For a crypto exchange, a Hong Kong crypto licence means an SFC licence: a VATP licence under AMLO, often alongside Type 1 and Type 7 for security tokens.
In Hong Kong, a crypto exchange needs a Virtual Asset Trading Platform (VATP) licence from the Securities and Futures Commission (SFC) under AMLO, often alongside Type 1 and Type 7 licences under the SFO for security-token activity; the SFC does not offer a generic crypto licence. The mandatory regime has applied since 1 June 2023, and 13 platforms were licensed as of August 2026. A VATP needs at least HKD 5 million paid-up share capital, liquid capital of at least HKD 3 million, two SFC-approved Responsible Officers and at least 98% of client virtual assets in cold storage. The SFC charges HKD 4,740 per regulated activity on application and again each year once licensed, and the mandatory external assessment report costs from HKD 500,000 on the market. Licensed platforms took a median of about twelve months from application to licence, between eleven and twenty-eight in all. Protegra maps your activities to the right SFC permissions and structures the Hong Kong entity and custody model around them.
| Item | Figure | Basis |
|---|---|---|
| Regulator | SFC for trading platforms and securities activity; HKMA for stablecoin issuers | SFO; Stablecoins Ordinance (Cap. 656) |
| Licence | VATP licence, often with Type 1 and Type 7 for security tokens | AMLO (VATP, mandatory since 1 June 2023); SFO (Type 1, Type 7) |
| Capital | HKD 5 million paid-up; liquid capital of at least HKD 3 million | SFC VATP framework; Financial Resources Rules |
| Custody | At least 98% of client virtual assets in cold storage, through a TCSP-licensed subsidiary | SFC requirement for VATPs |
| SFC fees | HKD 4,740 per regulated activity on application, then each year | Securities and Futures (Fees) Rules, Schedule 3 |
| External assessment | From HKD 500,000 (market range to HKD 800,000) | SFC Circular 25EC2, 16 January 2025 |
| Time to licence | Median about 12 months from application (11–28) | SFC lists of VATPs, checked 23 Sep 2026 |
Sources: SFC, Lists of virtual asset trading platforms, checked 23 September 2026; Securities and Futures (Fees) Rules, Schedule 3; SFC Circular 25EC2 of 16 January 2025; AMLO, SFO and the Stablecoins Ordinance (Cap. 656).
A Hong Kong application is not won by picking a company secretary and submitting a generic policy pack. It is won by aligning the activity scope, entity, capital, custody model, technology, governance, and local operating structure before the SFC tests the application. The right combination is what makes an SFC licence legible to banks, family offices, and institutional investors across Asia. Protegra maps your business to the right SFC permissions, structures the Hong Kong entity and custody model around them, and takes you from first application to a licence that is ready for real operations in Asia.
We turn a VATP application into an exchange that can operate after approval.
Start your applicationnot a licence selected from a price list. We work across spot exchanges, OTC desks, custody, security-token platforms, fund managers with virtual-asset exposure, and stablecoin distribution and issuance.
Your commercial description may be “exchange,” “broker,” or “crypto platform.” The regulatory answer depends on what the business actually does: Does it operate a centralised spot market for virtual assets? Does it deal as principal or agent in security tokens? Does it provide automated trading services? Does it hold or control client virtual assets? Does it manage funds or portfolios with virtual-asset exposure? Does it issue or distribute regulated stablecoins? We map the real activity before the capital requirement and application architecture are fixed.
Custody is not simply another feature added to an exchange licence. The SFC requires at least 98% of client virtual assets to be held in cold storage, with client assets segregated and held through a wholly owned Hong Kong subsidiary holding a TCSP licence. Third-party custody is not accepted for the core client-asset function. That is a structural constraint, not a policy checkbox.
The SFC expects more than incorporation and named directors. The business needs credible responsible officers, AML/CFT, risk management, technology controls, market-conduct procedures, customer disclosures, and local accountability. We build those controls around the product you will actually operate.
As of August 2026, the SFC’s public register lists 13 licensed VATPs, including HashKey Exchange and OSL. The regime launched in June 2023 and has grown steadily as platforms complete on-site inspections and remediation.
The HKMA granted its first two stablecoin issuer licences in April 2026 — to HSBC and Anchorpoint Financial — after reviewing 36 first-round applications under the Stablecoins Ordinance that came into force in August 2025.
