Exploring the Compliance Pathway for Traditional Finance to Enter Hong Kong's Web3 Virtual Asset Market through the VASP Regime
TechFlow Selected TechFlow Selected
Exploring the Compliance Pathway for Traditional Finance to Enter Hong Kong's Web3 Virtual Asset Market through the VASP Regime
To wear the crown, one must bear its weight. Only by meeting regulatory requirements can market participants join in sharing this enormous pie and drive the long-term development of the market.
Navigating Web3 tides with focused insightsAuthors: Will Awang, Gu Jiening
Introduction
Following the release of the "Policy Statement on the Development of Virtual Assets in Hong Kong" in October last year, Hong Kong's Virtual Asset Service Provider (VASP) regime—the so-called "crypto new policy"—officially took effect on June 1, 2023. This marks a significant milestone and major boost for China’s virtual asset industry. All stakeholders have been actively preparing to enter Hong Kong’s Web3 virtual asset market.
Comparing the $1 trillion virtual asset market with the $487 trillion traditional financial market, whether Hong Kong—the “hexagonal warrior” of finance—can seize this opportunity to become the financial hub of the digital world will largely depend on support and guidance from traditional finance. This article analyzes the ecosystem positioning of regulated entities under Hong Kong's VASP regime (centralized virtual asset exchanges), examines virtual asset market access through Hong Kong financial licenses, and reviews current preparations by various players, aiming to map out a compliant pathway for traditional finance to enter Hong Kong’s Web3 virtual asset market.
Ecosystem Positioning of CEXs
Centralized Exchanges (CEXs) are the apex predators in the market. Due to regulatory lag, CEXs integrate roles equivalent to those of exchanges, banks, brokers, futures firms, trusts, asset managers, and payment settlement institutions in traditional finance, covering nearly all aspects of the virtual asset ecosystem. At first glance, CEXs appear "too big to fail," but even FTX—once the world’s second-largest exchange—collapsed in just 10 days due to internal fraud. This led to the U.S. Securities and Exchange Commission (SEC) proposing new custody rules for virtual assets, aiming to split CEX operations (e.g., separating market-making and trading from custody) to prevent conflicts of interest and self-custody abuse.
Although the U.S. has yet to establish a unified virtual asset regulatory framework, and despite intense political battles among regulators over jurisdiction, the U.S. does have relatively corresponding laws and regulations governing specific CEX business segments—many of which are already practically enforceable and serve as useful references. We can better understand the ecosystem positioning of CEXs by examining Coinbase, a compliant centralized virtual asset exchange listed in the U.S.
As shown above, Coinbase partners with crypto-friendly banks—such as Silvergate Bank (though many like Silvergate and Signature Bank have since collapsed under political pressure)—and leverages networks like Silvergate’s SEN real-time cryptocurrency settlement system to provide fiat-to-crypto deposit and withdrawal services. This is the crucial first step of “channeling water into the canal,” where regulation primarily focuses on KYC, anti-money laundering (AML), and counter-terrorism financing (CTF).
After “channeling water into the canal,” Coinbase offers investors one-stop, full lifecycle crypto services: crypto trading (exchange function), derivatives trading (futures), financial product investments (brokerage), brokerage services, institutional crypto custody (trust/banking), crypto payment settlements (financial payments), and venture capital activities (asset management). Investors can also use Coinbase’s self-custody wallet to access decentralized ecosystems such as DEXs, DeFi, NFTs, and GameFi.
At this stage, regulatory focus shifts toward investor protection. It’s clear that CEXs consolidate numerous functions from traditional finance that require strict oversight. In the U.S., these crypto-related activities are largely brought under corresponding traditional financial regulatory frameworks. The SEC and other regulators continue pushing compliance through their “Regulation by Enforcement” approach.
Below is a brief summary of Coinbase’s compliance pathway in the U.S., provided for reference:
Access to Hong Kong Virtual Asset Financial Licenses
Compared to Coinbase’s comprehensive ecosystem and the U.S.’s extensive network of corresponding regulations, Hong Kong’s new VASP regime currently only targets CEX platforms. A market consisting solely of platforms and users cannot form a vibrant, diverse ecosystem—we must also bring in asset management, investment advisory, and related services. For Hong Kong’s Web3 virtual asset market to thrive, it will undoubtedly require strong support and guidance from traditional finance. Below, we analyze the 10 types of financial licenses regulated by the Securities and Futures Commission (SFC) (meticulously compiled by Shanghai Manqin Law Firm) to clarify how traditional finance can compliantly enter Hong Kong’s Web3 virtual asset market.
Crypto On/Off-Ramps (Banking License)
According to news reports, Chinese-funded banks in Hong Kong—including Bank of Communications (Hong Kong), Bank of China (Hong Kong), SPDB Hong Kong Branch—and virtual banks such as ZA Bank, are either already providing banking services to local virtual asset companies or have begun investigating the space. Officials from the Hong Kong Monetary Authority (HKMA) have stated: “There is no legal or regulatory requirement prohibiting banks operating in Hong Kong from providing banking services to virtual asset-related entities.”
