Hong Kong Crypto Licence Requirements in 2026

A Hong Kong crypto licence requires a Hong Kong company holding an SFC Virtual Asset Trading Platform (VATP) licence, at least two SFC-approved Responsible Officers and a wholly-owned custody subsidiary. Hong Kong made a deliberate choice: rather than court volume, its regulator built one of the strictest virtual-asset regimes in the world and licensed only operators who could meet it. If you are pricing a Hong Kong crypto licence on headline application fees, you are reading the wrong number — the real cost sits in the requirements, and they are steep.

This guide covers exactly what the 2026 Securities and Futures Commission (SFC) Virtual Asset Trading Platform (VATP) regime demands, from a Hong Kong company and two approved Responsible Officers to an in-house custody subsidiary holding a Hong Kong TCSP licence, substantial liquid capital and a full compliance and technology build, so you can weigh the licence on what it actually takes. If you want the wider picture first, our flagship Hong Kong crypto licence overview sets the scene; this is the substance behind it.

The company, the licence and who it is for

Everything starts with a Hong Kong company. The SFC licenses a Hong Kong incorporated entity operating a centralised virtual-asset trading platform — there is no remote-only route and no offshore shell that applies from elsewhere. Since 1 June 2023 the VATP licence has been mandatory to run a centralised crypto exchange serving Hong Kong, and only a small number of platforms have cleared the bar. That scarcity is why an SFC licence works as an institutional credential that carries weight with banks, family offices and professional investors across Asia.

This is not a licence for a lean startup testing an idea. It is built for well-capitalised, institution-facing operators who can fund the capital, stand up in-house custody and staff two Responsible Officers. If that is not your profile yet, the answer is to structure toward it rather than rush a file that will stall. For how the regime works end to end, particularly the two-approved-officers model and the custody architecture, our Hong Kong VATP licence deep-dive is the companion to this checklist, and the Hong Kong crypto licence cost guide models the full financial commitment.

Capital and the custody subsidiary

This is the requirement that catches operators pricing Hong Kong on its fees alone. The SFC demands substantial capital, and it demands a specific custody structure. At application you must have in place:

• A Hong Kong company as the licensee — incorporated and administered in Hong Kong, operating the trading platform under SFC conditions.
• HK$5 million of paid-up capital and at least HK$3 million of liquid capital to SFC requirements — enough to run the platform and wind it down safely. The SFC expects licensees to be properly resourced, with funding to match the platform.
• A wholly-owned custody subsidiary holding a Hong Kong TCSP licence. Client virtual assets are held by this in-house arm rather than by a third-party custodian. Building and capitalising it is a hard, non-negotiable part of the file.
• Robust governance and internal-control frameworks across the group, with clear lines of accountability.

The custody rule deserves emphasis because it is where many international operators expect flexibility and find none. The SFC does not accept outsourced third-party custody: client assets sit with a wholly-owned subsidiary of the licensed platform holding a Hong Kong TCSP licence, with strict segregation from the platform’s own assets. That means a second entity to incorporate, capitalise and staff, with its own budget line.

Responsible Officers and fit-and-proper vetting

Under the VATP regime, the SFC runs rigorous fit-and-proper vetting on the named applicant and on everyone behind the platform. The centrepiece is the Responsible Officer requirement, and it is one of the hardest gates to clear.

At least two SFC-approved Responsible Officers. Each RO must be an experienced, qualified individual whom the SFC vets on competence and integrity — relevant background in the regulated activity, a clean record, and sound financial standing. ROs carry personal accountability for the platform’s regulated activities, so the SFC is genuinely selective about who it approves. Sourcing two people who will actually clear that bar, and who are willing to hold the responsibility, is frequently the slowest single item on the timeline. Start it on day one.

Fit-and-proper directors and controllers. Beyond the ROs, every director and controlling shareholder is assessed for integrity, competence and financial soundness. Identity is verified, records are screened, and unresolved questions hold the file.