Hong Kong’s mandatory VATP licensing regime took effect on 1 June 2023 under AMLO, with a transitional period that ended in May 2024. Since then, operating an unlicensed centralised exchange serving Hong Kong investors is a criminal offence.
Hong Kong is where crypto meets a securities regulator that already supervises exchanges, brokers, and fund managers. Not as a sandbox or a slogan, but as a mature financial market with deep liquidity, institutional counterparties, and a rulebook written for trading venues, not generic “crypto businesses.” Its value is that virtual-asset activity is regulated within that framework, which makes the regime legible to institutions that already work with the SFC.
The Securities and Futures Commission (SFC) treats virtual assets as part of the existing securities and futures perimeter, with a dedicated licensing regime for exchanges and clear expectations for custody, capital, and conduct. It does not offer a generic “crypto licence.” It grants a Virtual Asset Trading Platform (VATP) licence under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO), often alongside Type 1 and Type 7 licences under the Securities and Futures Ordinance (SFO) for security-token activity. The SFC allows firms to apply for one or more regulated activities, but the capital, governance, custody, and operational requirements change with the scope. The correct question is not “Which crypto licence do companies get in Hong Kong?” It is: what will your company actually do with virtual assets, client orders, wallets, and customer funds? Hong Kong is a separate jurisdiction with its own regulator, courts, and rulebook. An SFC licence authorises the regulated activities named in it, in Hong Kong. It does not extend to another market’s regime, and it does not cover activities the firm did not apply for.
A VATP licence covers operating a centralised platform that matches buyers and sellers for non-security virtual assets, with the ability to serve both professional and retail investors subject to SFC conditions.
VATP operators face defined capital floors, strict custody rules, and ongoing supervision as trading venues.
Type 1 (dealing in securities) covers dealing in security tokens and other virtual assets that fall within the SFO definition of securities.
Type 7 (providing automated trading services) covers operating an electronic trading system that matches or executes orders in securities, including security tokens. Many security-token platforms require both Type 1 and Type 7 permissions.
Type 9 (asset management) covers managing portfolios or collective investment schemes that invest in virtual assets. The SFC has published specific expectations for funds with virtual-asset exposure, including eligibility, valuation, custody, and disclosures.
Capital is set under the SFC’s Financial Resources Rules, based on the licensed activities, client-asset holdings, and risk profile.
Standalone virtual-asset custody is not yet a separately licensed activity. Today the SFC requires a trading platform to hold client assets through a wholly owned Hong Kong subsidiary holding a TCSP licence, separate from the platform itself. A dedicated custodian licence, with a proposed HKD 10 million paid-up and HKD 3 million liquid capital, was set out in the FSTB/SFC consultation conclusions of 24 December 2025; the bill is expected in 2026.
The HKMA’s Stablecoins Ordinance, in force since 1 August 2025, requires a licence to issue specified stablecoins in Hong Kong or to issue a Hong Kong dollar-referenced stablecoin anywhere in the world. Licensed issuers must meet capital, reserve, redemption, and conduct standards; certain banks are exempt from the capital floor.
Custody should not be treated as an informal feature of another activity: its legal structure and relationship with other licensed activities must be confirmed before incorporation.
Stablecoin issuance is regulated by the HKMA, not the SFC, and is separate from VATP, Type 1/7/9, and custody permissions.
SFC capital is only one part of the Hong Kong licensing project. A realistic Year 1 estimate includes activity scope, entity setup, registered office, SFC application and supervision fees, paid-up capital, responsible officers and key personnel, AML/CFT, technology, custody, insurance, accounting, audit, banking, and ongoing operations.
One licence, three levels — the regulator asks for exactly the same file in all three, and what changes is how much of it sits with you. Our fee for each level is quoted on scope after the first call; the estimate below holds at every level.
Moving up or down changes our fee and nothing else — not the capital, not the state fees, not the statutory clock. Carrying a file to the decision is not a promise of approval: no adviser can give one, and an adviser who does is selling you something other than advice.
Hong Kong licensing is structured around the activity scope, Hong Kong entity, capital, local substance, operating model, and evidence submitted to the SFC (and HKMA for stablecoins). On timing: the platforms the SFC has licensed from its own list of applicants took a median of about twelve months from application to licence, and between eleven and twenty-eight in all. The SFC’s fifteen-week pledge covers ordinary corporate licences, not trading platforms. Source: SFC, Lists of virtual asset trading platforms, checked 23 September 2026. The timings below are indicative, not a promise.
