Update: AML obligations for a virtual-asset service

Hong Kong's mandatory licensing regime for virtual-asset trading platforms is now operational. Enforcement risk for non-compliant operators has moved from theoretical to live. Any entity that operates a centralised virtual-asset trading platform serving Hong Kong users, or that holds itself out as doing so, is within the perimeter of the regime – and the regulator is the Securities and Futures Commission.

The Anti-Money Laundering and Counter-Terrorist Financing Ordinance imposes a mandatory licensing requirement on centralised virtual-asset trading platforms, with the Securities and Futures Commission as the licensing authority; the regime commenced 1 June 2023, and AML, customer due diligence and the FATF travel rule for virtual-asset transfers apply from the point of capture.

This briefing covers what the current position requires, who it reaches across the Hong Kong–offshore corridor, and where immediate action is needed.

What the regime now requires

The virtual-asset trading platform (VATP) licensing regime under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance makes licensing mandatory. Operating without a licence is an enforcement exposure, not a filing technicality.

Three obligations sit at the centre of the compliance file for any licensed or licence-seeking operator. First, customer due diligence must meet the standard set out in the Anti-Money Laundering and Counter-Terrorist Financing Ordinance and the Securities and Futures Commission's AML guidelines. Second, the FATF travel rule (the requirement to transmit originator and beneficiary information alongside virtual-asset transfers) applies to all in-scope transfers. Third, where a virtual asset constitutes a "security" or a "futures contract" under the Securities and Futures Ordinance, the Securities and Futures Commission's licensing requirements under that ordinance apply in addition – creating a dual-track position.

On the stablecoin side, a Hong Kong Monetary Authority licensing regime for fiat-referenced stablecoin issuers (stablecoin issuers whose instruments are pegged to one or more fiat currencies) commenced in 2025. Operators in the stablecoin space should verify the current commencement date and perimeter with counsel before acting.

In our cross-border practice, we see a recurring pattern: offshore-incorporated platforms treating Hong Kong users as outside the perimeter because the entity sits in the BVI or the Cayman Islands. That position is not reliable. The regime's capture turns on the activity and the user base, not solely the place of incorporation.

Who this affects across the corridor

The immediate audience is any operator running a centralised exchange, a token issuance programme, or a fiat-to-crypto conversion service with material Hong Kong exposure. That includes BVI- and Cayman-incorporated holding entities whose operating subsidiaries face Hong Kong users, and funds or family offices that use a virtual-asset platform as a portfolio tool.

The cross-border read matters here. An entity incorporated offshore but actively marketing to Hong Kong users cannot treat Hong Kong regulatory obligations as someone else's problem. The Anti-Money Laundering and Counter-Terrorist Financing Ordinance and the Securities and Futures Commission's supervisory reach extend to the conduct, not simply the registered address.

Beyond the primary operator, compliance obligations run to intermediaries – including virtual-asset custodians, over-the-counter desks and settlement agents – that facilitate transfers on behalf of Hong Kong-connected clients. Source-of-funds documentation and the travel rule are not obligations that apply only at the platform level.

The immediate action

The first question is whether an existing licence application is filed, pending or required. The Securities and Futures Commission has published its licensing process; operators in the pipeline should ensure that their AML programme, compliance officer appointment, and internal controls documentation are current and match the regulator's stated expectations.

For operators not yet in the licensing process, an honest perimeter analysis is the starting point. Does the entity's activity, user base or marketing bring it within the VATP regime? Does any token it lists carry securities characteristics? Is the entity also touched by the HKMA's stablecoin regime? Each of these is a distinct filing or compliance track.

The travel rule is an area where operational readiness consistently lags regulatory obligation. Transferring virtual assets without transmitting the required originator and beneficiary data is a breach of the AML framework, and it is the kind of breach that surfaces quickly in any supervisory review.

To discuss your licensing position, AML programme or cross-border compliance file, contact us at info@lockhartyip.com. Our desk covers the full regulatory engagement – from perimeter analysis and licence applications through to ongoing AML compliance across Hong Kong and the principal offshore centres.

For a broader read on the Tech & Web3 practice and how Hong Kong's virtual-asset regime sits within a cross-border structure, see our Tech & Web3 practice page. For fund structures using digital assets across Hong Kong and Cyprus, see our guide to digital-asset fund structures. For fintech regulatory engagement in Hong Kong more broadly, see our fintech briefing.

About Lockhart & Yip

Lockhart & Yip is an independent international and cross-border counsel based in Hong Kong. We advise international groups, founders, family offices and their advisers on virtual-asset regulation, AML compliance and cross-border tech and Web3 matters, working alongside locally licensed firms on matters of Hong Kong law. Our desk is built around licensing posture, AML obligations, sanctions-neutral contracting and the full range of cross-border enforcement across Greater China and the principal offshore centres. We regularly act on matters of this kind across the Hong Kong–offshore corridor. To discuss your position, write to info@lockhartyip.com.

Frequently asked questions

What is the first step in AML obligations for a virtual-asset service provider?

The first step is a perimeter analysis: determining whether the entity's activity, user base and token types bring it within the mandatory licensing regime under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance and, separately, whether the Securities and Futures Ordinance applies to any listed or issued virtual asset. Without a clear perimeter read, the compliance programme cannot be calibrated correctly and the licensing track cannot begin.

What documents are needed for AML obligations for a virtual-asset service provider?

A licensing application to the Securities and Futures Commission requires an AML and counter-terrorist financing programme, a compliance officer appointment, internal control documentation, and evidence of systems capable of meeting the customer due diligence and FATF travel rule requirements. Source-of-funds records and ongoing transaction monitoring documentation form the operational backbone of the file. Operators should verify the current SFC checklist before filing, as requirements are updated.

What does the route look like for AML obligations for a virtual-asset service provider?

The route runs from perimeter analysis through licence application to ongoing supervisory engagement. The Securities and Futures Commission reviews the application, may issue queries, and grants a licence only where the AML programme, systems and governance meet its published standards. For operators with offshore holding entities and Hong Kong-facing operations, the cross-border structure – including which entity holds the licence and how transfers are booked – is a material part of the compliance design from the outset.

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.

Update: AML obligations for a virtual-asset service provider