A virtual-asset trading platform licence in Hong Kong

A foreign principal building a centralised virtual-asset exchange faces a decision that cannot be deferred: operate without a licence and risk enforcement, or engage the process and build the compliance foundation that the market increasingly requires. Hong Kong's mandatory licensing regime for virtual-asset trading platforms changed the calculation permanently when it commenced on 1 June 2023. The Securities and Futures Commission – the SFC (Hong Kong's integrated securities and futures regulator) – is the licensing authority, and it holds the power to refuse, condition, or revoke.

A virtual-asset trading platform licence in Hong Kong is a mandatory regulatory authorisation under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (as amended to introduce the VATP – virtual-asset trading platform – regime), required for any centralised platform offering to trade virtual assets in or from Hong Kong. The SFC administers the regime. Where a virtual asset also qualifies as a security or futures contract, the Securities and Futures Ordinance applies concurrently.

This note sets out when the licence requirement is triggered, the route our desk runs, the cross-border positions that most frequently complicate an application, and the decisions a principal must own before filing.

Why foreign principals reach this point – and what creates urgency

Enforcement risk is real. The SFC has made clear that operating a centralised platform accessible to Hong Kong users without a licence is a regulatory breach. That position is not theoretical.

For a foreign-incorporated exchange – one structured in the BVI, the Cayman Islands, or a European jurisdiction and accessing the Hong Kong market through a web front-end or mobile application – the question of nexus arises quickly. The regime does not require a physical presence in Hong Kong as the sole trigger. A platform that actively solicits Hong Kong users, onboards them, or holds their assets will ordinarily fall within the regulatory perimeter. Our desk regularly advises principals who have reached Hong Kong through growth, through an acquisition, or through a change in the applicable rules in another jurisdiction, and who now face a defined compliance decision.

The trigger is almost always one of three things: a request from an institutional investor or banking counterparty who needs to see a licence on file; a decision to list a token that meets the definition of a security under Hong Kong law; or a referral letter from the SFC itself. Each of these compresses the timeline considerably. The first engagement step should happen before any of these pressure points arrives.

The governing regime – instruments and regulator

The VATP licensing requirement operates under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, as amended to bring centralised virtual-asset trading platforms within the SFC's authorisation perimeter. The commencement date of the mandatory licensing regime was 1 June 2023. Platforms operating before that date were given a transitional period; verify the current position on transitional arrangements before acting.

Where a virtual asset is a "security" or "futures contract" as defined in the Securities and Futures Ordinance, that Ordinance applies concurrently. A platform trading only non-security virtual assets falls under the AMLO-based VATP regime alone. A platform trading security tokens, or offering futures-equivalent products, requires authorisation under both instruments. Mapping the token classification is therefore a threshold legal decision, not an administrative step.

VATPs are also subject to the full suite of AML obligations that apply to financial institutions in Hong Kong: customer due diligence, ongoing monitoring, and the FATF travel rule (the Financial Action Task Force requirement that transferring virtual-asset service providers transmit and receive originator and beneficiary information for transfers above the relevant threshold). The SFC's licensing conditions incorporate AML obligations by reference, so an AML programme that fails to satisfy the regulator's guidelines will block or condition the licence regardless of the strength of the corporate application.

How does the cross-border structure affect the Hong Kong licence?

A virtual-asset exchange rarely sits in a single jurisdiction. The common pattern our desk sees is a Cayman or BVI holding entity above a Hong Kong operating company, with technology hosted across multiple locations and user agreements governed by a third jurisdiction's law. This structure is not disqualifying, but each layer creates a compliance question.

The SFC will look through the holding structure to assess the fitness and propriety of ultimate beneficial owners and controllers. A BVI holding entity whose ownership chain passes through a jurisdiction on a high-risk list, or whose ultimate owners have adverse regulatory history in another jurisdiction, will face a more intensive review. The holding structure must be disclosed in full, and the corporate documentation across each layer – incorporating documents, registers, agreements between entities – must be in order before the SFC file is opened.

The cross-border interface also matters for AML. A Mainland-connected exchange, for example, will need to demonstrate that its AML programme covers counterparties and transactions touching jurisdictions that operate under different sanctions and AML frameworks. Hong Kong implements United Nations sanctions and does not give domestic effect to unilateral measures of other states. The SFC's AML guidelines operate within that posture, but a platform with Mainland-origin users or assets must map the specific obligations carefully across the boundary.

For groups considering Hong Kong as a regional licensing hub – seeking a licence here as the anchor authorisation for a wider Asia-Pacific operation – the structural planning extends to subsidiary relationships, intra-group service agreements, and the question of which entity contracts with end users. These decisions have both regulatory and tax consequences, and our desk works alongside allied tax counsel to ensure the holding and operating layers are aligned before the application is filed.

For groups with technology or data arrangements touching other jurisdictions, the interface between the VATP licence and cross-border data agreements can raise additional questions. Our work on cross-border SaaS and data arrangements addresses the points that commonly arise at that intersection.

The route our desk runs – step by step

The application process has a defined sequence, and the order of steps matters. Filing before the foundational documents are correct produces delays that are difficult to recover from. Our engagement is structured around the following phases.

