HK VATP — Virtual Asset Trading Platform Licence
Executive summary
Hong Kong's VATP regime is the most architecturally novel of any post-2023 crypto-exchange framework. Effective 1 June 2023 under amendments to the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615), the regime created a single licensing pathway for virtual asset trading platforms operating in or marketing into Hong Kong, with parallel obligations under the Securities and Futures Ordinance (Cap. 571) Type 1 and Type 7 categories where the platform offers virtual assets that qualify as securities or operates an automated trading service. The August 2023 retail-access activation made Hong Kong one of the first developed-economy jurisdictions to permit licensed crypto exchanges to serve retail customers under a comprehensive regulatory framework, distinct from the EU's earlier wholesale-only EMD-based regime. As of mid-2026 the SFC has granted full VATP licences to 13 firms — among them OSL, HashKey, HKVAX, HKbitEX (Hong Kong Digital Asset EX), Accumulus, DFX Labs, EX.IO, PantherTrade (Futu), YAX (Tiger Brokers), Bullish, BGE, and VDX — with several further applications still under review. OKX and Crypto.com withdrew their Hong Kong VATP applications during 2024 and are not licensed VATPs. The transitional grandfathering regime under AMLO Section 53ZRK closed on 31 May 2024, and the post-transition enforcement environment has been notably firmer than the pre-transition consultative phase, with several deemed-licensed firms withdrawing rather than face refusal. The OTC platform consultation closed in 2024 and produced a separate licensing regime expected to come into force during 2026.
Statutory architecture
The VATP regime sits in Part 5B of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, inserted by the Anti-Money Laundering and Counter-Terrorist Financing (Amendment) Ordinance 2022 effective 1 June 2023. Section 53ZRA defines a virtual asset trading platform as a facility providing, or holding itself out as providing, services for trading or buying and selling of virtual assets. Section 53ZRD requires any person operating a VATP in Hong Kong, or actively marketing VATP services to the Hong Kong public, to hold a VATP licence from the SFC. Section 53ZRG defines virtual asset broadly to include any cryptographically-secured digital representation of value used as a medium of exchange, store of value, or unit of account, but excludes central-bank-issued digital currencies and certain limited-use digital tokens. The SFC also operates a parallel licensing regime under the Securities and Futures Ordinance (Cap. 571): a VATP that offers any virtual asset constituting a security under Section 1 of the Schedule must additionally hold a Type 1 (dealing in securities) regulated activity licence, and a VATP operating an automated trading service must hold a Type 7 (providing automated trading services) licence. The dual-track architecture means most fully-licensed VATPs hold both an AMLO VATP licence and SFO Type 1 plus Type 7 licences. The SFC's published VATP Code of Conduct sets out detailed conduct requirements covering token admission, custody, market surveillance, conflicts of interest, customer-asset segregation, financial-resources adequacy, and ongoing reporting. The HKMA holds parallel jurisdiction over banks providing banking services to VATPs, and a separate stablecoin-issuer regime under the Stablecoin Issuers Bill (passed in 2025 and effective in phases through 2025-2026) places stablecoin issuance under direct HKMA supervision rather than under the VATP regime. The transitional grandfathering provision under Section 53ZRK provided a deemed-licensed status from 1 June 2023 to 31 May 2024 for pre-existing operators, after which deemed-licensed firms either obtained full licences, accepted determinations, or wound down.
