Reading the risk in a virtual-asset trading platform

A licence means little if the risk underneath it is not mapped before the application goes in. For operators seeking a virtual-asset trading platform (VATP, a centralised exchange for virtual assets regulated under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance) licence in Hong Kong, the commercial question is not whether to apply. It is whether the structure, the counterparty book, and the compliance architecture can survive the scrutiny that comes with it. Most applicants find out the hard way that the licensing gate and the ongoing obligation are two different problems – and that the second is harder than the first.

The mandatory VATP licensing regime in Hong Kong, administered by the Securities and Futures Commission, commenced on 1 June 2023. It subjects centralised virtual-asset trading platforms to customer due diligence, the FATF travel rule (the requirement to transmit originator and beneficiary information alongside virtual-asset transfers), and continuous supervision obligations that sit alongside – and in some respects exceed – those applied to conventional licensed securities dealers.

This analysis examines the commercial stakes, the governing instruments, the cross-border interface between Hong Kong's regime and the systems of the jurisdictions operators most commonly trade with, and our assessment of where the live risk sits for operators active or seeking to become active in this market. The argument is not that the licence is prohibitive. It is that operators who read the risk narrowly – as a licensing checklist rather than a structural compliance question – create exposure that compounds over time.

What is actually at stake commercially for VATP applicants?

The commercial answer is straightforward: Hong Kong is the only major common-law jurisdiction in Asia with a fully operational mandatory licensing regime for centralised virtual-asset exchanges, and the licence carries with it both market access and reputational weight that unlicensed venues cannot replicate. For a platform with users, counterparties, or settlement flows touching Greater China, the GCC, or European institutional investors, Hong Kong licensure is fast becoming a threshold condition for counterparty acceptance and banking access.

That weight, however, creates its own pressure. The Securities and Futures Commission applies a standard of conduct that is materially similar to the standard it applies to licensed securities dealers. Governance requirements, responsible-officer accountability, client-asset segregation, and ongoing reporting are all live obligations from the date of licence, not aspirational targets. An operator that treats the licence as a marketing badge rather than an operational commitment will find the gap between its practice and the SFC's expectations closing – under enforcement conditions.

There is a second commercial dimension that operators frequently underestimate. The VATP licence does not eliminate the question of which virtual assets are securities or futures contracts. Where a listed token meets the definition under the Securities and Futures Ordinance, an additional licensing layer applies. Operators with diversified token listings must therefore run a continuous product-governance function that assesses each asset against both the VATP perimeter and the securities-law perimeter. That is not a one-time legal opinion; it is an ongoing compliance function with a direct line to trading decisions.

In our cross-border practice, we regularly see platforms that have resolved the licensing question but have not resolved the product-governance question. The exposure sits in the gap.

How do the governing instruments actually work – and where do they interact?

The VATP licensing regime derives its legal authority from the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, amended to bring centralised virtual-asset trading platforms within its regulatory perimeter. The Securities and Futures Commission is the licensing authority and the primary ongoing supervisor. The Hong Kong Monetary Authority enters the picture on two fronts: first, as the regulator responsible for the fiat-referenced stablecoin licensing regime that commenced in 2025 (parties should verify the current commencement date and perimeter before acting); and second, as the prudential regulator of the banks through which licensed platforms settle and hold client fiat.

The FATF travel rule applies to VATPs through the AML/CTF Ordinance framework. In practical terms, this means that a platform must, on each virtual-asset transfer, collect and transmit the name, account number, and address of the originator, and the name and account number of the beneficiary. For transfers below a defined threshold, a simplified form of the obligation applies – but parties should verify the current threshold position before relying on any simplified treatment.

Where a virtual asset is also a security or a futures contract under the Securities and Futures Ordinance, the platform must hold the relevant SFO licence. The analysis here is fact-specific and asset-by-asset. The governing question is whether the asset carries the economic characteristics of a security: a return tied to the efforts of others, a share in an enterprise, or a contractual right of a financial character. Platforms that list a wide universe of tokens without running that analysis for each asset carry a regulatory position they cannot fully describe – which is itself a problem when the SFC asks them to describe it.

The stablecoin dimension adds a third instrument to the picture. A platform that lists or settles in fiat-referenced stablecoins issued by entities subject to the HKMA regime must understand how its own obligations interact with the issuer's obligations. That interface is not yet fully settled in practice; counsel on our desk sees it as a live structuring question for platforms planning their listed-asset universe.

How does the cross-border interface bite – and which systems matter?