Phase one: diagnostic. We review the existing corporate structure, the token classification position, the AML programme as it stands, and the ownership and control chain. This phase produces a gap analysis: the list of decisions and documents that must be resolved before an application can be filed responsibly. In our cross-border practice, the gap analysis almost always identifies at least one layer of the holding structure that needs remediation before the SFC file is opened.

Phase two: structure and document preparation. Where the existing structure is not application-ready, we work with the principal to restructure the holding and operating entities, prepare or revise the AML and compliance policies, and ensure the corporate documents across all relevant jurisdictions are in order. Locally licensed Hong Kong firms join the engagement at this stage for any steps that require Hong Kong law advice – the form of the SFC application, the specific licence conditions likely to be imposed, and the interaction between the VATP licence and any securities-law authorisation.

Phase three: application filing and regulator engagement. The SFC application requires a detailed submission covering the corporate structure, the key persons (responsible officers and licensed representatives), the compliance programme, the technology and custody arrangements, and the financial resources of the applicant. The SFC may raise queries during its review. Managing the regulator's questions precisely and in the right register is where experience matters most.

Phase four: licensing and ongoing compliance. A VATP licence carries ongoing conditions. The principal must maintain its AML programme, its responsible officers, and its financial resources at the levels required by the SFC. Changes in ownership, in key personnel, or in the products offered may require regulatory notification or approval. We advise on the post-licence compliance position and on any subsequent regulatory engagement.

The sequence above describes the standard position. Your matter turns on the documents, the jurisdictions actually engaged, and the order of steps – which is where the route is won or lost. For a structured assessment of your VATP licensing position across the relevant jurisdictions, write to us at info@lockhartyip.com.

What documents and decisions does the client own?

No adviser can own the decisions that sit with the principal. The application will fail or be conditioned if the client has not resolved these questions before filing.

First, token classification. The principal must be able to confirm, for every virtual asset on the platform, whether it is a security, a futures contract, or a non-security virtual asset under Hong Kong law. This is a legal determination, but it depends on facts the client controls: the rights attached to the token, the economic structure of the offering, and the marketing representations made. Our desk maps the classification, but the underlying facts belong to the client.

Second, ownership and control. The SFC requires a complete and accurate picture of the ownership chain up to the ultimate beneficial owners. Where that chain involves trusts, nominee arrangements, or complex offshore structures, the documentation must be produced. Gaps or inaccuracies in the ownership disclosure are among the most common reasons for delay or refusal.

Third, key persons. The responsible officer and licensed representative requirements under the VATP regime demand individuals with the relevant experience and a clean regulatory history. Identifying and confirming the availability of these persons – often an early constraint for foreign principals without existing Hong Kong regulatory footprint – must happen before the application file is built.

Fourth, the AML programme. The client must have, or be prepared to build, an AML and customer due diligence programme that meets the SFC's detailed guidelines. For a foreign principal whose existing AML programme was built for a different jurisdiction, this almost always requires material revision. The travel rule obligations in particular require technical implementation that takes time to put in place.

A mid-market exchange based in Europe came to our desk in the first half of 2026. They had a BVI holding entity, an existing AML programme built for European regulatory requirements, and a token list that included three instruments of uncertain classification under Hong Kong law. We ran the diagnostic phase over four weeks. Two of the three uncertain tokens required reclassification, which changed the licensing track. The AML programme required restructuring to meet the FATF travel rule as applied by the SFC. The corporate structure required one additional layer of documentation at the BVI level before the ownership disclosure was application-ready. The filing proceeded on the revised basis, and the regulator's first-round queries were limited to the technology custody arrangements.

Common points where applications stall or fail

Applications fail for a predictable set of reasons. Understanding them before filing is the practical purpose of the diagnostic phase.

The most common is an incomplete or inaccurate ownership disclosure. The SFC's fitness and propriety assessment is thorough. A holding chain that was assembled for commercial reasons, without attention to how it would read to a regulator, often presents problems. Nominee structures, trust arrangements, and layered offshore entities each require careful documentation.

The second is an AML programme built for a different regulatory environment. The SFC's AML guidelines are detailed and specific to the virtual-asset context. An AML programme drafted for a European payment institution or a US money services business will not satisfy them without significant revision.

The third is a key-persons problem. The responsible officer requirements demand individuals who are fit and proper in the SFC's assessment. A principal who has not identified these individuals before starting the application process will lose significant time at the stage when the SFC is already reviewing the file.

The fourth – and this is where foreign counsel most frequently miss the point – is treating the token classification as a commercial decision rather than a legal one. A platform that lists a security token without the concurrent Securities and Futures Ordinance authorisation is operating outside its licence from day one. That position is difficult to recover from without a material restructuring of the application.

If an earlier filing, structure or engagement with the SFC produced an adverse or stalled result, a second read can identify the strategic error and the routes still open. Write to us at info@lockhartyip.com with the background.

The AML and ongoing compliance position

A VATP licence is not a one-time regulatory event. The ongoing obligations are material and continuous.

