How to approach a virtual-asset trading platform

Regulators in several major financial centres moved at different speeds after 2021. Hong Kong moved early, and with unusual specificity. A mandatory licensing regime for centralised virtual-asset trading platforms took effect on 1 June 2023 under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance. That date matters because it marks the point at which operating without a licence – or without at least a credible application in progress – became a compliance risk rather than a planning option.

A virtual-asset trading platform licence in Hong Kong is obtained through a mandatory application to the Securities and Futures Commission, the licensing authority under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, which commenced the regime on 1 June 2023. Where the platform also offers virtual assets that qualify as securities or futures contracts, a parallel licence under the Securities and Futures Ordinance is required. The sequence, the gate at each step, and the AML obligations that apply throughout are the subject of this guide.

This guide moves through the key decision points in order: the threshold question of whether a licence is needed, entity structure and substance, the application sequence, AML and travel-rule obligations, the securities overlap, and the practical mistakes that delay or derail otherwise well-prepared files. The cross-border dimension – relevant for groups whose holding entity sits outside Hong Kong – receives dedicated treatment.

Does your platform need a licence, and under which regime?

The first gate is scope: not every digital-asset business requires a Hong Kong virtual-asset trading platform licence, and getting the scope question wrong at the outset is one of the most common errors in-house counsel encounter. Under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, the mandatory licensing regime applies to centralised virtual-asset trading platforms (exchanges that hold client assets and match orders on a central book) that operate in Hong Kong or actively market to Hong Kong investors.

The perimeter turns on two questions. First, does the platform operate a centralised order book and custody client assets? Purely decentralised protocols that do not custody assets or operate a matching engine sit outside the immediate perimeter – though that line is not permanent, and the regulatory appetite to extend it is visible. Second, does the business operate in Hong Kong, or actively market to persons in Hong Kong? A platform incorporated in, say, the Cayman Islands but with a management team in Hong Kong, or with a Hong Kong-facing website making services available to Hong Kong residents, is likely to fall within scope.

Where any virtual asset offered on the platform constitutes a "security" or a "futures contract" under the Securities and Futures Ordinance, the platform requires a separate licence under that Ordinance. This creates a potential dual-licence scenario. The two regimes are administered by the same authority – the Securities and Futures Commission – but the application tracks and the ongoing obligations differ in important respects. A product-layer analysis of the intended token universe is therefore not optional; it is the first substantive step.

The practical conclusion: before a group commits resources to a Hong Kong application, in-house counsel should run a written scope analysis covering the operational model, the asset universe, the investor base, and the domicile of the entity that will hold the licence. That document sets the foundation for every step that follows.

How should the applicant entity be structured before the application opens?

The applicant must be a company incorporated in Hong Kong or a foreign company registered in Hong Kong. This is a hard structural requirement, not a preference. Groups whose current operating entity sits in the BVI, Cayman Islands, or another offshore holding centre need to establish a Hong Kong entity before the application can begin.

Substance matters here. The Securities and Futures Commission will examine management and control, key-function staffing, and operational infrastructure in Hong Kong. A shell with nominal local presence and day-to-day management sitting offshore will not satisfy the substance requirements. The precise headcount and floor-space thresholds are not published as bright-line rules, but experience on our desk is that the Commission's review focuses on whether the responsible officers and core risk, compliance, and technology functions are genuinely based in Hong Kong.

The offshore holding structure above the Hong Kong entity is a separate matter. Most international groups will maintain a BVI or Cayman parent holding company with a wholly owned Hong Kong operating subsidiary as the licensee. That is an accepted structure. What the Commission scrutinises is the Hong Kong entity's own substance, not the capitalisation model of the offshore layer. The offshore parent, however, will fall within the beneficial-ownership and corporate-transparency obligations that apply at the Hong Kong level.

A point that frequently surprises foreign counsel: the Significant Controllers Register under the Companies Ordinance – a requirement for Hong Kong-incorporated companies since 1 March 2018 – must be maintained and accurate before the application is submitted. An incomplete or inaccurate register at the filing date is an avoidable procedural gap.

