Digital Assets & Virtual Assets
Cryptocurrency Exchange Licensing in Hong Kong: The VASP Regime Explained
A practical guide to SFC licensing in Hong Kong for asset managers, investment advisers, and fund distributors, covering Type 1, 4, and 9 regulated activities, fit and proper requirements, and ongoing obligations.
The Securities and Futures Commission (SFC) is the statutory regulator for the securities and futures markets in Hong Kong. Under the Securities and Futures Ordinance (SFO), any person carrying on a “regulated activity” in Hong Kong must hold an SFC licence, unless an exemption applies. Operating without a licence is a criminal offence, carrying a maximum fine of HK$5 million and up to 7 years’ imprisonment.
For asset managers, fund managers, investment advisers, securities dealers, and financial intermediaries operating in or from Hong Kong, understanding the SFC licensing framework is foundational. This guide covers the key regulated activities, who needs a licence, the licensing process, and ongoing compliance obligations.
The SFO defines ten types of regulated activities:
A licence is required for any “person” (individual or corporation) who “carries on a business in” a regulated activity in Hong Kong, or who actively markets their services to the Hong Kong public. Key considerations:
The SFC licensing framework operates at two levels:
A corporation carrying on a regulated activity must be licensed as a Licensed Corporation (LC) for the relevant regulated activity type(s). An LC must meet: minimum paid-up capital requirements (varying by activity, e.g., HK$10 million for Type 1, HK$5 million for Type 9), liquid capital requirements (maintained on an ongoing basis), fit and proper requirements for the corporation, its directors, and substantial shareholders, and operational requirements (office, systems, controls, compliance function).
Individuals who conduct regulated activities on behalf of an LC must be individually licensed as Licensed Representatives (LRs). An LR must: be sponsored by a Licensed Corporation, satisfy the SFC’s minimum qualifications (relevant examination passes or equivalent experience), be fit and proper, and be approved as a Responsible Officer (RO) if they are to be active in management or supervision of the regulated activity.
Every LC must have at least two ROs for each regulated activity. ROs must be individually licensed and meet higher experience and qualification thresholds than ordinary LRs. They are personally responsible for supervising the regulated activity and ensuring compliance with regulatory requirements.
Applications are submitted through the SFC’s Online Licensing System (OLS). Key documents include:
The SFC conducts a fit and proper assessment of the corporation and all key individuals. Typical processing time is 3–6 months for a new LC application, though it can be longer for complex structures or where additional information is requested.
Licensed corporations must comply with the SFC’s Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission. Key obligations: act in clients’ best interests, ensure suitability of investment recommendations, disclose conflicts of interest, maintain adequate systems and controls, and keep accurate books and records.
LCs must maintain minimum paid-up capital and liquid capital at all times. Monthly financial returns (MFRs) must be submitted to the SFC reporting the LC’s capital position.
Licensed corporations are subject to AML/CFT obligations under the AMLO, including: customer due diligence (CDD), enhanced due diligence (EDD) for higher-risk clients, suspicious transaction reporting (STR) to JFIU, ongoing monitoring, and record-keeping. The SFC conducts regular AML inspections.
Each LC must designate individuals as Managers-in-Charge for eight core functions: overall management oversight, key business line, operational control and review, risk management, finance and accounting, information technology, compliance, and AML/CFT. The MIC regime requires clear accountability for each core function at a senior management level.
LCs must file: annual returns, audited accounts, notifications of material changes (change of ROs, directors, business activities, ownership). Failure to notify the SFC of material changes is an offence.
SFC licensing is the gateway to operating as a financial intermediary in Hong Kong. The licensing process is demanding but navigable with proper preparation. Once licensed, ongoing compliance is an active, resource-intensive obligation. The SFC’s enforcement posture has become increasingly assertive, and the consequences of non-compliance — criminal prosecution, licence revocation, and reputational damage — are severe.
Alan Wong LLP advises on SFC licensing applications, compliance programmes, and regulatory investigations for asset managers and financial intermediaries in Hong Kong. Contact us for a consultation.
Disclaimer: This article is provided for general information only and does not constitute legal advice. It should not be relied upon as a substitute for specific legal advice on any particular matter. No solicitor-client relationship is created by your access to or use of this article. The law may change, and its application will depend on the specific facts and circumstances of each case. To the fullest extent permitted by law, we accept no responsibility for any loss or damage arising from reliance on this article.
A practical guide to AI governance and compliance in Hong Kong — the PCPD, HKMA and SFC expectations, plus a 13-point checklist for businesses adopting AI.

Hong Kong startup PDPO guide — privacy notices, direct marketing rules, employee data, cookies, breach response, and a practical compliance checklist for founders.