Where a virtual-asset trading platform licence

The commercial reality for any group operating or intending to operate a centralised virtual-asset exchange in Asia is stark: Hong Kong has moved from a disclosure-based opt-in model to a mandatory licensing regime, and the window for operating outside that regime has closed. The Securities and Futures Commission – the SFC (Hong Kong's integrated financial regulator, responsible for securities, futures and, since June 2023, virtual-asset trading platforms) – is the authority that decides who operates and who does not. That decision now carries cross-border weight. A platform licensed in Hong Kong can engage institutional and retail counterparties across the region with a credible regulatory passport in hand. A platform that is not licensed, or that operates in a grey posture, faces a different calculation entirely.

A virtual-asset trading platform licence in Hong Kong is a mandatory requirement for any centralised exchange offering trading services to the Hong Kong public under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, with the licensing regime having commenced on 1 June 2023; the SFC is the sole licensing authority, and where a platform's virtual assets include securities or futures contracts, the Securities and Futures Ordinance applies in parallel.

This analysis covers what is actually at stake commercially, how the governing instruments interact, where the cross-border interface bites, and where our desk sees the risk sitting now. It is written for general counsel, compliance officers and principals at groups that are already licensed, in the application pipeline, or re-evaluating their structure in light of the current enforcement posture.

What is commercially at stake for a licensed or unlicensed platform?

The licensing question is, at its core, a market-access question. Hong Kong's regime creates a tiered commercial reality: licensed platforms can offer their services to retail participants in Hong Kong and carry the imprimatur of SFC authorisation in their counterparty relationships across the region. Unlicensed platforms cannot. That is not a theoretical distinction. It determines whether institutional prime brokers, custodians and fiat on-ramp banks will onboard the platform at all.

The stakes extend beyond Hong Kong's own market. A platform that has navigated the SFC's standards – capital adequacy, custody segregation, conflicts management, cybersecurity and AML – has, in effect, demonstrated a compliance baseline that several other Asia-Pacific regulators treat as a reference point in their own review processes. That demonstration effect has commercial value beyond the licence itself.

The reverse is equally true. A group that has been refused a licence, had conditions imposed, or that continues to operate without one faces not only enforcement risk in Hong Kong but reputational damage that carries across the jurisdictions in which its trading volume actually sits. In our cross-border practice, we see this play out most acutely for platforms with a Mainland Chinese user base operating through a BVI or Cayman holding structure: the offshore wrapper does not insulate the platform from SFC jurisdiction if the services reach Hong Kong participants.

The commercial question, therefore, is not whether to engage with the licensing regime. It is how to engage with it efficiently, in the right sequence, and with a structure that can sustain the ongoing obligations once the licence is granted.

What instruments govern the regime and how do they interact?

The mandatory licensing regime for centralised virtual-asset trading platforms in Hong Kong is established under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, as amended to create the VATP (virtual-asset trading platform) licensing framework. The SFC administers the regime and issues detailed licensing conditions that function, in practice, as secondary legislation: they set the capital requirements, the custody standards, the conflicts and token-admission rules, and the ongoing reporting obligations.

A separate and concurrent layer applies where any virtual asset traded on the platform is a security or futures contract within the meaning of Hong Kong law. In that case, the Securities and Futures Ordinance applies as well, requiring the platform to hold the appropriate SFC licence for dealing in securities or futures. The practical consequence is that many platforms in Hong Kong need to engage with both regimes simultaneously: the VATP licence under the AML/CTF Ordinance and the securities-dealer or futures-dealer licence under the SFO.

The AML/CTF Ordinance also carries the FATF travel rule (the Financial Action Task Force requirement that originator and beneficiary information accompany virtual-asset transfers above a defined threshold) into the Hong Kong licensing conditions. Compliance with the travel rule is an operational obligation, not merely a best-practice standard, for licensed VATPs. The travel rule interface creates a direct cross-border complication: when a Hong Kong-licensed platform transfers assets to or receives assets from a platform in a jurisdiction that has not fully implemented the travel rule, the data-completeness problem sits with the Hong Kong licensee.

The stablecoin layer is a separate and developing instrument. The Hong Kong Monetary Authority has moved to introduce a licensing regime for fiat-referenced stablecoin issuers (issuers of digital assets pegged to fiat currencies such as the Hong Kong dollar or the US dollar). The HKMA, not the SFC, is the licensing authority for stablecoin issuers. A platform that lists a fiat-referenced stablecoin therefore operates at the intersection of two regulatory regimes and two regulators. Parties should verify the current commencement position of the HKMA stablecoin regime before relying on any description of its scope or requirements.

How does the cross-border interface between Hong Kong and the Mainland bite in practice?

