Hong Kong Crypto Licence: The SFC VATP Guide

If Malta is a highly regarded name in EU crypto, Hong Kong plays a similar role in Asia — and, if anything, it is harder to get. The Securities and Futures Commission runs one of the most demanding virtual-asset regimes in the world, has approved only a handful of platforms, and shows no interest in courting volume. The selectivity is intentional.

The teams that pursue a Hong Kong Virtual Asset Trading Platform licence are not chasing the fastest or cheapest route to going live. They are well-capitalised, institution-facing operators who want a regulated base in a top-tier global financial centre that Asian banks, family offices and professional investors trust on sight. (Issuing a stablecoin is a separate HKMA regime — see Hong Kong stablecoin licence.) This guide explains what an SFC VATP licence really is in 2026: the regime, the Responsible Officers, the custody rule, the capital, the recent expansion, and the real question of who should actually attempt it.

What an SFC VATP licence is — and why it’s elite

A Hong Kong crypto licence is, in formal terms, a Virtual Asset Trading Platform (VATP) licence issued by the Securities and Futures Commission (SFC). Since 1 June 2023 it has been mandatory: any centralised virtual-asset exchange that serves Hong Kong must hold one. There is no light-touch registration alternative, no grandfathering shortcut for platforms that want the market’s credibility — you meet the SFC standard or you do not operate.

The word “elite” is doing real work here. Hong Kong made a deliberate strategic choice: rather than license widely and sort out quality later, it set the bar high from day one and admitted only operators who could clear it. The result is a short list of licensees. An SFC VATP licence signals to banks, professional investors and institutional counterparties across Asia that a platform has passed one of the toughest reviews in the industry. That is a credential a cheaper offshore VASP registration simply cannot buy — a contrast we set out in full in our EU CASP vs offshore VASP comparison.

Just how selective the regime is

Numbers make the point better than adjectives. As of early 2025, only around nine platforms held a Hong Kong virtual-asset licence — in one of the world’s largest financial centres, after nearly two years of an open, mandatory regime. The low number reflects how strictly the SFC filters applicants.

The practical takeaway is that a Hong Kong application is not a form-filling exercise you win on price. The SFC’s licensed-VATP list is short, and we mirror it weekly at Hong Kong licence data. The SFC runs a thorough, iterative review, and poorly prepared files stall or fail. Everything that follows in this guide is really a description of that filter: the people, the custody, the capital and the controls the SFC expects before it adds a name to that short list. The full document set sits in our Hong Kong crypto licence requirements guide.

Two Responsible Officers: the human bar

The most distinctive people requirement in the regime is the Responsible Officer. A VATP applicant must have at least two SFC-approved Responsible Officers (ROs) — senior individuals whom the SFC formally approves to be accountable for the platform’s regulated activities. They need genuine, relevant experience, appropriate qualifications, clean records and sound financial standing, and the SFC vets each one directly.

This is not a nominee arrangement. ROs are real people with real accountability, and lining up two who will satisfy the SFC is one of the hardest parts of any Hong Kong application. It is also a common reason files stall: teams underestimate how specific the SFC’s expectations are and start the process without credible RO candidates in place. The SFC looks for demonstrable competence in the specific regulated activities the platform will carry on, and a generic finance background does not meet that test. It also expects the ROs to take a genuine, hands-on part in running the business. Sourcing, vetting and getting two suitable individuals through the approval process is work that runs in parallel with everything else, and it is best started early rather than treated as a formality at the end.

Alongside the ROs, the SFC runs fit-and-proper due diligence on directors and controllers (clean records, sound financial standing and a credible source of funds on every owner) and expects a competent, resourced compliance and risk function behind them. Getting the people layer right before you file is decisive, and we cover it, with the RO-approval process in depth, in our Hong Kong VATP licence deep-dive.

The custody rule: a wholly-owned subsidiary

If the two-RO requirement defines the people side, the custody rule defines the structure — and it is the single feature that most surprises operators coming from lighter regimes. Under the SFC’s framework, a licensed platform must hold client virtual assets through a wholly-owned subsidiary, holding a Hong Kong TCSP licence. Third-party custodians are not accepted. You cannot outsource custody to a specialist vendor and point the SFC at their controls; the safeguarding of client assets has to sit inside your own corporate group, under your own regulated umbrella.

That has real consequences for how you build. It means a second, capitalised legal entity to establish and fund; institutional-grade custody technology (key management, cold-storage architecture, segregation and reconciliation) built and operated in-house; and an insurance or compensation arrangement covering client-asset risk. It is more expensive and more operationally demanding than a bolt-on custody contract, because the SFC wants the party holding client crypto to be inseparable from the party it licenses and supervises. For the mechanics of setting up the custody subsidiary correctly, see our Hong Kong crypto licence requirements guide.

Capital, structure and the 2025 expansion

Alongside the custody subsidiary, the SFC’s VATP Guidelines require the platform itself to hold HK$5 million of paid-up capital and at least HK$3 million of liquid capital (or the basic amount under the Financial Resources Rules if higher), plus liquid assets in Hong Kong covering 12 months of actual operating expenses. Combine that with a Hong Kong operating company, the wholly-owned custody arm, two ROs and a full compliance build, and you have a regime that is genuinely capital-heavy. Operators choose it for standing with institutions rather than for a cheap launch.

What makes 2026 an interesting moment is that the regime is maturing rather than tightening for its own sake. In November 2025 the SFC issued circulars that expanded the products licensed VATPs can offer and allowed platforms to integrate their order books with global affiliates for shared liquidity, a meaningful signal that Hong Kong wants its licensees to compete on a serious, global footing. For a well-capitalised group, that direction of travel is encouraging: the licence is getting more commercially useful. The full economics of meeting the capital and build requirements are laid out in our Hong Kong crypto licence cost breakdown.

Who it suits — and who should look elsewhere

Be realistic about fit. The SFC VATP licence suits serious, well-capitalised centralised exchanges targeting professional and institutional Asian investors; teams that can genuinely meet the two-RO and wholly-owned-custody requirements; groups that want a highly regarded regulated base in a leading financial centre; and established global platforms adding a credible, high-trust Asian credential. For those operators, the scarcity, the deep banking access and the institutional standing are worth every dollar and month the process demands.

It is the wrong choice for a startup chasing a fast, cheap launch, and it is the wrong choice if your users are primarily in the EU — because Hong Kong is not MiCA and does not passport into Europe. A VATP licence authorises regulated activity in and from Hong Kong; to serve EU customers you would still need a separate EU CASP. That either/or (or, for the largest players, both) is exactly the decision our EU CASP vs offshore VASP guide is built to help you make.

If a top-tier Asian credential is where your business is heading, we run the entire file (the Hong Kong company, the wholly-owned custody subsidiary, the Responsible Officer sourcing, the SFC application and the banking around it). The quote lists the government costs and our fee as separate lines. See the full scope on our Hong Kong crypto licence page, then book a free consultation and we will model the real capital, timeline and whether Hong Kong or a different Asian or EU route actually fits your plan before you commit a dollar.

Christina S.

Crypto Licensing at Vantegris

Christina S. is part of the Vantegris team, which prepares and files licence applications across 40+ jurisdictions. This article was reviewed by Vladyslav S. (Compliance & Legal).

Full profile Book a free consultation

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.