Crypto License in Hong Kong

The SFC charges a non-refundable application fee when you submit your VATP licence application, and an annual licence fee once approved. Fees are fixed by statute and do not vary by business size. There is also a separate company incorporation cost payable to the Companies Registry.

A typical application with two Responsible Officers and five Licensed Representatives costs roughly HKD 23K–30K (USD 3K–3.8K) in pure government fees — a negligible share of total project cost. The dominant costs are capital and professional fees.

The SFC imposes two parallel capital tests: a paid-up capital floor (a one-time minimum) and an ongoing liquid capital requirement (maintained at all times). The thresholds depend on whether the platform holds client assets.

Liquid capital is not the same as paid-up capital: it is a rolling balance-sheet test. The SFC calculates it as net tangible assets minus prescribed haircuts on illiquid assets. In practice, a custodial VATP must maintain roughly HKD 15M (USD 1.9M) in qualifying liquid assets at all times — not just on the day of application. Dropping below this threshold triggers immediate SFC notification obligations.

Most applicants targeting retail clients pursue the custodial licence, which means locking up HKD 25M in share capital before they process a single trade. That capital is not a fee — it remains on the company balance sheet — but it is real cash unavailable for operations.

Beyond government fees and capital, you will incur substantial professional costs. The SFC requires applicants to engage an external assessor to audit systems and controls before and after approval. Legal and compliance advisory typically runs in parallel throughout the 12–18 month review process.

Non-custodial applicants should plan for HKD 7.2M–11.1M (USD 920K–1.42M) total first-year outlay, including the HKD 5M capital floor but excluding ongoing liquid capital maintenance.

Custodial applicants should plan for HKD 27.2M–31.1M (USD 3.48M–3.98M) in total first-year outlay, dominated by the HKD 25M capital requirement. The professional fee component is essentially identical regardless of custody scope.

The SFC regulates crypto assets that meet the definition of “securities” or “futures contracts” under the SFO. Tokens structured as investment contracts, revenue-sharing instruments, or debt claims typically fall into this category. Four licence types are most relevant to crypto businesses:

Type 9 carries a specific crypto carve-in: a manager whose portfolio holds ≥ 10% in virtual assets needs SFC approval even if those assets are not securities. This catches most crypto hedge funds. Types 1 and 7 are often held together by platforms that both match orders and deal as principal. The SFC Code of Conduct applies to all licensed persons and imposes ongoing obligations around best execution, conflicts of interest, and client asset protection.

The VASP regime under AMLO Chapter 5B came into full effect on 1 June 2023. It requires any centralised virtual asset exchange operating in Hong Kong — or actively marketing to Hong Kong investors — to obtain a VASP licence from the SFC. Unlike the SFO, this regime covers non-security virtual assets including Bitcoin and Ether.

The core requirements are:

• Paid-up share capital — minimum HKD 5,000,000 at all times
• Liquid capital — at least HKD 3,000,000 or 5% of client assets held on platform, whichever is higher
• Insurance or compensation arrangements — covering at least 50% of client assets held in hot wallets
• Retail access gate — platforms may serve retail clients only after satisfying additional SFC conditions on token due diligence, pricing transparency, and product limits
• Local presence — at least two responsible officers resident in Hong Kong; the CEO must be one of them
• AML/CFT programme — compliant with FATF Travel Rule; on-chain transaction monitoring required

Platforms that were operating before 1 June 2023 could apply for a transitional arrangement before 29 February 2024. New entrants have no transitional grace — they must be licensed before commencing operations. Operating without a licence is a criminal offence carrying up to 7 years imprisonment and a fine of HKD 5,000,000.

Hong Kong enacted the Stablecoins Ordinance (Cap. 656) in 2025, with the licensing regime entering into force in August 2025. It covers issuers of “fiat-referenced stablecoins” — tokens pegged to a single fiat currency or a basket of fiat currencies — where the issuer operates in Hong Kong or issues a coin referencing Hong Kong dollars.

The headline requirements under Cap. 656:

• Minimum paid-up capital — HKD 25,000,000 (approximately USD 3.2 million at April 2026 rates)
• Reserve asset requirements — 1:1 backing with high-quality liquid assets held in segregated accounts; reserve must match or exceed the outstanding supply of the stablecoin at all times
• Redemption obligation — holders must be able to redeem at par within one business day on demand
• Disclosure — monthly reserve attestation by an HKMA-approved independent auditor
• Local incorporation — the issuing entity must be incorporated in Hong Kong

Algorithmic stablecoins and commodity-backed tokens are explicitly excluded from Cap. 656 and remain outside the stablecoin regime. If you are building a USD or HKD stablecoin product for distribution in Hong Kong, you cannot issue without a Cap. 656 licence after August 2025. The HKMA is the primary supervisor for stablecoin issuers.