In our cross-border practice, we regularly see groups arrive at the structuring stage with an offshore entity and no Hong Kong operating company in place. Incorporation takes a short number of weeks; the substance build takes longer. The two tracks need to run in parallel, not in sequence.

What is the application sequence, and what is the gate at each step?

The application sequence for a Hong Kong virtual-asset trading platform licence under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance follows a defined progression, with a substantive gate at each stage before the next opens.

Step 1 – Pre-application preparation. The applicant compiles the core documentation: a description of the business model, the proposed suite of virtual assets, the technology architecture, the risk-management and internal-control systems, the AML and counter-terrorist financing programme, and the details of proposed responsible officers and ultimate beneficial owners. The Commission's published guidance describes the expected content of these materials. In practice, the document set is substantial; under-prepared filings are returned, and the delay costs are disproportionate to the preparation time saved.

Step 2 – Submission and initial completeness review. Once submitted through the Commission's electronic system, the application is reviewed for completeness. This is not a merits review. An incomplete filing at this gate does not advance; it is returned with comments. The common gap at this stage is an incomplete AML programme or a responsible-officer profile that does not satisfy the fit-and-proper requirements.

Step 3 – Substantive review. The Commission's substantive review covers the financial resources of the applicant, the technology and cybersecurity arrangements, the risk-management structure, the AML and counter-terrorist financing systems, and the fitness of proposed responsible officers. The Commission may issue queries, and the applicant must respond within the stated deadlines. Slow or incomplete responses extend the review period.

Step 4 – Conditions and approval. If the review is satisfactory, the Commission issues a conditional approval or a licence subject to ongoing conditions. Conditions commonly address the categories of virtual asset that may be offered, investor eligibility (retail versus professional), custody arrangements, and periodic reporting. Licensees must comply with conditions from the date of grant; there is no grace period for post-licensing implementation of required systems.

Step 5 – Ongoing obligations. The licence is a continuing obligation, not a one-time clearance. Periodic reporting, change-notification requirements (material changes to business model, responsible officers, beneficial ownership), and the ongoing AML and travel-rule programme all run from the date of grant and indefinitely thereafter.

The sequence above describes the standard position. Your matter turns on the documents, the jurisdictions actually engaged, and the order of steps – which is where the route is won or lost. To discuss how the application sequence applies to your specific platform model, contact info@lockhartyip.com.

What are the AML and travel-rule obligations that run through the process?

AML compliance is not a closing condition on a virtual-asset trading platform licence application in Hong Kong – it is a threshold requirement that the Commission assesses throughout. The Anti-Money Laundering and Counter-Terrorist Financing Ordinance imposes customer due diligence obligations, ongoing monitoring, and record-keeping requirements on licensed virtual-asset trading platforms. These obligations begin at onboarding and continue for the life of the customer relationship.

The FATF travel rule (the Financial Action Task Force standard requiring originator and beneficiary information to accompany virtual-asset transfers) applies to licensed platforms in Hong Kong. Platforms must implement systems capable of capturing, transmitting, and receiving the required counterparty information for virtual-asset transfers at or above the applicable threshold. Building the travel-rule technical infrastructure into the platform architecture before the application is submitted – rather than as a post-licensing retrofit – is measurably faster and less expensive. The Commission's review of the AML programme will include the travel-rule implementation plan.

A common structural error: groups that built their compliance infrastructure for a non-Hong Kong jurisdiction – Singapore, the UAE, or a European centre – and assume it will transfer directly. The Hong Kong regime aligns broadly with the FATF standards, but the specific obligations under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, and the Commission's own guidance on expected programme content, require local calibration. A compliance programme designed elsewhere will typically need material adjustments before it satisfies the Commission's review criteria.

Responsible officers carry personal obligations under the AML regime. The fit-and-proper assessment for responsible officers includes an examination of their understanding of, and commitment to, the AML obligations. This is not a box-ticking exercise. The Commission's approach treats the responsible officer as the live point of accountability for the platform's compliance posture.

How does the securities overlap work in practice?

