Digital Assets & Virtual Assets
Cryptocurrency Exchange Licensing in Hong Kong: The VASP Regime Explained
Hong Kong SVF licensing guide — who needs an HKMA licence, application requirements, capital and float protection, AML compliance, and the virtual banking framework explained.
Hong Kong's payments and e-money landscape has been transformed over the past decade. The rise of mobile wallets, contactless payments, cross-border remittance platforms, and virtual banks has created a rich and competitive ecosystem, underpinned by a regulatory framework administered by the Hong Kong Monetary Authority (HKMA).
Two distinct licensing regimes are relevant for businesses operating in this space: the Stored Value Facility (SVF) regime under the Payment Systems and Stored Value Facilities Ordinance (PSSVFO) and the virtual bank licensing regime under the Banking Ordinance. This guide explains both regimes, the obligations they impose, and the practical considerations for businesses seeking to operate in Hong Kong's digital payments and banking market.
A stored value facility (SVF) is a facility that stores monetary value — in electronic or other form — that can be used to make payments or transfer value. Common examples include e-wallets, prepaid payment cards, mobile payment apps, and certain cryptocurrency platforms where fiat currency is held on behalf of users.
Under the PSSVFO (Cap. 584), which came into full effect in November 2016, any person who issues or operates a multi-purpose SVF in Hong Kong must be licensed by the HKMA. A multi-purpose SVF is one that can be used to make payments to multiple payees (as opposed to a single-purpose SVF, which can only be used with a specific merchant or service provider).
Single-purpose SVFs — such as a retailer's own gift card or a transit operator's own card — are generally exempt from licensing, though HKMA has discretion to bring specific single-purpose SVFs into the licensing regime if they reach a sufficient scale.
Any business that issues or operates a multi-purpose stored value facility accessible to the Hong Kong public must hold an HKMA SVF licence. This includes:
Operators of virtual currency exchanges where users deposit fiat currency (which is then held in a stored form) may also fall within the SVF regime depending on the specific structure of the platform. Businesses should take legal advice on whether their platform constitutes a multi-purpose SVF before launch.
An SVF licence is issued by the HKMA following an application process that assesses the financial soundness, operational readiness, and regulatory compliance of the applicant. Key requirements include:
Once licensed, SVF operators are subject to ongoing regulatory requirements including:
SVF licensees must also comply with specific consumer protection obligations, including clear disclosure of fees, terms and conditions, and complaints handling procedures. The HKMA may vary or revoke an SVF licence if a licensee fails to meet its ongoing obligations.
Separate from the SVF regime, the HKMA introduced a virtual bank licensing framework in 2018, following the issue of guidance on the authorisation of virtual banks. Virtual banks (also called digital banks or neobanks) are banks that deliver banking services primarily through electronic channels, without a physical branch network.
Virtual banks in Hong Kong are authorised under the Banking Ordinance (Cap. 155) and are subject to the same regulatory requirements as conventional licensed banks, including capital adequacy, liquidity, credit risk management, and AML/CFT obligations. The HKMA issued eight virtual bank licences between 2019 and 2020 to operators including subsidiaries of Alibaba, Tencent, Standard Chartered, and ZhongAn Insurance, among others.
Key features of the virtual banking regime include:
In addition to SVF licensing and virtual bank authorisation, the PSSVFO also establishes a regulatory regime for designated retail payment systems (RPS). An RPS is a payment system that processes retail payment transactions and is designated by the HKMA based on systemic importance or the interests of users. Operators of designated RPS are subject to oversight by the HKMA in relation to systems safety, risk management, and user protection.
Major card payment schemes operating in Hong Kong may be designated as RPS under this framework. The regime does not directly affect most e-wallet or fintech businesses, but businesses building payment infrastructure that processes significant volumes of retail transactions should be aware of the potential for designation.
Hong Kong-based SVF operators and digital banks increasingly serve cross-border payment use cases, particularly for transfers between Hong Kong and Mainland China and other Asian markets. Cross-border payments engage additional regulatory considerations:
For businesses considering entering the Hong Kong digital payments or digital banking market:
Alan Wong LLP advises fintech companies, payment service providers, and financial institutions on regulatory compliance in Hong Kong, including SVF licensing applications, virtual bank authorisation, AML/CFT programme design, and ongoing compliance obligations under the PSSVFO and Banking Ordinance. We also advise on the structuring of cross-border payment products and the regulatory considerations applicable to digital asset payment platforms.
Whether you are preparing an SVF licence application, reviewing your existing compliance framework, or assessing whether your payment product requires authorisation, we can provide targeted and practical advice.
Disclaimer: This article is provided for general information only and does not constitute legal advice. It should not be relied upon as a substitute for specific legal advice on any particular matter. No solicitor-client relationship is created by your access to or use of this article. The law may change, and its application will depend on the specific facts and circumstances of each case. To the fullest extent permitted by law, we accept no responsibility for any loss or damage arising from reliance on this article.
A practical guide to AI governance and compliance in Hong Kong — the PCPD, HKMA and SFC expectations, plus a 13-point checklist for businesses adopting AI.

Hong Kong startup PDPO guide — privacy notices, direct marketing rules, employee data, cookies, breach response, and a practical compliance checklist for founders.