Hong Kong VATP Licence Explained (2026)

If you are researching the “Hong Kong VATP license”, you have already worked out that Asia’s most credible crypto exchange licence is also one of its hardest. This guide sets out exactly what the VATP regime is, who the Securities and Futures Commission licenses under it, and the two requirements — the Responsible Officers and the custody subsidiary — that decide whether an application is serious or dead on arrival.

In our practice, the teams who succeed in Hong Kong treat the SFC as a securities regulator that happens to license crypto, not a light-touch crypto registry. The ones who stall priced it like an offshore permit. Below is the version we scope from.

What the VATP regime actually is

VATP stands for Virtual Asset Trading Platform. It is the SFC’s term for a centralised crypto exchange, and since 1 June 2023 operating one for the public in Hong Kong without an SFC licence has been illegal. That start date matters: Hong Kong did not grandfather in the operators who were already trading. It drew a line, required everyone to apply, and let the deadline force a clean-out — several platforms that could not meet the standard withdrew rather than face refusal.

The licence sits on a dual legal framework, which is the single most misunderstood part of the regime. Because most tradable tokens can be treated as securities, a VATP is licensed under the Securities and Futures Ordinance (SFO) for Type 1 (dealing in securities) and Type 7 (providing automated trading services) regulated activities. At the same time, to cover non-security tokens, the platform is licensed under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) VASP regime. One platform, two overlapping licences, one supervisor — the SFC administers both so that whatever a listed token is legally classified as, it falls inside the perimeter. This is why the SFC assesses a VATP the way it assesses a broker, not the way an offshore registrar processes a form.

A full VATP licence authorises one thing precisely: operating a virtual-asset exchange for the public in and from Hong Kong — order matching, custody of client assets and the surrounding conduct obligations. It does not authorise unlicensed derivatives, it does not cover activities the SFC has not specifically approved, and it does not reach beyond Hong Kong’s borders as a matter of right. For how this fits the wider picture of what an exchange licence involves, our crypto exchange licence explainer walks through the general model, and the Hong Kong crypto licence pillar covers the jurisdiction end to end.

What the licence requires

The regime rewards depth, not speed. The table below is the shape of what a credible VATP file has to demonstrate — every row is a gate, not a nice-to-have.

Two rows carry most of the weight — the Responsible Officers and the custody subsidiary — so each gets its own section below. But note the ones that quietly sink applications: token admission and investor protection. The SFC expects a formal admission-and-review committee that carries out due diligence on every token before listing — weighing regulatory status, technology risk, liquidity and issuer background — with retail access held to a higher bar than professional access. A file that lists tokens without a documented process behind each one has not internalised what the licence is for. The requirements breakdown sets out the full checklist we work from.

The Responsible Officers

Every VATP must appoint at least two Responsible Officers, and the SFC approves each one personally. This is not a compliance job title you can fill after approval — the ROs are named in the application, vetted individually, and the licence effectively depends on them.

A Responsible Officer is a senior individual the SFC holds personally accountable for the platform’s regulated activities. They must be fit and proper in the SFC’s specific sense: relevant industry experience, appropriate qualifications, a clean regulatory and criminal record, and demonstrable competence to supervise the business. At least one must ordinarily be available to the regulator, and between them the ROs must actively manage the Type 1 and Type 7 activities rather than lend their names to them. If an RO leaves and the platform drops below two, that is a reportable event that can put the licence at risk — which is why we treat RO continuity as a live operational issue, not a box ticked at filing.

The wholly-owned custody subsidiary

Hong Kong’s answer to “who holds the coins” is unusually strict, and it is one of the clearest signals of how the regime thinks. A VATP may not use a third-party custodian. Client virtual assets must be held by an associated entity that is a wholly-owned subsidiary of the licensed platform, established specifically for custody and capitalised at HKD 10 million.

The logic is ring-fencing. By forcing custody into a dedicated, separately capitalised subsidiary, the SFC keeps client assets legally and operationally distinct from the trading business, so a problem on the exchange side does not reach into customer holdings. In practice the subsidiary must hold the large majority of client assets in cold storage, run institutional-grade key management, and carry insurance against loss or theft. Building it is a real project — a second regulated entity, its own capital, controls and security architecture — and a cost offshore permits simply do not have. If you are comparing that burden against cheaper regimes, the cost breakdown models the full commitment, and our note on crypto-friendly banking covers the account side that a licensed platform still has to solve.

Why Hong Kong is so selective — and what 2025 changed

By early 2025 only around nine platforms held a full SFC virtual-asset licence. That number is not an accident of a slow queue; it is the design. The SFC would rather supervise a small set of well-run platforms than absorb the systemic and reputational risk of licensing volume, and every requirement above — the dual framework, the ROs, the custody subsidiary, the token due diligence — is a filter that a thin operator cannot pass. The scarcity is precisely what gives the licence its value: a Hong Kong VATP badge tells banks, family offices and institutional counterparties across Asia that a platform cleared a genuinely demanding bar.

For most of the regime’s early life, that rigour came with a commercial cost — a walled, retail-focused Hong Kong platform struggled with thin liquidity. The November 2025 SFC circulars addressed exactly that. The SFC expanded the range of products licensed VATPs can offer and, critically, allowed platforms to integrate their order books with global affiliates for shared liquidity — letting a Hong Kong book tap into a wider international pool rather than trading in isolation. That is a meaningful shift in posture: the regulator is treating the regime as something to grow into a competitive institutional venue, not just a defensive perimeter.

Is the VATP licence right for you?

The honest test is scale and intent. The VATP regime is built for well-capitalised, institution-facing platforms that want a blue-chip Asian base and can carry two Responsible Officers, a HKD 10 million custody subsidiary, substantial working capital and a full compliance-and-technology build. For that profile, Hong Kong is the premier address in Asia and the credential is a moat few rivals hold. For a small team testing a product or an operator whose users sit outside Asia, the cost and rigour will outrun the benefit — a different jurisdiction is the smarter first move, with Hong Kong kept as a later upgrade.

The applicant is always a Hong Kong company holding the SFC VATP licence — not an offshore shell, not a free-zone vehicle, and nothing to do with the gambling structures used elsewhere. That local, substance-heavy footprint is part of what the licence buys. It is slow, it is capital-intensive, and that is the point: the difficulty is the product. If you are weighing a Hong Kong VATP against an EU CASP or a lighter Asian regime, we will map it to where your users, your capital and your institutional goals actually sit and quote the real number. Book a free consultation and we will scope the SFC file end to end.

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.