Matter note: a virtual-asset trading platform licence in Hong Kong

The question a cross-border operator faces when entering the Hong Kong virtual-asset market is rarely straightforward: which entity applies, which regulator signs off, and what does a compliant operating model actually look like before the first line of code is committed to production. Getting the structure wrong at the outset is far more expensive than getting it right. This note describes an anonymised matter our desk handled involving a virtual-asset trading platform seeking a licence under Hong Kong's mandatory licensing regime. The names, jurisdictions of origin and commercial details have been removed. The legal sequence and the lessons remain.

A virtual-asset trading platform operating in Hong Kong – or actively marketing to Hong Kong investors – must hold a licence under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, with the Securities and Futures Commission as the licensing authority, and where the assets traded include securities, additional obligations arise under the Securities and Futures Ordinance. The regime commenced on 1 June 2023.

The sections below follow the matter in sequence: the situation and constraint, the structural issue, the route chosen, the turning point, and the transferable lesson for operators considering the same path.

What was the situation, and what constrained the operator?

The operator was a mid-market digital-asset exchange. It had been active for several years through an offshore holding structure, with group entities incorporated in a recognised offshore common-law jurisdiction and technology operations maintained in a third country. The target market included Hong Kong – both institutional clients and sophisticated retail participants.

The constraint was timing. Hong Kong's VATP licensing regime (the mandatory licensing framework for centralised virtual-asset trading platforms under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance) had moved from an opt-in model to a compulsory one. Any platform actively marketing to or serving Hong Kong investors now required a licence from the Securities and Futures Commission. Operating without one was not a structuring choice; it was a regulatory breach.

The group had taken advice in its home jurisdiction. That advice was technically accurate as far as it went. It did not go far enough. The existing offshore holding structure had not been designed with Hong Kong regulatory substance in mind. There was no Hong Kong-incorporated entity, no designated compliance officer resident in the city, and no AML programme calibrated to the local regulatory guidelines. All three were necessary conditions for a licence application, not optional enhancements.

The operator came to us with a working platform, an offshore structure, a planned Hong Kong launch, and a gap between where it stood and where it needed to be. The question was how to close that gap in a defined sequence without pausing the commercial timetable more than necessary.

What was the structural and legal issue?

Two issues sat at the centre of the matter. The first was entity structure. The second was AML programme design.

On structure: a VATP licence is granted to a corporation. The corporation must be incorporated in Hong Kong or registered as a registered non-Hong Kong company. The group had neither. The offshore holding entity was not licensed or registrable as a Hong Kong operator. A new Hong Kong entity was therefore required – not as a formality, but as the regulated entity that would hold the licence, own the Hong Kong-facing business, and carry the ongoing regulatory obligations.

That raised a secondary question. How should the Hong Kong entity sit within the existing offshore structure? The group's tax and economic-substance position in its current holding jurisdiction needed to be preserved. Inserting a new Hong Kong operating company required careful thought about the inter-company arrangements: licensing of IP, revenue flows, and the service-level terms between the offshore technology entity and the Hong Kong regulated entity. Get that wrong, and the group creates a substance problem in one jurisdiction while solving a licensing problem in another.

On AML: the Anti-Money Laundering and Counter-Terrorist Financing Ordinance imposes a detailed set of customer due diligence, record-keeping and transaction-monitoring obligations on licensed VATPs. The FATF travel rule (the requirement to transmit originator and beneficiary information for virtual-asset transfers above a defined threshold) applies to platforms operating in Hong Kong. The group's existing AML programme had been built to a different standard. It identified counterparties at onboarding. It did not systematically apply the travel rule or maintain the internal governance documentation that the Securities and Futures Commission expects to review on application and in ongoing supervision.

Neither issue was fatal. Both required structured remediation before an application could be filed.

What route did the matter take, and where was the turning point?

The route followed four stages. Each stage had a defined output before the next could begin.

The first stage was a licensing-readiness assessment. We reviewed the existing group structure, the offshore entity's constitutional documents, the AML programme, the technology architecture relevant to the travel rule, and the proposed management team. The output was a gap analysis: what was present, what was absent, and what needed to be built or remediated before an application file could be assembled.

