Digital Assets & Virtual Assets
Cryptocurrency Exchange Licensing in Hong Kong: The VASP Regime Explained
A legal and regulatory guide to Security Token Offerings (STOs) in Hong Kong: SFC framework, security token classification, prospectus requirements, intermediary licensing, tokenised bonds and funds, and practical compliance checklist.
Security token offerings (STOs) represent one of the most significant developments at the intersection of traditional securities law and blockchain technology. An STO involves the issuance of digital tokens on a blockchain that represent ownership of, or rights in, an underlying asset — whether equity in a company, debt, real estate, fund interests, or other financial instruments. Unlike utility token sales (which aim to provide access to a product or service), STOs are explicitly designed to constitute securities, and are therefore subject to securities regulation.
This article examines the legal and regulatory framework for STOs in Hong Kong, the SFC’s approach, and the key considerations for issuers.
A token is a security token if it constitutes a “security” as defined in the Securities and Futures Ordinance (SFO). The most common categories engaged by STOs are:
The SFC applies a “look-through” approach: the label applied by the issuer is irrelevant. If the economic substance of the token is that of a security, it is regulated as one regardless of what it is called.
The SFC has issued a number of statements and circulars addressing STOs. Its position, consistent since its November 2018 Statement on STOs, is that: security tokens are “securities” under the SFO; dealing in, advising on, and managing security tokens requires SFC licensing; and STOs offered to the public in Hong Kong must comply with the prospectus requirements of the Companies (Winding Up and Miscellaneous Provisions) Ordinance (Cap. 32) or an exemption must apply.
The following SFC licences are relevant to STOs:
In practice, most STOs in Hong Kong are structured as private placements to “professional investors” only, relying on the exemptions under Section 103(3) of the SFO (which exempts offers made only to professional investors from the prohibition on offering CIS interests to the public without SFC authorisation) and under the Companies (Winding Up and Miscellaneous Provisions) Ordinance (which provides a prospectus exemption for offers to professional investors).
“Professional investors” under the SFO include: institutions (banks, licensed corporations, insurance companies, authorised institutions), corporate investors with portfolios exceeding HK$8 million, and individual investors with portfolios exceeding HK$8 million who sign a professional investor declaration.
The SFC has indicated that secondary market trading in security tokens should only be conducted on SFC-licensed platforms. This is a significant constraint: there are currently very few SFC-licensed platforms with the technical capability to support secondary trading in security tokens. The SFC’s licensing regime for virtual asset trading platforms (VATPs) under the AMLO provides a separate licensing pathway for platforms trading non-security virtual assets, but for security tokens, Type 7 (Automated Trading Services) or Type 1 licensing on an appropriate platform is required.
Determine what the token represents: equity (shares in a company), debt (a bond or note), fund interests (units in a fund or OFC), or real estate interests (beneficial interests in a property-owning SPV). The choice of underlying asset determines the applicable legal framework and documentation requirements.
Obtain a written legal opinion from Hong Kong counsel confirming the token’s characterisation as a security (and the applicable regulatory framework). This is essential for the offering document and for representations to exchanges and investors.
The primary distribution of security tokens must be conducted through an SFC Type 1 licensed entity. The issuer itself may apply for a Type 1 licence, or it may appoint an existing licensed intermediary as the placement agent or distributor.
An STO requires a comprehensive offering memorandum disclosing: the issuer’s business and financial position, the terms of the security token (rights, restrictions, transferability), the technology and smart contract architecture, AML/KYC procedures for investors, risk factors (including technology risk, liquidity risk, and regulatory risk), and the dispute resolution mechanism.
All investors must undergo AML/KYC verification before receiving security tokens. The KYC process must be conducted by a regulated entity (the Type 1 licensed distributor or its AML/KYC service provider). Robust investor eligibility verification (confirming professional investor status) is essential.
The smart contract governing the token issuance, transfer, and any automated distributions should be independently audited by a reputable blockchain security firm. Smart contract bugs can result in loss of assets, unintended token creation, or unauthorised transfers.
Arrange for secondary market trading on an appropriate licensed platform. Given the limited availability of SFC-licensed platforms supporting security token trading, this is currently one of the most challenging aspects of STO structuring. Some issuers have established bilateral OTC transfer arrangements as an interim measure.
STOs in Hong Kong are regulated as securities offerings, with all the associated licensing, disclosure, and compliance requirements. The SFC’s “look-through” approach means that technology does not change regulatory treatment. A well-structured STO — with proper licensing, a comprehensive offering memorandum, robust AML/KYC, and a smart contract audit — is achievable, but requires careful planning and experienced legal counsel.
Alan Wong LLP advises on security token offerings, SFC licensing, and digital asset law in Hong Kong. Contact us to discuss your STO.
Disclaimer: This article is provided for general information only and does not constitute legal advice. It should not be relied upon as a substitute for specific legal advice on any particular matter. No solicitor-client relationship is created by your access to or use of this article. The law may change, and its application will depend on the specific facts and circumstances of each case. To the fullest extent permitted by law, we accept no responsibility for any loss or damage arising from reliance on this article.
A practical guide to AI governance and compliance in Hong Kong — the PCPD, HKMA and SFC expectations, plus a 13-point checklist for businesses adopting AI.

Hong Kong startup PDPO guide — privacy notices, direct marketing rules, employee data, cookies, breach response, and a practical compliance checklist for founders.