Where a virtual asset offered on the platform is a "security" within the meaning of the Securities and Futures Ordinance – broadly, an investment product that carries rights analogous to shares, debentures, or units in a fund – the platform requires an additional licence under that Ordinance. The Securities and Futures Commission administers both regimes, but the application tracks and the regulated activity categories differ.

The practical question is whether the intended token universe includes any asset that could be characterised as a security. This is a legal analysis, not a technical one. The fact that an asset is labelled a "utility token" or a "governance token" by its issuer does not determine its legal character. The Commission has published guidance on the factors it considers, but the analysis remains fact-specific and depends on the rights, obligations, and economic substance attached to the token.

Groups planning to list a broad or evolving set of virtual assets face ongoing exposure on this point. A token listed at launch as a non-security may acquire security-like characteristics through subsequent governance changes or economic restructuring. A live monitoring process – not a one-time pre-listing review – is therefore necessary for platforms with diverse or evolving listings.

The two-licence scenario has a structural implication. The regulated activity categories under the Securities and Futures Ordinance require specified responsible officers for each category. A platform pursuing both licences needs responsible officers qualified for both tracks. Recruiting and retaining qualified responsible officers in Hong Kong is a real operational constraint; it should be addressed in the structuring phase, not after the application is submitted.

For groups with an existing regulated entity in another jurisdiction – Singapore, the UAE, or a European financial centre – the question of whether that entity's regulatory status assists the Hong Kong application is occasionally raised. The short answer is that it does not. The Commission conducts an independent review. Authorisation in another jurisdiction is a background fact, not a substitute for the Hong Kong process.

What does the cross-border dimension add for a group with an offshore holding structure?

Most international groups approaching a Hong Kong virtual-asset trading platform licence have an existing offshore holding structure – typically a BVI or Cayman parent above one or more operating entities. The licence applies to the Hong Kong entity. The offshore layer is relevant in two specific ways: beneficial ownership disclosure and the substance of management and control.

The Commission requires disclosure of ultimate beneficial owners as part of the application. For a complex offshore holding chain, this means tracing ownership to the level of individual natural persons and documenting that chain fully. Where beneficial owners are themselves structured through trusts or foundations, the disclosure obligation extends to the settlor, protector, and beneficiary classes of those structures. Incomplete disclosure at this stage is a common source of queries during the substantive review.

The management-and-control question intersects with the substance requirement described above. If key decisions affecting the Hong Kong entity are made by individuals seated outside Hong Kong, the Commission may take the view that the effective place of management is elsewhere. This is relevant not only to the licence application but also to the tax-residence position of the Hong Kong entity. In our cross-border practice, we see groups that have structured their offshore holding layer efficiently but have not turned their minds to where decisions are actually made. The two questions – licensing substance and tax substance – require the same factual analysis; it is efficient to address both at the same time.

The stablecoin dimension is a separate and evolving point. The Hong Kong Monetary Authority has been developing a licensing regime for fiat-referenced stablecoin issuers (entities that issue digital tokens pegged to a fiat currency). That regime commenced in 2025. Groups with a stablecoin issuance component to their business should verify the current commencement date, perimeter, and licensing requirements before proceeding, as the position is subject to change.

If an earlier filing, structure or application in a different jurisdiction produced an adverse or stalled result, a second read of the Hong Kong position can identify the structural error and the routes still open. Email info@lockhartyip.com to discuss.

What are the common mistakes, and how is the route improved?

Three errors appear with consistent frequency in files that stall or receive adverse outcomes. They are worth naming directly.

Underestimating the substance requirement. The Commission's review is not a document exercise. It is an assessment of whether the entity genuinely operates from Hong Kong. Groups that incorporate a Hong Kong company and then continue to manage the business from outside – appointing nominal local directors and filing adequate paperwork – find that the Commission's queries focus precisely on this point. The solution is operational: put real management and control in Hong Kong before the application opens, not after.

Treating the AML programme as a post-licensing workstream. Platforms that submit applications with a draft or generic AML programme regularly receive queries that delay the substantive review by a significant period. The Commission's expectations on programme content – policies, procedures, customer due diligence levels, monitoring systems, travel-rule infrastructure – are documented in its published guidance. Meeting those expectations at the filing date, not three months later, is the single most effective step a group can take to manage the application timeline.