The most significant cross-border interface for Hong Kong-based virtual-asset platforms is the boundary between Hong Kong and Mainland China. The Mainland has maintained a prohibition on domestic virtual-asset trading and exchange services; the relevant Mainland regulatory posture is not permissive in this space, and that posture is not changing on any disclosed timeline. A Hong Kong-licensed platform cannot lawfully extend its services into the Mainland market. That seems obvious stated plainly – but the operational reality is more nuanced.

A BVI holding company owns a Hong Kong-licensed operating entity. The platform's technology infrastructure or certain back-office functions sit with an affiliate in the Mainland. Marketing is conducted in Mandarin and reaches Mainland users through channels that are nominally offshore. The SFC's licensing conditions require the platform to implement controls that address this kind of structural ambiguity. Where the platform cannot demonstrate that its services are genuinely not reaching Mainland participants, it faces a compliance gap – one that the SFC has indicated it will treat seriously.

The cross-border enforcement interface also matters in the other direction. If a Mainland counterparty or user sustains a loss in connection with a Hong Kong-licensed platform's activities, the question of which court will hear the claim and which law governs the contractual relationship is live and often under-addressed in the platform's terms of service. Since the Mainland Judgments in Civil and Commercial Matters (Reciprocal Enforcement) Ordinance took effect on 29 January 2024, a Mainland judgment on a civil or commercial claim can be registered and enforced in Hong Kong through the Court of First Instance, provided it meets the ordinance's connection-based requirements and falls within its scope. Platforms whose user agreements are silent on forum selection and governing law are exposed to that enforcement risk in a way that was less practically significant under the older, exclusive-jurisdiction-based regime.

Counsel on our desk regularly see platforms that have addressed the SFC's front-door requirements with care but have left the cross-border contractual and enforcement architecture in a state that creates residual exposure. The licensing application and the user-facing legal documentation need to be considered as a single risk-management exercise, not two separate workstreams.

The sequence above describes the standard position. Your matter turns on the documents, the jurisdictions actually engaged, and the order of steps – which is where the route is won or lost. For a structured assessment of your VATP licensing position and its cross-border implications, write to us at info@lockhartyip.com.

What does the comparative read across Hong Kong and the principal offshore centres look like?

For a group assessing where to house its regulated virtual-asset exchange, Hong Kong is not the only option being evaluated. Singapore, the UAE, and certain offshore centres with their own licensing regimes are part of the same conversation. The comparative read matters, because the choice of licensing jurisdiction determines which institutional relationships the platform can access, which users it can serve, and which enforcement and regulatory risks it accepts.

Hong Kong's regime is distinctive in at least two respects. First, it sits within a common-law system with English as an official language of the courts and a strong tradition of judicial independence. For platforms whose counterparty base includes international institutional participants, that legal context is a genuine commercial differentiator. Second, the SFC's standards – particularly on custody segregation and the separation of client assets from platform assets – are among the most prescriptive in the region. That prescriptiveness is a burden during the application process and a costly ongoing obligation. But for a platform that can meet those standards, it is also a signal to the market that carries weight.

The offshore holding structure that typically sits above a Hong Kong-licensed operating entity – commonly a BVI or Cayman Islands company – does not itself hold the licence. The licence is held by the Hong Kong entity. The offshore holding entity is subject to its own substance requirements under the economic-substance regimes of those jurisdictions, and the interplay between the holding structure and the licensed entity's capital requirements needs to be managed across both layers. A platform that capitalises the Hong Kong entity by loan from the BVI holding company needs to consider how that debt instrument is characterised by the SFC in its assessment of the platform's financial soundness.

Consider a mid-market exchange operator with a Cayman holding structure and a primarily Southeast Asian user base that approached our desk in early 2026. The group had obtained regulatory acknowledgment in a lighter-touch jurisdiction but wanted SFC licensing to access Hong Kong institutional prime brokerage relationships. The cross-border question was not merely which licence to hold but how to restructure the existing holding chain, the capital flows and the user-agreement architecture to satisfy SFC requirements without triggering adverse tax or substance consequences in the Cayman layer. The sequencing of those steps – structure first, application second, documentation third – was the substance of the engagement.

Where does the AML obligation sit, and why does it matter across jurisdictions?

The AML obligations for a Hong Kong-licensed VATP are extensive and explicitly cross-border in their application. Under the AML/CTF Ordinance, licensed platforms must conduct customer due diligence (CDD) – the process of verifying the identity of customers and understanding the nature and purpose of the business relationship – on all customers, apply enhanced due diligence to higher-risk customers and politically exposed persons, and maintain transaction monitoring systems that flag unusual patterns. These are not aspirational standards; they are licensing conditions, and the SFC reviews compliance with them as part of both the licensing assessment and the ongoing supervisory cycle.