It is evident that licensed banks in Hong Kong (authorized by HKMA) will act as on/off-ramps for crypto, directly or indirectly playing the role of “channeling water into the canal” and enabling investor onboarding. Direct models include ZA Bank planning to launch virtual asset trading services for retail investors through partnerships with licensed local virtual asset exchanges, pending regulatory approval—a powerful strategic move leveraging its user base. Indirect models include HashKey PRO, which has partnered with ZA Bank and Bank of Communications (Hong Kong) as settlement banks to offer fiat deposit and withdrawal services.
Centralized Virtual Asset Exchanges (VASP License)
Under the revised Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) 2022 and the Guidelines for Virtual Asset Trading Platform Operators (VASP Guidelines), from June 1, 2023, all centralized virtual asset exchanges operating in Hong Kong or actively marketing their services to Hong Kong investors must obtain an SFC license and be subject to its supervision, regardless of whether they offer security token trading.
Depending on regulatory scope, the SFC regulates security token trading on virtual asset exchanges under the Securities and Futures Ordinance (Type 1 + Type 7 licenses), while non-security token trading falls under AMLO and requires a VASP license. In practice, existing SFC-licensed operators such as OSL and HashKey Group—which already hold Type 1 (securities dealing) and Type 7 (automated trading service) licenses—must still apply for a VASP license to offer non-security virtual asset services.
News reports indicate that many traditional CEXs are actively preparing VASP license applications. Traditional financial institutions such as Tiger Brokers and Greenland Financial Holdings are reportedly interested in applying. Interactive Brokers, the global automated electronic broker, has launched cryptocurrency trading in Hong Kong via a partnership with OSL, allowing its professional clients to trade Bitcoin (BTC) and Ethereum (ETH).
Since the AMLO and VASP Guidelines define “virtual asset services” solely as operating a virtual asset exchange, only exchange-related entities currently fall under the VASP regulatory framework. Other virtual asset activities remain governed by previous regimes. However, the Financial Services and Treasury Bureau may expand the definition via gazette notice in the future to include additional virtual assets and services.
Virtual Asset Custody (TCSP Trust License)
The VASP Guidelines require CEX operators to “safeguard client assets” by holding client funds and virtual assets in trust through a wholly-owned subsidiary (a “connected entity”) licensed as a Trust or Company Service Provider (TCSP). This means compliant CEXs under the VASP regime must hold both a VASP license and a TCSP license, with the latter ensuring independent custody of investor assets to prevent internal misuse.
Since traditional banks can only hold fiat assets, virtual asset custody must currently be conducted via trust accounts, creating new business opportunities for TCSP license holders. Companies offering virtual asset custody—whether wallet providers or institutional custodians—typically require a TCSP license. Examples include exchanges such as OSL, HashKey Group, and Gate.io Group, each operating their own TCSP trust companies. Additionally, Liminal, an infrastructure and digital asset custody provider, recently obtained a TCSP license.
Virtual Asset Asset Management (Type 9 License + Uplift)
The Type 9 license alone only permits traditional asset management services and does not cover virtual asset management. Therefore, licensed asset managers wishing to hold more than a certain threshold of virtual assets in their portfolios must undergo an “uplift” process—submitting additional documentation to the SFC for approval beyond the standard Type 9 license. While there are over 2,000 Type 9 licensees in Hong Kong, by the end of 2022, only six—New Fire Asset Management, Lion Rock Global Asset Management, MaiCapital, Fore Elite Capital, and others—had received SFC approval to manage portfolios invested in virtual assets.
Prior to 2018, the SFC could only regulate virtual asset management if the underlying assets qualified as “securities” or “futures contracts” under Schedule 1 of the Securities and Futures Ordinance. The SFC’s 2017 statement on ICOs clarified that offering trading services, advice, or managing/promoting funds investing in tokens that qualify as securities constitutes a “regulated activity.” However, this left many non-security virtual assets in a regulatory gray zone, undermining investor protection.
On November 1, 2018, the SFC issued a statement outlining a regulatory framework for managers of virtual asset portfolios, fund distributors, and platform operators, extending oversight to non-security virtual assets and broadening its reach across the crypto sector. On October 4, 2019, the SFC further released the “Standard Terms and Conditions for Licensed Corporations Managing Portfolios Investing in Virtual Assets” (“Terms and Conditions”), a landmark turning point in Hong Kong’s approach to virtual assets, mandating additional licensing for fund managers whose portfolios allocate over 10% to crypto assets, beyond the standard Type 9 license.
Specifically, licensed firms must comply with SFC regulation if they manage funds that: (a) explicitly target virtual asset investments; or (b) invest 10% or more of total portfolio value in virtual assets. Here, “virtual assets” refer to digitally represented value, including digital tokens (cryptocurrencies, utility tokens, asset-backed tokens), virtual commodities, crypto assets, or similar instruments, regardless of whether they qualify as “securities” or “futures contracts” under the SFO.