The Customs and Excise Department (C&ED) issues MSO licences under the AMLO for businesses that operate a money changing or remittance service. In the crypto context, an MSO licence is the primary requirement for OTC desks — businesses that exchange crypto for fiat, or vice versa, directly with clients rather than through an exchange order book.

Key points for crypto OTC operators:

• Scope — an MSO licence covers fiat-to-crypto and crypto-to-fiat conversion services; it does not cover crypto-to-crypto trading, which falls under the VASP regime if done on a platform basis
• No minimum capital requirement — unlike the VASP regime, the MSO regime sets no statutory minimum capital; instead, the C&ED assesses fitness and properness of the operator and its principals
• AML/CFT obligations — MSOs must implement customer due diligence, transaction monitoring, and suspicious transaction reporting under AMLO Schedule 2
• Application fee — HKD 2,080 for a new licence; annual licence fee of HKD 2,600
• Renewal — licences are valid for two years and must be renewed before expiry

The Hong Kong Monetary Authority (HKMA) operates two entry paths that are underused by crypto startups: the Fintech Supervisory Sandbox and the Stored Value Facility (SVF) licence.

Fintech Supervisory Sandbox. The HKMA sandbox allows pilot deployment of new financial technology products under relaxed regulatory requirements before a full licence is obtained. For crypto-adjacent payment products — including fiat on-ramps, programmable money, and crypto-linked cards — the sandbox lets you test with real customers for a defined period while working toward an SVF or stablecoin licence. Sandbox participation does not guarantee a licence, but it establishes a supervisory relationship with the HKMA that materially reduces approval timelines when you file the full application. The sandbox is open to startups that cannot yet meet the full capital requirements of a regulated regime.

SVF Licensing. An SVF licence under the Payment Systems and Stored Value Facilities Ordinance (Cap. 584) is required for any business that issues multipurpose stored value — meaning stored monetary value redeemable by third parties, not just the issuer. Crypto wallets that hold fiat balances on behalf of users, or crypto debit card programmes with a fiat float, fall into this category. The minimum capital requirement is HKD 25,000,000, matching the stablecoin regime. The HKMA is the licensing authority.

For most startups, the practical path is: enter the HKMA sandbox first → build the compliance infrastructure during the sandbox period → file for the full SVF or stablecoin licence with 12–18 months of supervised operating history behind you. This is faster than filing cold, because the HKMA already knows your product and team.

Your operating entity must be incorporated in Hong Kong under the Companies Ordinance. A foreign company operating through a branch is not eligible — you need a locally incorporated limited company. The SFC also requires a physical office in Hong Kong; a registered address service alone does not satisfy this requirement.

• Entity type — Hong Kong-incorporated company (private or public limited by shares)
• Local office — a genuine place of business in Hong Kong where staff are present and records are kept
• Board composition — at least one director must be ordinarily resident in Hong Kong
• Regulated activity scope — the VATP licence covers Type 1 (dealing in securities) and Type 7 (providing automated trading services) regulated activities for virtual assets; your corporate objects must reflect these

Every VATP must appoint at least two Responsible Officers (ROs) for each regulated activity. ROs are personally accountable to the SFC and must pass the SFC fit and proper test — covering competence, financial soundness, and integrity. At least one RO must be an executive director actively involved in day-to-day management.

• RO residency — each RO must be ordinarily resident in Hong Kong; offshore ROs are not accepted
• RO qualifications — relevant industry experience (typically ≥3 years in securities or VA trading), plus completion of SFC-recognised regulatory examination modules
• Licensed Representatives (LRs) — all staff who conduct regulated activities on behalf of the VATP must be licensed as LRs under the relevant RO; each LR is also subject to the fit and proper test
• Continuing obligations — ROs and LRs must maintain CPD hours annually and notify the SFC of any material change in their fitness (criminal charges, insolvency, civil judgments)

The SFC publishes its fit and proper criteria in the SFC circular on VATP supervision. Budget 8–12 weeks for SFC review of each individual applicant once documents are submitted.