The cross-border dimension of the AML obligation is most acute in two areas. First, the travel rule: when a Hong Kong-licensed VATP sends virtual assets to a counterparty platform or wallet, it must transmit the originator and beneficiary information required by the FATF travel rule. Where the receiving entity is in a jurisdiction that has not implemented the travel rule, or where the receiving address is a self-hosted wallet, the Hong Kong platform faces a compliance decision – it cannot simply transmit assets and rely on the counterparty to complete the data chain. The SFC's guidance on travel-rule compliance has developed alongside the regime, and platforms should maintain a current view of the regulator's published position.

Second, the source-of-funds obligation. A significant proportion of the user base of Hong Kong-facing platforms has connections to Mainland China, where the channels by which funds have moved into Hong Kong – and into virtual assets – can be complex. The SFC's customer due diligence expectations require the platform to understand those channels and to escalate where the position is unclear. Platforms that have relied on self-certification by customers, without adequate supporting documentation, have found that position difficult to sustain in supervisory review.

If an earlier filing, structure or enforcement attempt produced an adverse or stalled result, a second read can identify the strategic error and the routes still open. For a review of your AML and cross-border compliance position, contact info@lockhartyip.com. You may also find our guide on AML obligations for virtual-asset service providers a useful companion to this analysis.

What does a well-prepared licence application actually require?

The practical answer to what an SFC VATP licence application requires is not found in a checklist. It is found in the preparatory work that the SFC expects to see evidenced before a formal application is made. The SFC's licensing process involves a detailed review of the applicant's business model, its governance and ownership structure, its compliance and risk-management arrangements, its financial resources and capital position, and its operational resilience and cybersecurity standards. Each of those reviews requires documented evidence, not narrative assertion.

In our experience, the applications that progress most efficiently are those where the applicant has addressed three prior questions before the application is filed. First, is the holding and ownership structure transparent and defensible? The SFC will require a full group structure chart with ultimate beneficial owners identified, and any complexity in the holding chain – offshore vehicles, nominee arrangements, trust structures – will require explanation. Second, is the compliance function resourced and independent? The SFC expects a responsible officer and a compliance officer who are resident in Hong Kong, experienced in financial regulation, and genuinely independent of the front-office commercial function. Third, is the technology infrastructure subject to documented and tested controls? The custody, cybersecurity and business-continuity expectations are prescriptive, and the documentation of those controls – not merely their existence – is what the SFC reviews.

A platform with a BVI holding company, a Hong Kong-licensed operating entity, and a technology team distributed across Southeast Asia faces a structural question at each of these three points. The answers are available, but they require coordination across multiple workstreams and across multiple advisers in multiple jurisdictions. The role of international counsel in that process is to hold the cross-border read – to ensure that what the SFC sees in Hong Kong is consistent with the position in the holding jurisdiction and the operational jurisdictions, and that the sequencing of corporate steps, filings and compliance implementations is designed to avoid the gaps that create supervisory concern.

What does foreign counsel typically miss, and where does the risk sit now?

Counsel advising on virtual-asset regulation from outside Hong Kong frequently underestimate two features of the SFC regime. The first is the depth of the SFC's ongoing supervisory engagement after a licence is granted. Licensing is not a one-time event; it is the beginning of a regulatory relationship that involves periodic inspections, ad hoc information requests, and a detailed scrutiny of the platform's compliance with its licence conditions. Platforms that have treated the licence application as the finish line, rather than the starting line, have found themselves unprepared for that engagement.

The second underestimated feature is the SFC's approach to the boundary between its virtual-asset regime and its securities regime. Many virtual assets – particularly governance tokens, tokenised securities and certain structured products issued on-chain – sit at or near the line between a virtual asset and a security. The SFC has published guidance on where it draws that line, but the guidance requires ongoing application to specific tokens as market practice develops. A platform that lists a token without conducting a documented securities-law analysis of that token's characteristics is exposed to a regulatory finding that it has been dealing in unlicensed securities – a separate and more serious category of breach than a licensing-condition failure.

Consider the position of a platform that, in the period immediately after the regime commenced in June 2023, continued to operate under the transitional arrangements while building out its compliance infrastructure. The transitional period is no longer available. Any platform that has not either obtained a licence or filed a credible application and is still engaging Hong Kong participants is now operating in an enforcement risk position, not a regulatory-grey position. The SFC has indicated that it treats continued operation without a licence, after the close of the transitional window, as a matter for enforcement rather than further guidance.

Where does the risk sit now? In our assessment, the primary risk for groups in this space is not the initial licensing hurdle – it is the ongoing compliance obligation for licensed platforms and the enforcement exposure for unlicensed platforms that have not made a clean exit from the Hong Kong market. The two populations require different responses. For licensed platforms, the work is sustaining compliance with conditions that continue to evolve. For unlicensed platforms with residual Hong Kong exposure, the work is a structured assessment of how that exposure can be mapped, documented and managed.

