Hong Kong Crypto Licence Requirements in 2026

A Hong Kong crypto licence requires a Hong Kong company holding an SFC Virtual Asset Trading Platform (VATP) licence, at least two SFC-approved Responsible Officers and a wholly-owned custody subsidiary. Hong Kong made a deliberate choice: rather than court volume, its regulator built one of the strictest virtual-asset regimes in the world and licensed only operators who could meet it. If you are pricing a Hong Kong crypto licence on headline application fees, you are reading the wrong number — the real cost sits in the requirements, and they are steep.

This guide is the requirements checklist we work from on our own desk. It covers exactly what the 2026 Securities and Futures Commission (SFC) Virtual Asset Trading Platform (VATP) regime demands — a Hong Kong company, two approved Responsible Officers, an in-house custody subsidiary capitalised at HKD 10 million, substantial liquid capital and a full compliance and technology build — so you can weigh the licence on what it actually takes. If you want the wider picture first, our flagship Hong Kong crypto licence overview sets the scene; this is the substance behind it.

The company, the licence and who it is for

Everything starts with a Hong Kong company. The SFC licenses a Hong Kong incorporated entity operating a centralised virtual-asset trading platform — there is no remote-only route and no offshore shell that applies from elsewhere. Since 1 June 2023 the VATP licence has been mandatory to run a centralised crypto exchange serving Hong Kong, and only a small number of platforms have cleared the bar. That scarcity is the point: an SFC licence is an institutional credential that carries weight with banks, family offices and professional investors across Asia.

This is not a licence for a lean startup testing an idea. It is built for well-capitalised, institution-facing operators who can fund the capital, stand up in-house custody and staff two Responsible Officers. If that is not your profile yet, the honest answer is to structure toward it rather than rush a file that will stall. For how the regime works end to end — the two-approved-officers model and the custody architecture in particular — our Hong Kong VATP licence deep-dive is the companion to this checklist, and the Hong Kong crypto licence cost guide models the full financial commitment.

Capital and the custody subsidiary

This is the requirement that catches operators pricing Hong Kong on its fees alone. The SFC demands substantial capital, and it demands a specific custody structure. At application you must have in place:

• A Hong Kong company as the licensee — incorporated and administered in Hong Kong, operating the trading platform under SFC conditions.
• Substantial paid-up and liquid capital to SFC requirements — enough to run the platform and wind it down safely. The SFC expects licensees to be genuinely resourced, not thinly funded.
• A wholly-owned custody subsidiary capitalised at HKD 10 million — client virtual assets are held by this in-house arm, not a third-party custodian. Building and capitalising it is a hard, non-negotiable part of the file.
• Robust governance and internal-control frameworks across the group, with clear lines of accountability.

The custody rule deserves emphasis because it is where many international operators expect flexibility and find none. The SFC does not accept outsourced third-party custody: client assets sit with a wholly-owned subsidiary of the licensed platform, capitalised at HKD 10 million, with strict segregation from the platform’s own assets. That means a second entity to incorporate, capitalise and staff — a cost and a build, not a paragraph in a policy.

Responsible Officers and fit-and-proper vetting

Under the VATP regime, the SFC runs rigorous fit-and-proper vetting, and it runs on everyone behind the platform — not just the named applicant. The centrepiece is the Responsible Officer requirement, and it is one of the hardest gates to clear.

At least two SFC-approved Responsible Officers. Each RO must be an experienced, qualified individual whom the SFC vets on competence and integrity — relevant background in the regulated activity, a clean record, and sound financial standing. ROs carry personal accountability for the platform’s regulated activities, so the SFC is genuinely selective about who it approves. Sourcing two people who will actually clear that bar, and who are willing to hold the responsibility, is frequently the slowest single item on the timeline. Start it on day one.

Fit-and-proper directors and controllers. Beyond the ROs, every director and controlling shareholder is assessed for integrity, competence and financial soundness. Identity is verified, records are screened, and unresolved questions hold the file.