License tiers and categories
The VATP regime is single-tier — a firm is either licensed or not — but the activity scope of the licence is specified at application. Three core scope axes apply. First, customer base: a VATP licence may be scoped to professional investors only or to retail and professional investors together. Retail-eligible licensing requires substantially more rigorous token-admission processes, customer-disclosure documentation, and ongoing risk-rating mechanics. Second, asset scope: the SFC operates an approved-asset list under the VATP Code of Conduct that distinguishes Tier 1 assets (BTC, ETH, and other large-cap assets meeting specific liquidity, market-cap, governance, and surveillance criteria) from Tier 2 assets (other approved virtual assets meeting a lower bar). Retail offerings are typically restricted to Tier 1 assets in practice, though the formal SFC position permits Tier 2 retail offerings subject to enhanced disclosures. Third, functional scope: trading-only (the core VATP licence), trading-plus-custody (where the VATP performs proprietary or third-party custody), and trading-plus-staking (where the VATP offers protocol staking services to customers under specific SFC guidance issued in 2024). The OTC platform consultation closed in 2024 and produced a parallel OTC Virtual Asset Trading Service Provider regime expected to come into force during 2026; this regime will cover off-exchange trading and brokerage services that fall outside the existing VATP perimeter. Stablecoin issuance is excluded from the VATP regime and falls under the separate Stablecoin Issuers Bill effective in phases through 2025-2026 under HKMA supervision. Custody-only services may sit outside the VATP perimeter but remain within Type 13 (providing depositary services for relevant CIS) or other SFO regulated activity perimeters depending on structure. Lending and borrowing services have no clear current perimeter under the VATP regime and are flagged for future SFC consultation.
Capital and operational requirements
VATP licensing imposes specific minimum capital and operational requirements. Minimum paid-up capital is 5 million Hong Kong dollars (approximately 640,000 dollars at current rates) per AMLO and SFO Type 7 requirements. Minimum liquid capital is the higher of 3 million Hong Kong dollars or one quarter of the licensee's annual operating expenses, as required by Schedule 2 of the Financial Resources Rules under the SFO. Insurance: the SFC requires VATPs to maintain insurance covering at least 100 percent of customer assets held in hot wallets and at least 50 percent of customer assets held in cold wallets, with the insurance arranged through a panel of approved insurers. Custody: customer crypto-assets must be held with the VATP's associated entity or with a third-party custodian, with at least 98 percent in cold storage at all times. Customer-asset segregation: customer assets must be held in trust accounts legally segregated from the VATP's proprietary assets, with daily reconciliation. Internal controls: a board-level Risk Committee, a Compliance Officer reporting to the board, an MLRO, an independent internal audit function, and a separate Chief Information Officer with personal accountability for cybersecurity. Token admission: the SFC's published Token Due Diligence Guidelines require a published methodology covering legal classification, security audit results, market-cap and liquidity analysis, governance and tokenomics review, sanctions and AML screening, and ongoing surveillance; the methodology must be reviewed annually. Market surveillance: the VATP must operate a market-surveillance system capable of detecting wash trading, spoofing, and other manipulative trading patterns, with periodic SFC inspection. Travel Rule: the SFC has imposed Travel Rule obligations through the VATP Code of Conduct effective 1 January 2024, with a 8,000 Hong Kong dollar (approximately 1,000 dollar) threshold and full data-field transmission requirements consistent with FATF Recommendation 16. Ongoing reporting: monthly financial returns, quarterly conduct returns, annual audited financial statements, and a comprehensive annual SFC questionnaire covering all aspects of VATP operations.
Notable licensees
The SFC's published VATP register lists 13 firms with full VATP licences as of mid-2026. HashKey Exchange, the licensed pillar of the HashKey Group ecosystem, was among the first to obtain full retail-eligible licensing in August 2023 and operates one of the largest licensed Hong Kong retail businesses. OSL Digital Securities (BC Group), the longest-licensed firm dating to pre-AMLO Type 1 and Type 7 SFO licensing in 2020, transitioned to full VATP licensing and operates an institutional-focused business. The other licensed operators include HKVAX (Hong Kong Virtual Asset Exchange), HKbitEX (Hong Kong Digital Asset EX), Accumulus, DFX Labs, EX.IO, PantherTrade (a Futu subsidiary), YAX (a Tiger Brokers subsidiary), Bullish, BGE, VDX (Victory Fintech), and NewBX (Bixin). Several of these — PantherTrade and YAX among them — reflect the entry of established Hong Kong brokerages into the licensed VATP market. Notable non-licensees are as important as the licensees: OKX and Crypto.com both withdrew their Hong Kong VATP applications during 2024 and do not hold VATP licences, and several offshore-affiliated platforms withdrew after SFC pre-application engagement signalled likely refusal. On the stablecoin side, the separate Stablecoins Ordinance took effect on 1 August 2025 under HKMA supervision; the HKMA has drawn strong interest from candidates including JD Coinlink, a Standard Chartered / Animoca / HKT consortium, and other banking and fintech groups, with the first issuer licences expected to go to only a small number of applicants.