A second scenario that our desk handles regularly is the group that holds a licence in one jurisdiction – say, a regulated exchange in the UAE or a registered entity in an EU member state under the relevant EU crypto-asset regulation – and wishes to extend into Hong Kong without fully understanding that the Hong Kong regime requires its own separate licence and does not provide for mutual recognition with other regulatory regimes. Regulatory authorisation in one jurisdiction is not a passport into Hong Kong's licensed market. That misunderstanding, when it persists into the point at which the platform begins to engage Hong Kong participants, creates an enforcement risk that is both avoidable and significant.

Our read: where the regulatory environment is heading

The direction of travel in Hong Kong's virtual-asset regulatory environment is towards greater convergence between the VATP regime and the broader financial-services regulatory structure. The SFC's approach to VATPs is increasingly analogous to its approach to licensed securities dealers and futures brokers – the same logic of capital adequacy, client-asset protection, conflicts management and supervisory engagement applies. That convergence is deliberate. It reflects a policy position that virtual-asset trading platforms are financial intermediaries and should be regulated as such.

The development of the HKMA's stablecoin regime adds a second regulatory pillar alongside the SFC's VATP framework. For a platform that handles fiat-referenced stablecoins – whether as a listed asset, a settlement medium or a custody holding – the question of which regulator has primary oversight over which function will require ongoing attention. The two regulators operate different regimes, with different licensing criteria and different supervisory expectations. A platform caught between the two without a clear view of how its activities are characterised under each regime is in a genuinely complex position.

The cross-border enforcement architecture has also shifted since the Mainland Judgments (Reciprocal Enforcement) Ordinance took effect. Platforms whose user base includes participants with Mainland connections, and whose terms of service do not address forum and governing law with precision, are exposed to enforcement dynamics that the old regime made more remote. That shift is not a reason to avoid the Hong Kong market – quite the reverse. But it is a reason to ensure that the legal architecture around the platform's user relationships is as carefully considered as the architecture of the compliance function itself.

Our view is that the current period is one in which the distance between well-structured and poorly structured platforms is widening. The well-structured platform – with a clear holding architecture, a licensed Hong Kong operating entity, a documented AML and travel-rule compliance programme, and a user-agreement framework that addresses cross-border enforcement risk – is in a position to engage the institutional market and to withstand supervisory scrutiny. The poorly structured platform is accumulating risk on several fronts simultaneously. The regulatory environment in Hong Kong is sufficiently developed that the choice between those two positions is, at this point, a choice that can be made deliberately.

For a full picture of our approach to virtual-asset matters, including the holding and AML dimensions, see our Tech & Web3 practice and our note on a virtual-asset trading platform licence matter.

Related practices

Sanctions & AML – cross-border AML compliance, travel rule and source-of-funds analysis for virtual-asset groups
Holding Structures – BVI and Cayman holding structures above Hong Kong licensed entities, substance and capital-flow sequencing

Frequently asked questions

What is the first step in a virtual-asset trading platform licence in Hong Kong?

The first step is a pre-application assessment of the group's ownership and holding structure, its compliance and governance arrangements, and whether any virtual assets it proposes to list engage the parallel Securities and Futures Ordinance regime. This structural read – completed before a formal filing is made with the SFC – identifies the gaps that are most likely to delay or complicate the application, and determines the order in which corporate, compliance and documentation workstreams need to proceed. Filing without that preparatory review tends to generate supervisory queries that extend the process significantly.

Which jurisdiction's law applies to a virtual-asset trading platform licence in Hong Kong?

The licensing requirements are governed by Hong Kong law – principally the Anti-Money Laundering and Counter-Terrorist Financing Ordinance and, where securities or futures are involved, the Securities and Futures Ordinance. However, the platform's holding structure, its user agreements and its enforcement exposure each involve the laws of additional jurisdictions: the BVI or Cayman law governing the holding entity, the law applicable to user contracts, and the law of any jurisdiction in which the platform's users or assets are located. The cross-border read requires those layers to be considered together, not in isolation.

Do I need a Hong Kong adviser for a virtual-asset trading platform licence in Hong Kong?

The licensing application itself, and the ongoing compliance programme required to maintain the licence, involve matters of Hong Kong law that require input from locally licensed Hong Kong counsel. International counsel – advising on the holding structure, the cross-border AML and enforcement position, and the interaction with offshore jurisdictions – provides a complementary and necessary layer, particularly for groups with holding entities in the BVI, Cayman Islands or other offshore centres. The two functions are distinct and both are required for a well-structured application. Verify the current licensing requirements directly with the SFC before acting.

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.

Where a virtual-asset trading platform licence in Hong Kong stands now