Source of funds and suitability. You must show not only that the business is funded but where the money comes from — a source-of-funds and suitability assessment on owners, the same standard a tier-1 bank applies. Vague or undocumented wealth is a common reason a file stalls.

The operational and AML build

Alongside people and capital, the SFC reviews a defined operational programme — and it expects the documents to be operable, not aspirational. The core of the build is:

AML/CFT to Hong Kong and FATF standards. Customer due diligence, ongoing monitoring, sanctions screening, the Travel Rule for virtual-asset transfers and suspicious-transaction reporting — all mapped to the FATF Recommendations and Hong Kong’s own requirements, and actually run by a staffed compliance function. Our primer on AML and KYC controls covers what an operable programme looks like in practice, and the same discipline applies to a virtual-asset platform.

Token due-diligence and admission criteria. The SFC expects a documented framework for assessing and admitting tokens to the platform — you cannot list at will. Each asset passes defined criteria before it reaches clients.

Market-conduct and client-asset segregation. Fair-dealing, suitability, disclosure and market-conduct obligations govern how the platform operates, and client assets must be strictly segregated from the platform’s own — the custody subsidiary is the structural expression of that rule.

Insurance or compensation for custodied assets. The SFC expects an insurance or compensation arrangement covering the risk to client virtual assets held in custody, sized to the exposure.

Technology, cybersecurity and custody security

A virtual-asset platform is a technology risk as much as a financial one, and the SFC treats it that way. The requirements run to institutional-grade custody security — key management, cold-storage controls and strict access governance over client assets — alongside resilient, tested trading systems with business-continuity arrangements. On the cybersecurity side you need encryption, access control, continuous monitoring and independent testing, plus compliant handling of personal and transaction data. These are not add-ons filed at the end; they are assessed as part of licensing and remain live obligations under ongoing SFC supervision. Filing with the technology and custody controls half-built is one of the surest ways to turn a long review into a longer one.

What the November 2025 circulars changed

The regime is maturing, not softening. In November 2025 the SFC issued circulars that expanded what licensed VATPs can offer and permitted licensees to integrate their order books with global affiliates for shared liquidity — a signal that Hong Kong wants its licensees to compete at scale, with deeper markets and a broader product set. For applicants, the practical reading is twofold: the opportunity behind an SFC licence is widening, but the core requirements that gate it — two Responsible Officers, an in-house custody subsidiary at HKD 10 million, substantial liquid capital and a full compliance and technology build — are unchanged and remain as demanding as ever. A more ambitious regime is not a lighter one.

Assembling the file in the right order

Requirements are one thing; sequence is another. The order that avoids rework is: incorporate the Hong Kong company and stand up governance first; begin sourcing and pre-clearing the two Responsible Officers immediately, because SFC approval of them is the longest pole; establish and capitalise the wholly-owned custody subsidiary at HKD 10 million in parallel; fund and evidence the paid-up and liquid capital; then build the AML/CFT, token-admission, market-conduct, custody-security, cybersecurity and insurance frameworks to SFC standard. Only then does the VATP application go in, and the SFC review that follows is thorough and iterative — expect questions, and answer them with a file that is already complete and internally consistent.

None of this is the light-touch registration an offshore jurisdiction offers — and that is the point. The SFC regime asks for a real Hong Kong company, real capital, two approved officers, in-house custody and a working compliance and technology programme, and in exchange gives you one of the most respected virtual-asset credentials in Asia, deep institutional banking access and a genuine competitive moat. It does not passport into the EU — for that you would need a separate CASP licence — but for a serious, institution-facing Asian operation, Hong Kong is the premier address.

Ready to assemble your SFC VATP requirements pack, or want a second opinion on a structure you have already started? Our team handles the Hong Kong company, Responsible Officer sourcing, custody subsidiary and full compliance build end to end, and will review any file against SFC expectations before you submit. Book a free consultation and we will tell you exactly what the licence will take.

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.