The SFC imposes three separate capital thresholds, all of which must be met simultaneously and maintained on an ongoing basis. The table below shows each requirement in HKD and approximate USD equivalent.

In practice, the 12-month expense buffer is often the binding constraint. A lean VATP with annual operating costs of HKD 12,000,000 (~USD 1.54 million) must hold that amount in liquid form on top of the HKD 3,000,000 liquid capital minimum. Financial statements must be audited annually by a Hong Kong-licensed CPA firm.

The SFC mandates specific insurance coverage and cold/hot wallet ratios. These are not suggestions — they are hard rules tied to the value of client assets under custody.

• Cold storage minimum — at least 98% of client virtual assets must be held in cold storage (offline wallets) at all times
• Hot wallet insurance — insurance coverage of 100% of the value of assets held in hot wallets; if HKD 10 million is in hot storage, you need HKD 10 million in insurance
• Cold wallet insurance — insurance coverage of at least 50% of the value of assets held in cold storage
• Custody segregation — client virtual assets must be held in segregated wallets, legally separated from the VATP’s own assets; commingling is prohibited
• Third-party custody — where a third-party custodian is used, the custodian must meet SFC standards; the VATP remains responsible for custody failures

The SFC Gazette Notice GN-3120 of 2023 sets out the full custody and insurance requirements in statutory form. Verify the current insurance market can actually write the policies you need — capacity for crypto-specific cold storage insurance is limited and policies must be reviewed and approved by the SFC.

Licensed VATPs are designated financial institutions under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO). This means full FATF-standard AML/KYC obligations apply, plus the VASP Travel Rule.

• Customer due diligence (CDD) — identity verification for all clients before account opening; enhanced due diligence (EDD) for politically exposed persons and high-risk clients
• Ongoing monitoring — transaction monitoring systems must flag unusual patterns; thresholds and typologies must be documented in your AML policy
• Travel Rule threshold — for virtual asset transfers of HKD 8,000 or above, you must collect, verify, and transmit originator and beneficiary information to the receiving VASP; below this threshold, basic originator information is still required
• Sunrise issue — when sending to a non-Travel-Rule-compliant counterparty VASP, you must have a documented policy for handling the mismatch; the SFC expects risk-based controls rather than blanket rejection
• Record retention — all CDD records and transaction records must be retained for at least 6 years
• Suspicious transaction reporting — must file SARs/STRs with the Joint Financial Intelligence Unit (JFIU) when there are reasonable grounds to suspect ML/TF

The SFC treats cybersecurity as a standalone licensing condition, not an IT best practice. VATPs must demonstrate that their systems can withstand attack and recover from failure before the licence is granted — and must prove it on a recurring basis thereafter.

• Pre-licensing security assessment — an independent cybersecurity audit by an SFC-acceptable firm must be completed before the application is submitted; findings and remediation must be documented
• Penetration testing — annual penetration tests of internet-facing systems, trading engines, and wallet infrastructure; results must be reviewed by the board and submitted to the SFC on request
• Vulnerability management — a formal patch management policy with defined SLAs for critical vulnerabilities (typically ≤72 hours for critical, ≤30 days for high)
• Incident response plan — documented IRP covering detection, containment, notification (including SFC notification within stipulated timeframes), and recovery; tested at least annually via tabletop exercises
• Business continuity — BCP and disaster recovery plan with recovery time objectives (RTOs) and recovery point objectives (RPOs) defined; secondary infrastructure must be geographically separated from primary
• System change management — all material changes to trading systems, wallet software, or custody infrastructure must go through a documented change control process with pre- and post-change testing

The SFC can conduct on-site inspections and request system access logs, audit trail records, and penetration test reports at any time. Your technology governance documentation must be audit-ready from day one of operations.

Hong Kong operates a two-tier profits tax regime for corporations. The lower rate applies to the first HKD 2,000,000 of assessable profits; the standard rate applies to everything above that threshold. A single connected group can only benefit from the lower rate through one entity.

How a crypto activity is taxed depends on whether it produces a revenue gain or a capital gain, and whether that gain arises in Hong Kong. The IRD assesses this on the facts of each case. The table below summarises the typical treatment for the most common activities.

The capital vs. revenue distinction is the critical variable. A business that holds digital assets as trading stock is taxed on disposal gains; a business that holds them as long-term investments is not. The IRD looks at intention at acquisition, holding period, frequency of transactions, and the nature of the entity’s activities as a whole.

