Reading the risk in AML obligations for a virtual-asset service provider

The commercial stakes for a virtual-asset service provider entering the Hong Kong market have never been more concrete. A platform that trades, holds, or transfers virtual assets for clients is not simply building a product – it is taking on a set of AML obligations that carry licence conditions, supervisory expectations and, where they are not met, enforcement consequences. For a cross-border operator, those obligations land differently depending on where the entity sits, where its clients are, and which regulator is actually watching.

AML obligations for a virtual-asset service provider in Hong Kong are governed primarily by the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, which since 1 June 2023 has imposed a mandatory licensing regime on centralised virtual-asset trading platforms with the Securities and Futures Commission as the licensing authority. A platform that falls within the regulatory perimeter must maintain customer due diligence, transaction monitoring, record-keeping and travel-rule compliance as conditions of its licence – and failure to do so is both a regulatory and a criminal exposure.

This analysis reads the risk in five parts: what is commercially at stake; the governing regime and how its obligations bite; the cross-border interface between Hong Kong and the relevant offshore and Mainland-facing structures; a comparative read on where operators across different jurisdictions face asymmetric exposure; and our own view on where the risk is concentrated right now.

What is actually at stake for a virtual-asset operator?

The commercial question is not abstract. A virtual-asset trading platform earns revenue from transaction flow, and that flow depends entirely on the platform's ability to access banking, custody, payment rails and institutional counterparties. All of those access points are gated by AML compliance. A platform that cannot demonstrate a credible AML programme cannot open a fiat on-ramp. A platform under supervisory investigation cannot retain institutional clients. The commercial case for AML compliance is the business model itself.

In our cross-border practice, we regularly see operators who treat AML as a cost to be minimised rather than a structural condition of operation. That view does not survive contact with the Hong Kong Securities and Futures Commission's licensing process. The SFC applies AML conditions as licence conditions, not as voluntary best-practice guidance. A material deficiency in customer due diligence or transaction monitoring is grounds for refusing a licence application or withdrawing one already granted.

The stakes run beyond the Hong Kong position. A platform licensed in Hong Kong serves clients from across the Asia-Pacific region, the Middle East and Europe. Each of those client relationships imports a separate set of AML considerations: the source of funds, the client's own regulatory status, and the risk that a transaction connects to a jurisdiction with a different sanctions posture. The Hong Kong regime does not operate in isolation, and an operator that manages only the local compliance layer is missing a significant part of the exposure.

What changed on 1 June 2023 was not merely a new licensing requirement. It was the point at which operating a centralised virtual-asset trading platform in Hong Kong without a licence became a criminal offence. The commercial risk of non-compliance is no longer a regulatory fine at the end of a protracted supervisory process – it is potential criminal liability, with consequences that run to individuals within the organisation, not just the entity.

What does the governing regime actually require?

The Anti-Money Laundering and Counter-Terrorist Financing Ordinance is the primary instrument. It applies to virtual-asset service providers (VAVSPs, meaning centralised platforms that exchange, transfer, manage or administer virtual assets for clients) and imposes obligations that mirror, and in certain respects exceed, those applied to licensed banks and money service operators. The Securities and Futures Commission is the licensing authority for virtual-asset trading platforms, and where a virtual asset is a "security" or "futures contract" within the meaning of the Securities and Futures Ordinance, parallel SFC licensing obligations also apply.

The obligations cluster into four groups. First, customer due diligence: a licensed platform must identify and verify the identity of clients, understand the nature and purpose of business relationships, and conduct enhanced due diligence for higher-risk clients, politically exposed persons (PEPs – individuals who hold or have held prominent public positions and who present a heightened corruption risk) and clients connected to higher-risk jurisdictions. Second, transaction monitoring: the platform must maintain systems capable of detecting patterns that are inconsistent with a client's profile and flagging transactions for further review.

Third, record-keeping: the Ordinance requires retention of customer identification records and transaction data for defined periods. Fourth, and particularly material for cross-border operators, the travel rule (the FATF requirement that originator and beneficiary information accompanies a virtual-asset transfer): VATPs are subject to customer due diligence and the FATF travel rule for virtual-asset transfers. For a platform processing transfers to and from counterparty platforms in other jurisdictions, the travel rule requires those counterparty platforms to be identified, verified and assessed for their own compliance posture.

The travel rule is where many cross-border operators discover that their compliance architecture is built for one jurisdiction only. A Hong Kong-licensed platform receiving a transfer from an unlicensed platform in a jurisdiction with weaker AML controls cannot simply accept the transfer and document it. The SFC expects the platform to assess whether the counterparty can provide reliable originator information and to take a risk-based position on whether the transfer should proceed. That assessment cannot be outsourced to the counterparty's own assertions.

