Cryptocurrency Exchange Licensing in Hong Kong: The VASP Regime Explained

Introduction

Hong Kong has positioned itself as a leading global hub for virtual assets and Web3 businesses, and the regulatory framework for cryptocurrency exchanges has evolved significantly in recent years. The introduction of a mandatory licensing regime for virtual asset service providers (VASPs) under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) (Cap. 615) — which came into force on 1 June 2023 — marked a pivotal moment for the industry.

Under the new regime, any person carrying on a business of operating a virtual asset exchange (VAE) in Hong Kong must obtain a licence from the Securities and Futures Commission (SFC), regardless of whether the virtual assets traded are securities. This guide explains the key features of the VASP licensing regime, the requirements for obtaining and maintaining a licence, and the compliance obligations that licensed exchanges must meet.

Background: From Opt-In to Mandatory Licensing

Prior to June 2023, Hong Kong operated a dual-track regulatory framework for virtual asset exchanges. Exchanges offering trading in securities-type virtual assets required SFC authorisation under the Securities and Futures Ordinance (SFO). Exchanges offering only non-securities virtual assets (such as Bitcoin and Ether) could voluntarily participate in the SFC's opt-in regulatory sandbox under a November 2019 framework.

This opt-in approach was widely seen as inadequate for addressing the risks posed by an industry that had grown rapidly in scale and complexity. The AMLO amendments, which extended the SFC's licensing powers to cover all VASPs operating virtual asset exchanges in Hong Kong, brought Hong Kong into line with international standards for AML/CFT regulation of the sector and provided a comprehensive regulatory framework applicable to all crypto exchanges.

Who Needs a VASP Licence?

The licensing obligation under the AMLO applies to any person who carries on a business of providing a service of buying, selling, or exchanging virtual assets (i.e., operating a virtual asset exchange) in Hong Kong. A "virtual asset" for these purposes broadly refers to a cryptographically secured digital representation of value that can be digitally traded or transferred, including cryptocurrencies such as Bitcoin, Ether, and other similar digital assets.

The licensing obligation does not extend to all virtual asset activities — it specifically covers the operation of a virtual asset exchange. Other virtual asset activities (such as custody, advisory services, and certain fund management activities involving virtual assets) may be regulated under separate SFC frameworks, including the existing SFO licensing regime for fund managers and the proposed licensing regime for virtual asset OTC service providers.

Entities that are already licensed under the SFO to operate a virtual asset exchange as part of a securities business are also subject to the new regime.

Key Eligibility Requirements

To obtain a VASP licence from the SFC, an applicant must satisfy a number of eligibility requirements, including:

• Incorporation in Hong Kong: Only companies incorporated in Hong Kong (or overseas companies registered in Hong Kong) are eligible to apply. This means that foreign exchanges without a Hong Kong corporate presence cannot obtain a VASP licence and must establish a local entity before applying
• Fit and proper test: The applicant and its responsible officers (ROs) must be fit and proper, including meeting requirements as to integrity, financial soundness, competence, and absence of criminal or regulatory sanctions
• Adequate financial resources: Applicants must maintain minimum paid-up share capital and liquid capital requirements
• Responsible officers: At least two responsible officers must be nominated, at least one of whom must be an executive director of the applicant. ROs bear personal responsibility for ensuring compliance with applicable requirements

Core Compliance Requirements

Licensed VASPs must comply with a comprehensive framework of ongoing obligations under the AMLO, the SFC's VASP licensing conditions, and relevant codes and guidelines. Key requirements include:

AML/CFT Compliance

Given the primary objective of the AMLO regime — AML and counter-terrorist financing — licensed VASPs must implement robust AML/CFT policies and procedures. This includes conducting customer due diligence (CDD) and enhanced due diligence (EDD) for higher-risk customers, ongoing monitoring of transactions, screening against sanctions lists, reporting suspicious transactions to the Joint Financial Intelligence Unit (JFIU), and record-keeping.