Misreading the securities-overlap point. Counsel on our desk regularly see applications that proceed on the assumption that a token universe is "non-securities" without a documented legal analysis. When the Commission queries specific tokens during the review, the absence of a pre-filing analysis creates both a delay and an uncertainty that could have been resolved in advance. A written product-layer analysis, prepared before the application is submitted and updated as the token universe evolves, is the practical remedy.

A fourth error – less common but consequential – is failing to plan the responsible-officer succession. A licence is effectively suspended if the required responsible officers are not in post. Groups that recruit two responsible officers and have no succession plan expose themselves to a compliance gap if one departs. The Commission expects a plan; building one into the governance structure from the outset is straightforward if done at the right time.

Decision checklist: are you ready to proceed?

Before engaging with the Commission's application process, an in-house team or a group's advisers should be able to answer the following questions affirmatively. If any answer is uncertain, that item represents the priority workstream before the application opens.

Is the Hong Kong entity incorporated, capitalised, and in possession of a current Significant Controllers Register?
Has a scope analysis confirmed whether the business requires a licence under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, the Securities and Futures Ordinance, or both?
Have proposed responsible officers been identified and have their fit-and-proper profiles been assessed?
Is a complete AML and counter-terrorist financing programme in place, including a travel-rule implementation plan?
Has a written product-layer analysis been completed for the intended token universe?
Does the beneficial-ownership chain trace accurately to individual natural persons, including through any trust or foundation layer?
Is the management and control of the Hong Kong entity exercised in Hong Kong by persons based in Hong Kong?
Has the stablecoin question (if relevant) been addressed against the current HKMA regime position?

This guide addresses the standard position. It is not a substitute for advice on the specific facts of your business, your entity structure, or the current state of the Commission's guidance.

For a structured assessment of your virtual-asset trading platform licence position across the relevant jurisdictions, write to us at info@lockhartyip.com.

Related practices

Tech & Web3 – licensing, AML and entity structuring for virtual-asset businesses in Hong Kong
Sanctions & AML – compliance programme design and counterparty due diligence across jurisdictions

Frequently asked questions

What does the route look like for a virtual-asset trading platform licence in Hong Kong?

The route runs from a scope analysis and entity structuring in Hong Kong, through an application to the Securities and Futures Commission under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, to a substantive review covering AML programme, responsible officers, technology, and financial resources, and concludes with a licence subject to ongoing conditions. Where virtual assets on the platform are securities, a parallel track under the Securities and Futures Ordinance runs alongside. The whole process is sequential: each gate must be passed before the next opens, and the preparation quality at filing largely determines the review timeline. See also our Tech & Web3 practice page for the broader context.

What is the first step in a virtual-asset trading platform licence in Hong Kong?

The first step is a written scope analysis establishing whether the business falls within the mandatory licensing perimeter of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, and whether any assets on the platform trigger the additional Securities and Futures Ordinance requirements. That analysis determines the entity structure needed, the responsible-officer profile required, and the content of the AML programme. Without it, subsequent steps proceed on an uncertain foundation. Groups with operations or agreements touching other jurisdictions – for example, a data or services agreement touching the UAE or Singapore – should factor those cross-border dimensions into the scope analysis from the outset. Further guidance on adjacent cross-border agreements is available at our UAE cross-border guide and our Singapore matters note.

Which jurisdiction's law applies to a virtual-asset trading platform licence in Hong Kong?

Hong Kong law governs the licensing obligations: specifically the Anti-Money Laundering and Counter-Terrorist Financing Ordinance and, where the securities-overlap applies, the Securities and Futures Ordinance. The Securities and Futures Commission applies both statutes. For the group structure above the Hong Kong entity – typically a BVI or Cayman holding company – the law of that offshore jurisdiction governs the corporate-law questions, but the substance and beneficial-ownership obligations relevant to the licence are assessed under Hong Kong law. Cross-border licensing obligations in other markets where the platform may be accessed require separate local-law analysis in each jurisdiction concerned.

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.

How to approach a virtual-asset trading platform licence in Hong Kong