DIPN No. 39 sets out the IRD’s approach to the taxation of transactions in cryptocurrencies (referred to as “virtual currencies” in the note). It addresses:

• Source of profits — how the IRD determines whether crypto trading profits arise in Hong Kong, including analysis of where contracts are negotiated and concluded and where assets are held.
• Capital vs. revenue — the factors applied to distinguish investment-grade holdings (0% on disposal) from trading inventory (taxable on disposal).
• Mining income — the IRD treats mining rewards as revenue receipts when the miner carries on a trade, and applies source rules based on where the mining activity is conducted.
• ICO proceeds — funds raised in a token sale are not automatically treated as capital; where tokens represent a service obligation, proceeds may be taxable as they are earned.
• Exchange losses — realised losses on crypto held as trading stock are deductible; losses on capital assets are not.

DIPN No. 39 does not have the force of law, but it represents the IRD’s published practice and is the starting point for any dispute. Businesses should document their asset classification policy at acquisition and maintain records consistent with that policy throughout the holding period.

• OKX (OKCoin HK) — withdrew its VATP application in May 2024, citing the regulatory timeline and compliance costs.
• Bybit — pulled its application in late May 2024, announcing it would no longer serve Hong Kong retail users.
• Gate.HK — withdrew in June 2024 after failing to meet the SFC’s interim requirements for deemed-to-be-licensed platforms.
• Huobi HK — withdrew following parent company restructuring and inability to satisfy minimum liquid capital requirements.

The SFC’s April 2024 circular (SFC Press Release 24PR37) set out the requirements that deemed-licensed platforms had to satisfy by 29 May 2024 or face automatic lapse of their transitional status. Several platforms missed that threshold.

Rejections and withdrawals cluster around a short list of recurring deficiencies:

• Inadequate AML/CFT systems — transaction monitoring that cannot handle the throughput and velocity of a retail exchange, or missing travel-rule compliance for inter-platform transfers.
• Weak custody arrangements — failure to demonstrate that at least 98% of client assets are held in cold storage with independent custodian sign-off.
• Thin financial buffers — applicants that could not sustain the HKD 5 million minimum liquid capital requirement on an ongoing basis, not just at application date.
• Governance gaps — responsible officers without sufficient VATP-specific experience, or internal control functions (compliance, risk, internal audit) sharing personnel across lines.
• Product scope mismatch — applications that sought retail permissions without the infrastructure the SFC requires: insurance or compensation arrangements for client assets, independent price sources, and real-time risk monitoring.

In December 2024 the SFC introduced a simplified assessment process for new VATP applicants. Rather than running a full concurrent review of all regulatory obligations at once, the SFC now stages the assessment: it first confirms that the applicant meets baseline threshold criteria (financial soundness, fit-and-proper of key persons, core systems readiness) before moving to detailed operational review. This reduces wasted effort on both sides — applicants who cannot clear the threshold learn this earlier, and those who do proceed face a more structured, predictable review timeline. No equivalent staged gateway existed under the previous process, making this a meaningful procedural improvement for well-prepared applicants.

The table below compares Hong Kong against the three jurisdictions most commonly considered by crypto founders: Singapore, Dubai (VARA), and the EU under MiCA. “Best value” cells are highlighted in green.

A few points the table does not capture:

• The A-S-P-I-Re framework — Access, Safeguards, Products, Infrastructure, Relationships — commits the SFC to rolling consultations and published timelines for each new product class (staking, OTC derivatives, tokenised securities). Applicants know what is coming and can build product roadmaps accordingly.
• The LEAP blueprint commits the Hong Kong government to infrastructure investment (digital asset settlement rail, tokenised bond programme) that creates direct institutional demand for licensed operators. Licensed firms do not just hold a regulatory credential; they gain procurement eligibility.
• Retail access is a decisive differentiator over Singapore. Since MAS restricted retail crypto trading in 2022, Singapore-licensed exchanges cannot serve individual customers. A Hong Kong VASP Type 1 + Type 7 licence allows retail spot trading — a larger addressable revenue base from day one.
• Geographic position — Hong Kong operates in UTC+8, the same timezone as Shanghai, Beijing, Tokyo, Seoul, and Singapore. A compliance team based in Hong Kong covers the full APAC trading window without after-hours shifts. No other English-common-law jurisdiction shares this timezone.