VASPs must apply the Travel Rule — passing information about the originator and beneficiary of virtual asset transfers to counterpart VASPs — in accordance with the FATF Recommendation 16. Compliance with the Travel Rule requires VASPs to have appropriate technology solutions in place to transmit and receive the required information.

Client Asset Protection

Licensed VASPs are required to implement strict client asset segregation measures, ensuring that client virtual assets and fiat currency are held separately from the VASP's own assets and are protected in the event of the VASP's insolvency. VASPs must maintain custody arrangements that adequately protect client assets, including requirements regarding cold storage and insurance.

Product Due Diligence

VASPs must conduct due diligence on virtual assets before making them available for trading on their platform. This includes assessing the background and legitimacy of the virtual asset, its regulatory status (in particular, whether it constitutes a security), and its AML/CFT risk profile. The SFC has issued guidance on criteria for assessing virtual assets for listing on licensed exchanges.

Retail Investor Access

Subject to meeting specified conditions, licensed VASPs may offer virtual asset trading services to retail investors. These conditions include requirements as to token eligibility (limiting retail access to virtual assets that are included in at least two accepted indices from providers approved by the SFC), appropriate investor onboarding assessments, risk disclosure, and exposure limits for retail clients.

Governance and Risk Management

Licensed VASPs must establish sound corporate governance frameworks, including appropriate board oversight, risk management systems, internal controls, and technology and cybersecurity safeguards. They must also maintain business continuity plans and adequate insurance coverage.

The Transition Arrangement

Recognising that the VASP licensing regime was new, the AMLO provided a transition arrangement for existing operators who were carrying on a VASP business in Hong Kong immediately before 1 June 2023. These operators were permitted to continue operating during a transition period (which ran to 29 February 2024) while they prepared and submitted their licence applications, subject to meeting certain deemed-to-be-licensed conditions.

Operators that submitted a deemed-to-be-licensed application before the deadline could continue to carry on business while their application was being considered by the SFC. Those that did not file by the deadline are required to cease operations until a licence is granted. Operators that commenced business after 1 June 2023 without a licence are subject to criminal sanctions.

Enforcement and Penalties

Operating a virtual asset exchange in Hong Kong without a VASP licence is a criminal offence under the AMLO, punishable by a fine of up to HK$5 million and imprisonment of up to seven years. The SFC has signalled that it takes compliance with the licensing regime seriously and has taken enforcement action against unlicensed operators. VASPs must also comply with SFC requirements to refrain from soliciting Hong Kong investors to use unlicensed platforms.

Interaction with the SFO Regime

A VASP that operates an exchange offering trading in securities-type virtual assets (i.e., tokens that constitute "securities" under the SFO) must also hold the appropriate SFC licence under the SFO (typically a Type 1 licence for dealing in securities and a Type 7 licence for providing automated trading services). The VASP and SFO regimes run in parallel, and VASPs dealing in securities tokens must comply with both sets of requirements.

How Alan Wong LLP Can Help

Alan Wong LLP advises virtual asset exchanges and other VASP businesses on all aspects of the Hong Kong licensing regime. Our services include:

• Advising on the scope of the VASP licensing obligation and eligibility requirements
• Assisting with the preparation and submission of VASP licence applications to the SFC
• Reviewing and advising on AML/CFT compliance frameworks and Travel Rule solutions
• Drafting policies and procedures for client asset protection, product due diligence, and retail investor onboarding
• Advising on governance, risk management, and cybersecurity requirements
• Advising on the SFO licensing requirements applicable to exchanges dealing in securities tokens

Conclusion

The VASP licensing regime represents a coming-of-age for Hong Kong's virtual asset regulatory framework, providing a clear and comprehensive legal basis for the operation of cryptocurrency exchanges in one of Asia's most important financial markets. For exchanges seeking to establish or maintain operations in Hong Kong, obtaining and maintaining a VASP licence is a significant but manageable undertaking with the right legal and compliance support.

This article is for general information purposes only and does not constitute legal advice. For advice on VASP licensing or virtual asset regulation matters, please contact Alan Wong LLP.