Enforcement actions to date
VATP enforcement focuses on three pillars. First, unlicensed platform action: the SFC has been notably aggressive against offshore-based platforms marketing into Hong Kong, with the most prominent action being the September 2023 enforcement action against JPEX, a Hong Kong-marketed platform that suffered a significant alleged fraud-and-collapse event prior to obtaining licensing. The JPEX case produced criminal charges against several individuals, civil restraint orders, and material reputational damage to the broader Hong Kong crypto sector. Subsequent unlicensed-platform enforcement actions have included a 2024 cease-and-desist against Hounax (alleged fraudulent platform marketing into Hong Kong), a 2024 action against several smaller platforms operating without VATP licences, and ongoing investigations into deemed-licensed firms whose transitional status was withdrawn. Second, licensed-firm supervisory action: the SFC has issued business improvement orders against several licensed VATPs for AML programme deficiencies, token-admission process gaps, and customer-asset segregation issues, with the most prominent action being a 2025 supervisory action against a mid-tier licensed firm for failures in cold-storage controls. Third, market-conduct enforcement: the SFC has investigated suspected wash trading and other manipulative patterns on licensed VATPs, with one action resulting in personal sanctions against a Compliance Officer. Cross-border coordination has been substantial: the SFC's joint actions with Mainland Chinese authorities on Hong-Kong-marketed platforms targeting Mainland residents have produced enforcement-friendly outcomes, and the SFC's information-sharing with the JFSA, MAS, and the SEC continues under multiple bilateral MOUs.
How to apply
A VATP application is filed with the SFC's Intermediaries Supervision Department through the SFC's electronic submission system (WINGS). Pre-application engagement is mandatory and substantive: most successful applications involve six to twelve months of pre-application work before formal submission, including detailed scoping of business model, customer-asset segregation architecture, internal-control framework, and proposed token offerings. The substantive application requires a programme of operations, three-year financial projections, biographical questionnaires for every Responsible Officer and senior officer, fingerprint records for substantial shareholders, a detailed business plan, an AML/CFT manual aligned with the AMLO and the Drug Trafficking (Recovery of Proceeds) Ordinance, a Travel Rule compliance plan, an operational-resilience plan including cyber-security and disaster-recovery, an ICT framework, a customer-asset segregation architecture document with specific cold-storage controls, a market-surveillance system specification, a token-admission methodology, an MLRO appointment, an independent internal audit function appointment, an external auditor appointment, and a comprehensive Compliance Manual. Additional Type 1 and Type 7 licensing requires SFO-specific application materials including conduct rules, fitness and propriety evidence for Responsible Officers, and a separate Compliance Function. Statutory determination has no specific timeline under AMLO but the SFC's substantive review extends actual determination to 12 to 24 months in practice, with several applications taking substantially longer. All-in cost runs 15 to 80 million Hong Kong dollars (approximately 1.9 to 10 million dollars) depending on complexity. Common rejection reasons include inadequate cold-storage architecture, insufficient detail on customer-asset segregation, gaps in AML programme, weak Responsible Officer fitness-and-propriety evidence, insufficient capital backing, and inadequate market-surveillance system.