The Terms and Conditions require virtual asset fund managers to maintain liquid capital of at least HK$3 million or higher variable thresholds, and impose detailed requirements based on best execution, fair dealing, and disclosure principles—covering order allocation, related-party transactions, and cross-trading. Furthermore, stringent conditions apply in areas including AML/CFT compliance, fund auditing, asset custody, risk management, daily operations, marketing, and risk disclosures.
Notably, firms distributing funds to qualified Hong Kong investors typically also need a Type 1 license (securities dealing).
Other Virtual Asset Activities
Since the AMLO and VASP Guidelines narrowly define “virtual asset services” as operating a virtual asset exchange, only exchange-related entities are currently within the VASP regulatory framework. Derivatives trading, proprietary trading, market making, staking, and other services are not yet covered. However, the Financial Services and Treasury Bureau may expand the scope via official gazette announcements in the future.
Regarding stablecoins, the SFC stated in its consultation summary: The HKMA published a consultation summary on “Crypto Assets and Stablecoins” in January 2023, announcing plans to implement a licensing regime for stablecoin-related activities in 2023/24. Until then, the SFC advises against including stablecoins in retail offerings.
NFTs derive their nature from underlying assets and currently lack clear classification under the VASP regime. In a June 6, 2022 warning, the SFC noted that if an NFT is a genuine digital representation of a collectible (e.g., art, music, video), related activities fall outside SFC regulation. However, some NFTs blur the line between collectibles and financial assets and may qualify as “securities” under the SFO, thus becoming subject to regulation.
New Pathways in Real-World Asset Tokenization (RWA)
Real-World Asset (RWA) tokenization refers to converting the monetary value of physical assets into digital tokens, enabling their value to be represented and traded on blockchains. RWAs can represent various traditional assets—tangible or intangible—including commercial real estate, bonds, precious metals, artworks, wine, and virtually any store-of-value asset. Tokenization enhances liquidity, tradability, financing options, transparency, and value.
Since the Policy Statement, the Hong Kong government has taken several RWA-related initiatives. On February 16, 2023, it successfully issued an HK$800 million tokenized green bond—the first bond issued under Hong Kong law and among the world’s first government-issued tokenized green bonds. Future initiatives like the digital Hong Kong dollar will involve fiat-backed stablecoins. The government is also working to further legitimize Security Token Offerings (STOs), opening new financing channels for illiquid, non-standard markets such as real estate, private debt and equity, and art.
Traditional financial institutions—including Goldman Sachs, Hamilton Lane, Siemens, and KKR—have announced efforts to tokenize their real-world assets. Native crypto DeFi protocols like MakerDAO and Aave are also adapting to support RWA integration. With their rich financial assets and resources, traditional financial institutions can enter Hong Kong’s RWA market, industrialize virtual assets, and enable finance to empower the real economy.
Compliance Practices for Traditional Finance Entering Hong Kong’s Web3 Market
Applying HashKey Group’s business model to the Coinbase framework, we see a relatively complete compliant CEX structure emerging, with each component mapped to a corresponding regulatory regime: fiat on/off-ramps (via bank partnerships), security token trading (Type 1 + Type 7 licenses), non-security token trading (VASP license), custody (TCSP license), and venture investments (Type 9 license). Clearly, Hong Kong’s VASP regime swiftly and precisely targets CEXs.
Conclusion
In an August 2022 video titled “What Are Crypto Trading Platforms?”, SEC Chair Gary Gensler outlined the SEC’s regulatory approach toward CEXs: (1) Protect investor interests using the well-established 90-year-old U.S. Securities Act; (2) Split CEX operations (e.g., separate market-making/trading from custody) to avoid conflicts of interest and self-theft.
This was vividly demonstrated during the FTX collapse, prompting the SEC’s proposed custody rule reforms. Historical precedents such as the 1933 Glass-Steagall Act (separating commercial and investment banking after the Great Depression) and the 2010 Dodd-Frank Act (curbing speculative proprietary trading and strengthening derivatives oversight post-subprime crisis) were born from painful financial crises.
Hong Kong’s VASP regime has learned from these lessons. First, it uses CEXs to “channel water into the canal,” where KYC, AML, and CTF are paramount. Next comes the question of retail access: How should investor protection be ensured? How should the definitions of virtual assets and services be gradually expanded? We expect a series of detailed rules to emerge in the second half of the year. To wear the crown, one must bear its weight. Only by meeting regulatory requirements can market participants fairly share in this massive opportunity and drive long-term market growth.
Policy tailwinds are never without deeper causes. From a geopolitical perspective, could tensions between China’s CIPS RMB cross-border payment system and the dollar-based SWIFT system accelerate the development of borderless, permissionless blockchain-based payment networks? Could Hong Kong seize the “Web3 virtual asset” narrative—so aligned with its identity—to reinvigorate its financial leadership? We don’t yet know. But what we can see today is favorable timing, location, and human synergy—and unmistakably, the wind is rising in Hong Kong.
Join TechFlow official community to stay tuned
Telegram:https://t.me/TechFlowDaily
X (Twitter):https://x.com/TechFlowPost
X (Twitter) EN:https://x.com/BlockFlow_News
0xWillmfer