VATPs must maintain a customer due diligence programme that covers onboarding, ongoing monitoring, and enhanced due diligence for higher-risk customers and transactions. The FATF travel rule applies: for virtual-asset transfers above the relevant threshold, the platform must transmit originator and beneficiary information to the receiving platform and receive equivalent information on incoming transfers. Implementing the travel rule requires a technical solution as well as a compliance policy, and the SFC will expect both to be in place and functioning.

The AML obligations also extend to the platform's banking relationships. A licensed VATP needs to maintain fiat accounts for client money and operational purposes. Banks in Hong Kong and in major offshore centres will conduct their own AML review of a VATP client. Presenting the licence and the compliance programme in a form that satisfies a banking counterparty's due diligence process is a practical challenge that our desk regularly assists with.

Changes in the platform's business – adding new tokens, expanding to new user geographies, changing custody arrangements, or entering a significant commercial relationship – may require SFC notification or approval. The post-licence compliance calendar must be maintained with the same attention as the application itself.

The stablecoin and securities-token intersection

Two areas of the regime require particular attention for groups at the product frontier.

First, fiat-referenced stablecoins (digital tokens pegged to fiat currency values, such as a Hong Kong dollar or US dollar stablecoin). The Hong Kong Monetary Authority introduced a licensing regime for fiat-referenced stablecoin issuers in 2025. A VATP that lists or trades fiat-referenced stablecoins must assess whether its activities bring the platform or its issuer counterparties within the HKMA's perimeter, in addition to the SFC's. The two regimes are distinct. Parties should verify the current commencement date and perimeter of the stablecoin regime before acting, as the detail is subject to ongoing regulatory development.

Second, security tokens (virtual assets that meet the definition of a "security" under the Securities and Futures Ordinance, such as tokenised equity or debt instruments). A VATP seeking to trade security tokens requires a concurrent SFC authorisation under the Securities and Futures Ordinance, in addition to the VATP licence. This dual-licence position changes the application route, the responsible-officer requirements, and the ongoing compliance obligations. Our desk maps the applicable instruments before the application strategy is fixed.

Our broader Tech & Web3 practice covers the full range of Hong Kong virtual-asset regulatory questions, from licensing strategy through to post-licence compliance and product-level regulatory analysis.

Decision matrix: which track applies to your platform?

A principal approaching a Hong Kong VATP licence should work through the following positions before engaging the SFC process.

If the platform trades only non-security virtual assets and is incorporated or to be incorporated in Hong Kong, the applicable track is the AMLO-based VATP licence alone. The SFC is the sole licensing authority. The AML programme and FATF travel rule obligations apply in full.

If the platform trades or intends to trade any virtual asset that meets the definition of a security or futures contract under the Securities and Futures Ordinance, the platform requires both the VATP licence and the relevant SFC authorisation under the Securities and Futures Ordinance. The application is more complex, the responsible-officer pool is more constrained, and the ongoing conduct obligations are more detailed.

If the platform is foreign-incorporated and accesses the Hong Kong market without a local entity, the first question is whether the regulatory perimeter is engaged. If it is – because the platform actively solicits or serves Hong Kong users – establishing a Hong Kong entity and applying for the VATP licence is the compliant path. Operating in breach of the perimeter while the licence is pending is a risk position that must be assessed carefully.

If the platform is at the product frontier – issuing or trading fiat-referenced stablecoins – the HKMA stablecoin regime must be considered alongside the SFC's VATP regime. The applicable path turns on the specific product structure. Parties should verify the current regulatory position before the product is launched or listed.

For a mapping of your specific platform position to the applicable licensing track and compliance obligations, email info@lockhartyip.com.

Self-assessment checklist before engaging the SFC process

Before an application file is opened, a principal should be able to answer the following questions clearly.

• Has the token classification been assessed for every virtual asset on or proposed for the platform?
• Is the full ownership and control chain documented, from the applicant entity to the ultimate beneficial owners?
• Have the responsible officers and licensed representatives been identified and confirmed as available?
• Does the AML programme meet the SFC's published guidelines, including the FATF travel rule implementation?
• Is the corporate structure across all jurisdictions – holding, operating, and any intermediate entities – in order, with current corporate documents?
• Has the platform assessed whether the stablecoin regime or the Securities and Futures Ordinance applies to any of its products?
• Has the banking and custody arrangement been planned, and can it be presented to the SFC and to banking counterparties in the required form?

A "no" answer to any of these questions is a gap that must be closed before filing. Our diagnostic phase is designed to identify all of them in advance.

For a preliminary read on your VATP licensing position and the steps required before filing, contact info@lockhartyip.com.

Related practices

• Sanctions & AML – AML programme review, FATF travel rule compliance, and sanctions-neutral contracting
• Holding Structures – cross-border holding and operating entity design for regulated businesses

For broader briefing material on the VATP licensing regime, see our VATP licensing briefing.

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

Related

• Tech Web3
• Cross Border Saas Or Data Agreement Touching Cyprus 2
• Virtual Asset Trading Platform Licence Hong Kong Briefing

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.