How does the cross-border interface bite in practice?

The cross-border interface for a virtual-asset service provider in Hong Kong bites at three distinct points: the structure of the operating entity, the jurisdictional origin of clients, and the settlement of transfers that touch counterparties outside the SFC's perimeter.

On structure, many operators approaching the Hong Kong licensing regime hold their platform through an offshore entity – typically in the BVI or the Cayman Islands – with a Hong Kong subsidiary or branch carrying out the regulated activity. The AML obligations attach to the entity conducting the activity in Hong Kong, regardless of where the parent sits. But the offshore structure adds a layer of risk that the local compliance team cannot fully control: the parent entity may itself be subject to AML obligations in its own jurisdiction, and a failure at the parent level can create a compliance gap that flows down to the Hong Kong entity.

On client origin, a Hong Kong-licensed platform serving Mainland Chinese clients faces a particular challenge. Virtual-asset trading is not a licensed activity in the Mainland, and a Hong Kong platform that actively markets to Mainland residents faces both regulatory scrutiny from the SFC on its client-acceptance controls and a question about whether the activity constitutes an unlicensed cross-border financial service under Mainland rules. The AML obligation to understand the source of funds is sharpened by this dynamic: a Mainland-origin client whose funds have travelled through multiple jurisdictions before arriving at the platform presents a higher-risk profile that the platform's onboarding process must be designed to detect.

On settlement, the travel rule creates a direct interface between the Hong Kong regime and every jurisdiction from which a transfer is received or to which one is sent. A platform that receives a transfer from a platform in a jurisdiction that does not implement the travel rule cannot satisfy its own travel-rule obligations by the counterparty's silence. The SFC's published guidance on AML and the regulators' AML guidelines make clear that a risk-based approach to non-compliant counterparties is required – which in practice means accepting fewer transfers from higher-risk jurisdictions rather than accepting all transfers and documenting the risk.

Consider a mid-market scenario that we have seen more than once in our practice. An operator domiciled in the UAE, licensed in that jurisdiction for virtual-asset activity, establishes a Hong Kong entity to access Asian institutional clients. The parent and the Hong Kong subsidiary share a compliance function. When the SFC conducts its pre-licence assessment, it finds that the shared compliance function is calibrated to the UAE regime's requirements and does not map directly to Hong Kong's travel-rule and enhanced-due-diligence expectations. The operator has two compliance programmes in theory and neither fully in practice. The licensing process stalls until the gap is addressed – which takes longer and costs more than building the Hong Kong programme from the outset.

Where does the comparative exposure sit across different operating models?

The risk profile of AML non-compliance is not uniform across operator types. It concentrates differently depending on whether the platform operates as a purely centralised exchange, a hybrid model with decentralised finance (DeFi – peer-to-peer financial protocols that operate without a central intermediary) components, a custody-only provider, or an over-the-counter (OTC – bilateral trading outside an exchange) desk serving institutional or high-net-worth clients.

A centralised exchange is the paradigm case for the SFC's VATP licensing regime. Its AML exposure is known and, if the compliance architecture is well-built, manageable. The SFC's inspection and supervision process is calibrated to this model. The risk for a centralised exchange is primarily operational: the volume of transactions, the velocity of onboarding, and the challenge of maintaining consistent due diligence standards across a large client base while competing commercially on speed.

A hybrid operator that combines a centralised order-book with DeFi protocol integration faces a harder problem. The AML Ordinance and the SFC's licensing conditions apply to the centralised component. The DeFi component may not be within the regulatory perimeter. But if the platform routes client funds through a DeFi protocol and back, the SFC may treat that as a compliance gap in the platform's transaction monitoring: the platform cannot monitor what happens to funds while they are in the protocol.

OTC desks are the category where AML risk concentrates most acutely. An OTC desk serving institutional clients processes large, bespoke transactions with counterparties who may themselves be subject to AML obligations in other jurisdictions. The source-of-funds question for a single OTC transaction can involve tracing through multiple blockchain addresses, multiple exchange accounts and multiple fiat on-ramps. An OTC desk that does not have the analytical capacity to conduct that tracing is not meeting the enhanced-due-diligence standard that the SFC applies to higher-risk clients and transactions.