We map the business against SFC and HKMA regimes:
We also confirm that the entity will operate in Hong Kong and identify whether a VARA, FSRA, DFSA, or other route would apply instead for other target markets.
The Hong Kong entity structure is established under the Companies Ordinance.
We prepare:
The initial engagement and pre-application materials are prepared around one consistent business model.
This includes:
Where applicable, the company is incorporated and the SFC’s pre-application feedback is worked into the plan before completing the full operating structure. The SFC does not grant in-principle approval before an application is filed.
The business must not begin regulated virtual-asset activity before the full VATP and/or securities licences are granted.
We prepare the detailed application package:
We manage regulator communication, meetings, interviews, document revisions, and requests for information.
The objective is to keep the business model, policies, technology, governance, and financial evidence consistent throughout the review.
Once SFC approval is granted, the company completes the remaining operational conditions:
An SFC licence begins an ongoing supervisory relationship.
Customer-risk review, transaction monitoring, sanctions controls, suspicious-activity escalation, and policy updates.
Wallet and key controls, cybersecurity, incident response, vendor oversight, reconciliation, resilience testing, and evidence maintenance, including ongoing 98% cold-storage compliance.
Review of marketing, token admissions, customer disclosures, complaints, conflicts, suitability, and changes to the service model.
Capital, liquid capital, and liquid-asset testing, reporting, licence-condition tracking, and material-change notifications.
The SFC’s activity-based structure gives businesses flexibility, but it also creates several points where a licence can become misaligned before submission.
See how we workAn exchange may also be a dealer, custodian, manager, or stablecoin distributor. Applying for too little can leave the company unable to operate the product it has built. Applying for too much can increase capital, fees, policies, and operational burden unnecessarily.
Hong Kong is a separate legal jurisdiction with its own regulator. An SFC licence authorises the named activities in Hong Kong and nowhere else. Incorporating in the wrong jurisdiction means preparing for the wrong regulator, and rebuilding governance, custody, and capital against a rulebook that never applied.
Custody creates a distinct risk and control perimeter. The SFC requires client virtual assets to be held through a wholly owned Hong Kong subsidiary holding a TCSP licence, with at least 98% in cold storage.
The SFC’s financial-resources rules require not only paid-up capital but also required liquid capital and a liquid-asset cushion of 12 months’ operating expenses.
No. Pre-application feedback or a preliminary incorporation step is not the same as a full VATP or securities licence.
No. Token admission, issuance, marketing, custody, and distribution may involve separate analysis. Stablecoins are regulated by the HKMA under a dedicated regime with reserve, redemption, and disclosure requirements.
Select a challenge to see how a Hong Kong virtual-asset project moves from an initial business idea to an SFC-ready operating structure.
“We thought we needed a VATP licence. Once the product was mapped, we realised it also involved dealing in security tokens, custody, and asset management.”
“The activity scope was defined before we committed capital. We knew which services belonged in the application and which controls each one required.”
“We had designed the wallet architecture before deciding whether custody would be in-house or outsourced, and we had not planned for a separate subsidiary.”
“The custody model and subsidiary structure were selected before the application was submitted. Capital, governance, technology, safeguarding, and client disclosures all followed the same structure.”
“We chose a regional hub without checking whether it was Hong Kong, Dubai, or Abu Dhabi. We later discovered that the SFC was not the applicable regulator.”
“The jurisdiction and regulator were confirmed before incorporation. The entity, licensing strategy, and operating model were designed together.”
Reference: Virtual asset service provider (non-MiCA) licences compared in the Licensing Atlas.
Leave your details and we will map your business to the SFC and HKMA activity categories, confirm the Hong Kong jurisdiction, and identify the first steps toward authorisation.
Halifax, Nova Scotia, February 2019. Standing in front of a judge, a lawyer explains that a cryptocurrency exchange cannot find its customers’ money because the…
If you were setting up a payments business in Europe around 2018, there was a fair chance you spent a few weeks looking at Vilnius. That year Lithuania’s fintech…
Two things happened to Robinhood in the space of four days. On 29 May 2025, its Lithuanian subsidiary, Robinhood Europe, UAB, received the news it had been…