurisdictions—particularly in East Asia—Hong Kong previously maintained a relatively lenient regulatory environment for virtual asset trading. This attracted numerous exchanges, large and small, to establish headquarters or operational centers in Hong Kong. However, with the introduction of the "VASP crypto policy," Hong Kong is moving away from being a haven for regulatory arbitrage.
8. Conclusion
With the imminent implementation of the VASP regime, all stakeholders—including (1) existing virtual asset exchanges in Hong Kong; (2) offshore exchanges actively targeting Hong Kong investors; (3) new entrants planning to launch exchanges in Hong Kong; and (4) traditional financial institutions entering the virtual asset space—must proactively prepare for compliance and licensing applications.
The VASP regime represents Hong Kong’s effort to channel virtual asset activities into regulated pathways (“directing water into canals”), making KYC and AML compliance paramount. Following this initial step, we can expect further detailed rules in the second half of the year regarding retail investor access and investor protection. As the saying goes, “with great power comes great responsibility.” Only by meeting regulatory standards can exchanges fairly participate in this growing market and contribute to its sustainable development.
We foresee an inevitable shift—“the East rising as the West declines.” Amid FTX’s collapse and tightening U.S. regulation amid political tensions, Hong Kong, leveraging its strong foundation in traditional finance, robust legal system, and strategic proximity to mainland China’s vast resources, is poised to reclaim its former glory as a leading global crypto hub.
Join TechFlow official community to stay tuned
Telegram:https://t.me/TechFlowDaily
X (Twitter):https://x.com/TechFlowPost
X (Twitter) EN:https://x.com/BlockFlow_News
0xWillmfer