The second stage was structural. Working with locally licensed Hong Kong firms on the Hong Kong corporate steps, a new Hong Kong entity was incorporated. The inter-company arrangements – the technology licensing terms, the service-level agreement with the offshore operating entity, and the revenue-sharing structure – were designed to reflect the substance of the Hong Kong operation and to avoid creating an artificial bifurcation that neither regulator nor tax authority would accept. The group's cross-border agreement touching Mainland market participants also required a review at this stage; we considered those obligations alongside the entity design. For the detail on cross-border data and service arrangements of this kind, see our briefing at Cross-border SaaS or data agreements touching the Mainland.

The third stage was AML programme design. The programme was rebuilt, not patched. The customer due diligence procedures were redrafted to reflect the Securities and Futures Commission's licensing conditions and AML guidelines. Travel-rule compliance – covering both the originator-information obligation on outbound transfers and the beneficiary-information screening obligation on inbound transfers – was mapped to the platform's actual technology architecture. An internal AML committee structure was put in place, with defined escalation lines and a compliance officer who met the residency and seniority requirements for a licensed entity.

The turning point in the matter was not a filing or a hearing. It was a decision made at the end of stage two. The operator had been inclined to proceed with a minimal viable compliance programme and rely on post-licensing remediation to close remaining gaps. That approach was not viable. The Securities and Futures Commission's licensing process involves a detailed review of the applicant's policies, systems and controls before a licence is granted. An application filed with a partial programme would have stalled. The decision to complete the AML build before filing moved the matter forward cleanly. The application, when submitted, was substantively complete.

Operators considering a custody or digital-asset arrangement alongside or beneath a trading platform should also review the structural considerations set out in our guide at Stablecoin or digital asset custody arrangement guide.

What was the outcome, and what does it transfer to other matters?

The outcome was a licence application filed with a complete file: a Hong Kong entity with appropriate governance, a fully documented AML programme, a compliance officer in place, and inter-company arrangements that reflected the substance of the Hong Kong operation. The application proceeded through the regulatory review process. No material resubmission was required on the structural or AML points.

The qualitative result was that the operator entered the Hong Kong market as a regulated entity without the reputational exposure of a stalled or rejected application. That matters. The Securities and Futures Commission publishes information about licensed and unlicensed platforms. Being on the wrong list carries commercial consequences that survive the eventual correction.

Three things transfer from this matter to others.

First, the entity question is not optional. There is no route to a VATP licence that bypasses Hong Kong incorporation or registration. An operator that arrives with only an offshore structure must build the Hong Kong entity as a first step, not as a background task.

Second, the AML programme must be designed for the Hong Kong regulatory standard, not the lowest common denominator of where the group has operated before. The travel rule, in particular, is a technically demanding obligation that requires integration with the platform's technology architecture. It cannot be addressed by policy language alone.

Third, the inter-company structure matters to more than one regulator. The design of the holding structure, the licensing terms and the revenue flows has implications for the group's tax position, its substance position in the offshore jurisdiction, and, if the group takes on institutional clients or accesses Mainland capital markets, its cross-border regulatory posture. In our cross-border practice, we see operators treat these as separate workstreams. The better approach is to treat them as a single structural design problem from the outset.

For a full view of the firm's work across the Tech & Web3 practice, including licensing posture, AML compliance and entity structuring, see Lockhart & Yip – Tech & Web3.

The sequence above describes the standard position. Your matter turns on the existing structure, the jurisdictions actually engaged, and the order of remediation steps – which is where the route is won or lost. For a structured assessment of your licensing readiness and the structural steps required, write to us at info@lockhartyip.com.

Related practices

• Sanctions & AML – AML programme design and travel-rule compliance for regulated entities
• Holding Structures – offshore and Hong Kong holding entity design for regulated groups

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

Related

• Tech Web3
• Cross Border Saas Or Data Agreement Touching Mainland
• Stablecoin Or Digital Asset Custody Arrangement Guide

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.