Source of funds and suitability. The SFC wants evidence of where the money behind the business came from as well as proof that it is there: a source-of-funds and suitability assessment on the owners, at the depth a tier-1 bank would go. Undocumented wealth is a common reason a file stalls.

The operational and AML build

Alongside people and capital, the SFC reviews a defined operational programme and expects every document in it to work in practice. The core of the build is:

AML/CFT to Hong Kong and FATF standards. Customer due diligence, ongoing monitoring, sanctions screening, the Travel Rule for virtual-asset transfers and suspicious-transaction reporting — all mapped to the FATF Recommendations and Hong Kong’s own requirements, and actually run by a staffed compliance function. Our primer on AML and KYC controls covers what an operable programme looks like in practice, and the same discipline applies to a virtual-asset platform.

Token due-diligence and admission criteria. The SFC expects a documented framework for assessing and admitting tokens to the platform — you cannot list at will. Each asset passes defined criteria before it reaches clients.

Market-conduct and client-asset segregation. Fair-dealing, suitability, disclosure and market-conduct obligations govern how the platform operates, and client assets must be strictly segregated from the platform’s own — the custody subsidiary is the structural expression of that rule.

Insurance or compensation for custodied assets. The SFC expects an insurance or compensation arrangement covering the risk to client virtual assets held in custody, sized to the exposure.

Technology, cybersecurity and custody security

A virtual-asset platform is a technology risk as much as a financial one, and the SFC treats it that way. The requirements run to institutional-grade custody security (key management, cold-storage controls and strict access governance over client assets) alongside resilient, tested trading systems with business-continuity arrangements. On the cybersecurity side you need encryption, access control, continuous monitoring and independent testing, plus compliant handling of personal and transaction data. These are assessed as part of licensing and remain live obligations under ongoing SFC supervision. Filing with the technology and custody controls half-built usually lengthens an already long review.

What the November 2025 circulars changed

In November 2025 the SFC issued circulars that expanded what licensed VATPs can offer and permitted licensees to integrate their order books with global affiliates for shared liquidity, signalling that Hong Kong wants its licensees to compete at scale, with deeper markets and a broader product set. For applicants, the practical reading is twofold: the opportunity behind an SFC licence is widening, but the core requirements that gate it (two Responsible Officers, an in-house custody subsidiary with a TCSP licence, HK$5 million paid-up and HK$3 million liquid capital and a full compliance and technology build) are unchanged and remain as demanding as ever.

Assembling the Hong Kong file in the right order

The order that avoids rework is: incorporate the Hong Kong company and stand up governance first; begin sourcing and pre-clearing the two Responsible Officers immediately, because SFC approval of them is the longest pole; establish the wholly-owned custody subsidiary and its TCSP licence in parallel; fund and evidence the paid-up and liquid capital; then build the AML/CFT, token-admission, market-conduct, custody-security, cybersecurity and insurance frameworks to SFC standard. Only then does the VATP application go in, and the SFC review that follows is thorough and iterative — expect questions, and answer them with a file that is already complete and internally consistent.

The SFC regime is far heavier than an offshore registration. It asks for a real Hong Kong company, real capital, two approved officers, in-house custody and a working compliance and technology programme, and in exchange gives you one of the most respected virtual-asset credentials in Asia, deep institutional banking access and a genuine competitive moat. It does not passport into the EU (for that you would need a separate CASP licence), but for a serious, institution-facing Asian operation, Hong Kong is the premier address.

Ready to assemble your SFC VATP requirements pack, or want a second opinion on a structure you have already started? Our team handles the Hong Kong company, Responsible Officer sourcing, custody subsidiary and full compliance build end to end, and will review any file against SFC expectations before you submit. Book a free consultation and we will tell you exactly what the licence will take.

Christina S.

Crypto Licensing at Vantegris

Christina S. is part of the Vantegris team, which prepares and files licence applications across 40+ jurisdictions. This article was reviewed by Vladyslav S. (Compliance & Legal).

Full profile Book a free consultation

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.