Custody-only providers sit in a different position. Their AML exposure is concentrated in onboarding: the client whose assets are held must be identified and verified, and the provenance of the assets must be assessed. The ongoing transaction monitoring obligation is lighter than for a trading platform, but the onboarding obligation is equally demanding. A custody provider that accepts assets without a credible provenance assessment has the same exposure as a trading platform that fails to verify the source of funds on deposit.

What foreign counsel – particularly those advising operators from jurisdictions with less developed virtual-asset regimes – frequently miss is that the SFC's AML requirements are not merely a checklist. They are a standard of conduct that is assessed holistically against the risk profile of the operator's business. An operator that passes each individual checklist item but whose compliance function lacks the analytical capacity to handle complex cross-border transactions will not satisfy the SFC on a supervisory review.

The stablecoin dimension and what it adds to the AML picture

The AML risk for virtual-asset service providers is complicated further by the emergence of fiat-referenced stablecoins (digital tokens designed to maintain a fixed value relative to a fiat currency, such as the US dollar or Hong Kong dollar) as a significant settlement and liquidity instrument in Asian markets. A Hong Kong Monetary Authority licensing regime for fiat-referenced stablecoin issuers commenced in 2025 – parties should verify the current commencement date and perimeter before acting on it.

The practical significance for a VATP is this: if a platform accepts stablecoins as a deposit instrument or uses them as an internal settlement medium, it is now handling assets that may themselves be subject to a separate regulatory perimeter. The AML obligations for the platform do not change, but the risk assessment for a stablecoin transfer must account for the issuer's own AML posture and the degree to which the stablecoin's issuance structure is transparent.

A platform that accepts an inbound transfer denominated in a fiat-referenced stablecoin from a counterparty in a jurisdiction without a stablecoin regulatory regime has a travel-rule problem and a source-of-funds problem simultaneously. The travel rule requires originator information. The source-of-funds obligation requires the platform to understand how the stablecoin was acquired. If the counterparty cannot provide that information, the platform cannot complete the transaction without a documented risk assessment.

We have seen operators in our practice treat stablecoin transfers as if they were fiat transfers, applying bank-equivalent AML processes to an instrument that moves faster, settles irreversibly and has a more opaque chain of custody than a bank wire. That equivalence is not valid. The SFC's expectations for stablecoin-related transactions, read alongside the HKMA's emerging framework, are that the platform understands both the technical structure of the stablecoin and the regulatory status of its issuer. Those are two capabilities that most compliance teams do not yet have as standard.

Where the risk sits now: the Lockhart & Yip read

In our view, the risk for virtual-asset service providers in Hong Kong is concentrated in three areas at this moment.

The first is the gap between licensing status and operational reality. A platform that has obtained a licence or is in the licensing process is subject to ongoing supervisory expectations that begin from the date of the licence application, not from the date the licence is granted. Operators who build their compliance function to the standard required to obtain the licence and then fail to maintain it at that standard during the early operating period face a disproportionate regulatory risk.

The second is the travel-rule implementation gap. The FATF travel rule applies to virtual-asset transfers, and the SFC expects licensed platforms to implement it. Many platforms in the region have not yet built the technical infrastructure to transmit and receive originator and beneficiary information reliably across different blockchain networks and different counterparty platforms. A platform that is not operationally compliant with the travel rule is non-compliant with a licence condition, regardless of how strong the rest of its AML programme is.

The third is the oversight of cross-border clients and structures. A platform licensed in Hong Kong but serving clients connected to the Mainland, to the UAE, to CIS jurisdictions or to European family offices is handling a client base whose AML risk profiles are markedly different. A compliance programme calibrated to the average retail client on an Asian platform will not meet the enhanced-due-diligence standard for a Mainland-connected OTC client or a politically exposed person connected to a CIS jurisdiction. The SFC's supervisory focus in enforcement actions has consistently landed on the quality of the enhanced-due-diligence process for higher-risk clients, not on routine retail onboarding.

The objection we hear most often from operators in this position is that building a compliance function capable of handling the full risk spectrum is a competitive disadvantage relative to unlicensed platforms that face no such obligation. That objection has not persuaded any regulator, and it will not persuade the SFC. The commercial reality is that institutional clients, banking partners and large-volume counterparties will not engage with a platform that cannot demonstrate a credible AML programme. The compliance cost is a market access cost, not merely a regulatory burden.

If an earlier licensing application, structure or compliance assessment produced an adverse or stalled result, a second read can identify the gap and the routes still open. The strategic errors we see most frequently are fixable – but they require an honest assessment of the gap between the existing compliance architecture and the SFC's current expectations.