For most VATP applicants, the cross-border interface operates on at least three axes: the origin of users and counterparties, the location of group entities, and the jurisdiction of settlement infrastructure. Each axis carries its own regulatory consequence that the Hong Kong licence does not address and does not resolve.

Consider the axis of user origin. A Hong Kong-licensed VATP serving users resident in Mainland China faces a fundamental conflict. The Mainland's position on virtual-asset trading by residents is restrictive, and a licensed Hong Kong platform serving Mainland users without adequate geo-restriction and user-onboarding controls creates exposure not only to Mainland enforcement action against users, but to SFC concern about whether the platform's AML and know-your-client procedures are fit for the user base it actually has. The SFC does not regulate Mainland law, but it does regulate the robustness of a licensee's compliance framework – and a framework that ignores the regulatory status of its largest user segment is not robust.

The axis of group entity location raises a different question. Many VATP applicants are part of groups with holding entities in the BVI, the Cayman Islands, or offshore centres. The Hong Kong entity that holds the licence must be the entity that operates the platform. It must have the substance – people, systems, decision-making – to justify the licence. Where the substance is largely located in an offshore or foreign group entity, the SFC will probe the governance line. This is not a theoretical concern; it is a consistent theme in the SFC's supervisory engagement with the sector.

The third axis – settlement infrastructure – is where the travel rule creates its most acute cross-border difficulty. A platform that settles through on-chain transfers to wallets held in jurisdictions that have not implemented the FATF travel rule will encounter counterparties that cannot or will not comply with the transmission requirement. The platform cannot simply not comply on the grounds that the counterparty system cannot receive the data. Its obligation runs to the SFC regardless of what the counterparty jurisdiction has or has not done. Operators must build a technical and operational solution to this gap – and that solution looks different depending on whether the counterparty wallet is custodied, self-hosted, or held at a regulated VASP in a travel-rule-compliant jurisdiction.

What foreign counsel – particularly those advising from US or EU bases – consistently get wrong is the assumption that Hong Kong's AML obligations track the EU's Transfer of Funds Regulation or the US FinCEN framework in a way that allows for easy compliance mapping. They do not. The instrument is the AML/CTF Ordinance, the supervisor is the SFC, and the practical questions about threshold, wallet type, and unhosted wallet treatment require analysis under the Hong Kong instrument, not a transposition of another regime's conclusions.

The comparative read: Hong Kong versus the principal competing regimes

It is worth positioning Hong Kong's VATP regime against the regimes most commonly cited by applicants considering their venue options. The comparison is not academic; it shapes how a platform designs its holding structure, its user book, and its product list.

Singapore operates a digital payment token services licensing regime under its Payment Services Act. The two regimes differ in perimeter, scope of licensed activities, and the specific conduct requirements applied to custody and trading. Platforms that hold licences in both jurisdictions – or that operate a group where one entity is licensed in each – must run parallel compliance functions. The two regimes do not harmonise; they must be managed in parallel. The question of which entities within a cross-border group serve which users, and under which licence, is a structuring question that must be resolved before either application goes in.

The UAE – specifically the Dubai Virtual Assets Regulatory Authority and the Abu Dhabi Global Market – has emerged as a third centre. For platforms seeking to serve GCC-region users, UAE licensing may be a practical necessity regardless of what the Hong Kong entity holds. The interaction between a DIFC or ADGM licence and a Hong Kong VATP licence is again a structuring question, not a licensing checklist. Which entity contracts with which counterparty, which law governs those contracts, and which jurisdiction's courts or arbitral bodies would hear a dispute – these are the questions that determine whether the cross-border structure is coherent or merely licensed.

The EU's Markets in Crypto-Assets Regulation (MiCA, the EU-wide regime for crypto-asset service providers that applies from late 2024) creates a third point of reference for platforms with European institutional users or European group entities. MiCA's passporting mechanism is EU-internal and has no treaty relationship with Hong Kong's regime. A Hong Kong-licensed platform serving EU institutional clients must either ensure its EU-side entity holds a MiCA authorisation or ensure that the cross-border service falls within an available exemption under the relevant member state's rules. Neither answer is automatic.

Across all three comparisons, the consistent point is that the Hong Kong VATP licence resolves the Hong Kong regulatory question and no other. Platforms that treat it as a global compliance solution misread the instrument.

Where does the live risk actually sit for licensed and applicant platforms?

Our desk's read, across the matters we have handled and the applicant positions we have reviewed, is that the live risk concentrates in four areas. None of them is the licensing gate itself. All of them are structural or operational.