Comparison to peer frameworks
Against MiCA, the Hong Kong VATP regime is more architecturally focused on operational rigour (98 percent cold storage, mandatory insurance, granular token-admission methodology) but narrower in geographic reach (Hong Kong-only versus 27-state EU passport). Against Singapore's MAS Payment Services Act, the Hong Kong regime is broadly comparable in conduct rigour but has a more granular token-admission process and more restrictive retail eligibility. Against the New York BitLicense, the Hong Kong regime is broader in functional scope (incorporating Type 1 and Type 7 SFO requirements) and produces a more globally-recognised licence given Hong Kong's status as an Asia-Pacific financial hub. Against Japan's PSA crypto-exchange regime, the Hong Kong regime has comparable operational rigour but a more permissive token-onboarding architecture (the SFC's published methodology is more flexible than the JVCEA's pre-listing review). Against the FCA cryptoasset registration regime, the Hong Kong regime is broader in conduct scope and more substantively rigorous on operational controls. Against VARA's Dubai regime, the Hong Kong regime is more SFO-integrated and produces a globally-recognised licence in markets that recognise SFC supervision. The trade-off is commercial: Hong Kong VATPs face higher capital and operational costs than peer regimes, narrower retail eligibility, and a smaller domestic market than EU MiCA licensees, but the licence's regional reach and the SFC's globally-recognised supervisory rigour produce substantial commercial benefit for Asia-Pacific institutional business.
Open questions and pending changes
Three issues dominate operator planning through 2026 and 2027. First, the OTC platform regime: the SFC's 2024 consultation closed and produced draft rules that the SFC is expected to finalise during 2026. The OTC perimeter will cover off-exchange trading and brokerage services and will likely overlap with the existing VATP perimeter in ways that the SFC has not yet fully clarified. Second, the stablecoin issuer regime under HKMA supervision: the Stablecoin Issuers Bill effective in phases through 2025-2026 will produce the first major stablecoin licensing regime in Asia-Pacific, with HKD-pegged and other-currency-pegged stablecoin issuers facing substantial capital, reserve-composition, and disclosure requirements. The interaction between the HKMA stablecoin perimeter and the SFC VATP perimeter has not been fully clarified, particularly for VATPs that propose to offer or distribute stablecoins issued under the HKMA regime. Third, the lending and borrowing perimeter: the SFC's position on protocol-based lending services, lending against custodied assets, and yield-bearing products has not been finalised, and a future consultation is expected during 2026. Operators should also watch the SFC's evolving guidance on staking services (2024 guidance permitted staking under specific conditions), the post-DeFi consultation expected 2026-2027, the interaction with the HKMA Project Ensemble (the wholesale CBDC pilot that includes tokenised deposit and stablecoin trials), and the cross-border supervisory cooperation framework with Mainland Chinese authorities.
Watch points
- OTC platform regime finalisation expected 2026
- HKMA stablecoin issuer regime full effective dates 2025-2026
- Lending and borrowing perimeter consultation expected 2026
- Interaction between HKMA stablecoin and SFC VATP perimeters
- Post-DeFi consultation expected 2026-2027
- Cross-border supervisory cooperation with Mainland China
TL;DR
First major developed-economy regime to permit licensed retail crypto exchange access (August 2023); 13 full VATP licensees (OKX and Crypto.com withdrew), OTC and stablecoin regimes still being built out, JPEX scandal of 2023 reshaped enforcement posture and tightened licence-grant bar materially.
Get DeFi Intel research in your inbox
Weekly long-form coverage of papers, incidents, jurisdictions, chains, tokens and the people building them. Free tier covers headlines; Pro adds the analyst-grade breakdowns.
Sources
- SFC lists of licensed virtual asset trading platforms — sfc.hk
- Licensed crypto exchanges in Hong Kong (2026) — fintechnews.hk
- HKMA Stablecoins Ordinance (effective 1 August 2025) — hkma.gov.hk
Licensee list verified against the SFC register, 2026-07-15.