A practical map of the decision points

The sequence for a cross-border operator approaching AML compliance in Hong Kong runs through a defined set of decision points. The mapping below is illustrative; the governing regime and the SFC's current guidance are the operative sources.

Where the operator is a centralised trading platform accepting both retail and institutional clients, the risk profile is highest for the institutional and OTC segment. The instrument is the Anti-Money Laundering and Counter-Terrorist Financing Ordinance; the route is SFC licensing with VATP-specific AML conditions; the timing turns on the date the platform commenced operation in Hong Kong relative to 1 June 2023; the risk is the criminal exposure for unlicensed operation compounded by the ongoing supervisory risk for a compliance programme that does not meet licence conditions.

Where the operator is an offshore-incorporated entity establishing a Hong Kong subsidiary or branch, the instrument is the same but the structural question matters: the AML obligations attach to the Hong Kong-facing entity, and a compliance programme built for the parent jurisdiction will not automatically satisfy Hong Kong requirements. The route is a structured mapping exercise to identify the gaps before the SFC's pre-licence assessment does.

Where the operator is a DeFi-integrated platform or an OTC desk, the regulatory perimeter is less clearly defined, but the direction of travel is towards inclusion. Parties should verify the current SFC position on hybrid models before relying on any assumed exemption. The risk of assuming an exemption that is not confirmed is greater than the cost of seeking a preliminary view.

For all operator types, the stablecoin dimension adds a layer that requires separate assessment of both the technical structure of any stablecoin used and the regulatory status of its issuer.

The sequence above describes the standard position. Your matter turns on the specific jurisdictions engaged, the structure of the operating entity, and the composition of the client base – which is where the risk profile is built and where the route is won or lost. For a structured assessment of your AML obligations and licensing position across the relevant jurisdictions, write to us at info@lockhartyip.com.

What foreign advisers and operators consistently miss

Cross-border operators entering Hong Kong from the US, Europe, or less regulated offshore centres bring compliance frameworks calibrated to their home environments. The US approach to virtual-asset AML – driven by the Bank Secrecy Act and FinCEN guidance – is not the same as the SFC's approach. European operators familiar with the EU's Transfer of Funds Regulation (the EU's travel-rule instrument for crypto-asset service providers) find that the travel rule is structurally similar but operationally different: the Hong Kong regime applies to transfers between VATPs, but the mechanics of compliance across different blockchain networks are not standardised in the same way as SEPA-based fiat transfers.

The gap that surprises most operators is the SFC's expectations around governance and senior management accountability. A Hong Kong-licensed VATP is expected to have senior management with defined responsibility for AML compliance. That responsibility is personal, not merely institutional. The SFC's enforcement posture has consistently included individual accountability as a component of action against platforms with AML deficiencies. An operator whose AML function reports to a group compliance team sitting in another jurisdiction, with no senior individual in Hong Kong responsible for the Hong Kong compliance programme, does not meet that governance standard.

A second point that foreign counsel frequently overlook is the interaction between the AML regime and the sanctions posture. Hong Kong implements United Nations sanctions and does not give domestic effect to the unilateral measures of other states. An operator whose compliance programme incorporates US Office of Foreign Assets Control lists or EU restrictive measures as its primary sanctions filter is applying the wrong sanctions standard for Hong Kong purposes. The operative regime is the United Nations Sanctions Ordinance, applied by the relevant Hong Kong authorities. For a platform with a global client base, managing a multi-jurisdiction sanctions posture without conflating the Hong Kong standard with the US or EU standard is a material compliance challenge.

Counsel on our desk regularly see the consequences of a compliance programme that conflates the US and Hong Kong sanctions regimes. The practical risk runs in both directions: the platform may be over-blocking transactions that are permissible under Hong Kong law, creating commercial friction, or under-blocking transactions that are caught by UN-derived obligations. Neither error is without consequence.

Related practices and internal references

The analysis above engages the interface between virtual-asset licensing, AML obligations and the cross-border structures through which operators typically establish their Hong Kong presence. Two further areas of the firm's practice bear directly on these questions.

Related practices

• Sanctions & AML – compliance programme design, sanctions-neutral contracting, and source-of-funds analysis for cross-border operators
• Holding Structures – structuring the offshore and Hong Kong entity layer for regulated virtual-asset operators

For further reading on the regulatory engagement process and the entity structuring questions that arise alongside it, see our briefing at Fintech entity regulatory engagement in Hong Kong and our matter note at Token issuance reviewed under the Hong Kong regime. Our full Tech & Web3 practice is described at lockhartyip.com/practices/tech-web3/.

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.