The first is token-admission governance. The SFC expects a licensee to have a documented, repeatable process for assessing each virtual asset before it is made available for trading. That process must address the securities-law question, the AML risk rating of the asset, and the liquidity and market-integrity considerations. Platforms that have a process on paper but not in practice – where the paper process was not followed for specific listings – carry a gap that is almost always visible in a supervisory review.

The second is the responsible-officer accountability line. The regime places personal regulatory accountability on designated responsible officers. Where the actual decision-making on compliance matters runs through senior figures who do not hold the responsible-officer designation, the governance line does not reflect reality. The SFC reads governance by reference to what actually happens, not what the chart says.

The third is client-asset segregation and the fiat interface. The SFC requires client assets – both virtual assets and fiat – to be held separately from the platform's own assets. For the fiat side, this means the platform needs banking relationships that support a segregation model. Banking access for VATP licensees remains operationally difficult; platforms that have solved the licensing question but not the banking question are operationally constrained in a way that affects their ability to meet client-asset obligations in real time.

The fourth, and in our view the most systematically underweighted, is the AML source-of-funds position on the client book. A platform that has run know-your-client procedures to onboarding standard but has not built an ongoing transaction-monitoring function calibrated to the specific risk profile of its users is compliant at T=0 and non-compliant thereafter. Virtual-asset transaction monitoring requires both on-chain analytics tools and the human capacity to act on alerts. Platforms that have the tools but not the people, or the people but not the documented escalation path, carry an ongoing gap.

An Asian fintech group with a Cayman holding entity and a Hong Kong VATP applicant subsidiary came to us in the second half of last year. The licence application was substantively ready; the question was whether the group structure, and in particular the intragroup service agreements that placed key compliance and technology functions outside the Hong Kong entity, would satisfy the SFC's substance requirements. We reviewed the governance line and the intragroup contracts, identified the functions that needed to be formally vested in the Hong Kong entity, and prepared the restructured governance framework before the application was lodged. The application proceeded on a basis the group could explain to the SFC without qualification.

The sequence the above describes is the standard one for well-prepared applicants. The typical failure mode is the reverse: the application is lodged, the SFC asks governance questions, and the restructuring happens under regulatory scrutiny rather than before it.

The sequence above describes the standard position. Your matter turns on the documents, the jurisdictions actually engaged, and the order of steps – which is where the route is won or lost. To discuss how the VATP licensing and AML obligations apply to your cross-border position, contact info@lockhartyip.com.

How does the stablecoin regime change the picture for VATP operators?

The HKMA's fiat-referenced stablecoin licensing regime, which commenced in 2025 (parties should verify the current commencement date and perimeter before acting), introduces a distinct regulatory layer that intersects with the VATP regime in ways that are not yet fully mapped in practice. A VATP that lists a fiat-referenced stablecoin on its platform must understand whether its listing and trading activities in respect of that stablecoin bring it within the stablecoin regime's perimeter, or whether the HKMA regime bites only on the issuer.

The practical question for a VATP is this: if a stablecoin issuer is required to hold an HKMA licence, and the VATP lists that issuer's stablecoin, does the VATP have due-diligence obligations running to the issuer's regulatory status? The answer – in the absence of definitive SFC or HKMA guidance on the interface – is that a prudent VATP will treat the issuer's regulatory status as a material input into its token-admission governance process. A stablecoin issued by an entity that should hold an HKMA licence but does not is a different compliance risk from one issued by a licensed entity; the token-admission process should reflect that difference.

For platforms that settle internally in a stablecoin – using it as a functional equivalent of fiat for intraplatform settlement – the question is sharper still. The travel rule applies to virtual-asset transfers. An intraplatform settlement in a stablecoin that involves a change of beneficial ownership is, on one reading, a virtual-asset transfer for travel-rule purposes. Platforms that have adopted stablecoin settlement without working through the travel-rule consequences of that model carry a structural gap that is not obvious at the operational level but is immediately visible in an AML audit.

If an earlier filing, structure or compliance design has produced a gap or a stalled engagement with the SFC or HKMA, a second read of the position can identify the structural error and the routes still open. For a structured assessment of your stablecoin-related VATP obligations across the relevant Hong Kong instruments, write to us at info@lockhartyip.com.

Our analytical read: where is this heading?

The direction of travel in Hong Kong's virtual-asset regulatory regime is towards convergence with the standards applied to conventional securities and banking intermediaries. That convergence is not complete, and the speed of travel is uneven across different aspects of the regime. But the regulatory signal – from the SFC's supervisory engagement, from the HKMA's entry into the stablecoin space, and from the government's stated policy of positioning Hong Kong as a responsible virtual-asset hub – is consistent.

What this means in practice for VATP operators is that the compliance gap between where the sector currently is and where the regulator expects it to be is likely to narrow under enforcement conditions rather than by voluntary upgrade. The SFC's track record in the conventional securities sector suggests that it moves from supervisory engagement to enforcement action when gaps persist after they have been identified. Operators who treat the VATP compliance requirements as aspirational rather than obligatory are pricing in a regulatory risk that is, in our assessment, systematically underpriced.

The cross-border dimension compounds this. A platform operating across Hong Kong, Singapore, and a GCC jurisdiction is managing three regulatory relationships simultaneously. The failure mode in that structure is not usually a hard regulatory conflict; it is the gradual drift of the actual business away from the structural and governance assumptions that each licence was granted on. Managing that drift – keeping the governance line, the substance, and the compliance function aligned with the licensed structure as the business evolves – is the ongoing work. It is not a one-time legal exercise.

For groups considering whether to apply for a VATP licence, or reviewing their position under an existing licence, the relevant question is not whether they can pass the licensing gate. Most well-resourced applicants can. The question is whether they can sustain the ongoing compliance posture that the licence requires, across the jurisdictions they actually operate in, over the medium term. That question is structural, not documentary.

We regularly advise on the structural and governance questions that determine whether a VATP applicant or licensee is positioned to meet that standard. The work begins before the application and continues through the lifecycle of the licence.

The objection answered: is Hong Kong licensing worth the compliance cost?

The prevailing myth among operators considering their venue options is that Hong Kong licensing imposes a compliance burden disproportionate to the commercial return – that a lighter-touch offshore structure delivers equivalent market access at lower cost. That reading is increasingly outdated.

The commercial reality is that institutional counterparties, prime brokers, and sophisticated users increasingly require or strongly prefer engagement with entities that hold a licence in a recognised, well-supervised jurisdiction. Hong Kong's common-law system, its position within the Greater China economic sphere, its banking infrastructure, and its treaty relationships make it a credible and commercially valuable licensing venue for platforms with Asian business. The compliance cost is real; so is the cost of not being licensed when a counterparty, a bank, or a user requires it.

The more precise objection – that the VATP compliance requirements are uncertain in some areas and that the SFC's supervisory approach is still developing – is better-founded. Our response to that objection is that uncertainty is a reason to engage proactively with the regime, not a reason to defer. A platform that participates in the market while the regime develops has the opportunity to shape its compliance function alongside the regulatory development. A platform that defers until certainty arrives will find that certainty arrived in the form of an enforcement action against competitors, and the window for orderly compliance has narrowed.

Counsel on our desk sees the compliance-cost objection most frequently from platforms that have built their governance and operations for a lighter regulatory environment and are now pricing the cost of upgrading to VATP standard. For those platforms, the question is not whether to upgrade – it is in what sequence, and with what structural changes, the upgrade can be made in an orderly way rather than under regulatory pressure.

Related practices

Sanctions & AML – AML obligations, counterparty screening, and source-of-funds analysis for cross-border operators
Holding Structures – offshore and Hong Kong holding entity design for regulated financial groups

Frequently asked questions

How long does a virtual-asset trading platform licence in Hong Kong usually take?

The Securities and Futures Commission does not publish a fixed processing timetable for VATP licence applications, and timelines vary materially with the completeness of the application, the complexity of the applicant's group structure, and the volume of applications under review. Well-prepared applicants with resolved governance, substance, and AML-framework questions move faster than those that require iterative supplementary rounds with the SFC. Parties should verify the current processing position with the SFC or with counsel before relying on any indicative period.

What documents are needed for a virtual-asset trading platform licence in Hong Kong?

A VATP licence application requires, at minimum, a detailed business plan, a governance and management structure description with responsible-officer particulars, the platform's AML and counter-terrorist-financing policies and procedures, a client-asset protection framework, a risk-management framework, and a token-admission policy. The SFC may require further supplementary materials depending on the specifics of the applicant's model. Documentation should be reviewed by counsel experienced in the VATP regime before submission; deficiencies in the initial filing extend the process materially.

What is the first step in a virtual-asset trading platform licence in Hong Kong?

The first step is a structural and governance assessment of the applicant entity and its group before any application materials are prepared. This means confirming that the Hong Kong entity that will hold the licence has the substance, decision-making authority, and governance line to support the licence; that the product universe has been assessed for the securities-law overlap; and that the AML and travel-rule framework is operationally implementable. Submitting the application before those questions are resolved is the most common and most avoidable cause of delay.

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.

Reading the risk in a virtual-asset trading platform licence in Hong Kong