Virtual Asset Service Provider (VASP) Licence Support (Hong Kong)

A Hong Kong Virtual Asset Service Provider (VASP) Licence Support document is the preparatory documentation used to support a VASP licence application to the Securities and Futures Commission (SFC) under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) as amended by the Anti-Money Laundering and Counter-Terrorist Financing (Amendment) Ordinance 2022. The VASP licensing regime became mandatory in Hong Kong from 1 June 2023, making Hong Kong one of the first major financial centres to establish a thorough licensing framework for centralised virtual asset exchanges.

The Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) was amended in 2022 to insert a new Part 7A establishing the mandatory VASP licensing regime. Under this regime, any person who carries on a business of providing virtual asset services — principally the operation of a centralised virtual asset exchange (VAEX) — in Hong Kong must be licensed by the SFC. Operating a VA exchange without a VASP licence after the end of the transitional period is a criminal offence under Cap. 615, punishable by fine and imprisonment.

The Securities and Futures Commission is the statutory regulator responsible for licensing and supervising VASPs. The SFC's approach to VASP regulation draws on its experience supervising SFC-licensed virtual asset trading platforms (VATPs) under the opt-in framework it operated between 2019 and 2023, applying and enhancing the standards developed through that framework for the mandatory licensing regime.

Hong Kong's VASP regime positions the territory as a regulated virtual asset hub in Asia — a deliberate policy choice by the Hong Kong Government to attract legitimate virtual asset businesses while maintaining investor protection and AML/CFT standards consistent with FATF (Financial Action Task Force) recommendations. The SFC has established detailed licensing criteria covering corporate governance, financial resources, client asset protection, AML/CFT compliance, cybersecurity, and investor protection.

VASP licences under Cap. 615 are distinct from SFC licences under the Securities and Futures Ordinance (Cap. 571). Virtual assets that constitute 'securities' under the SFO require Cap. 571 licensing (Types 1 or 7) in addition to the VASP licence, while virtual assets that are not securities (such as Bitcoin and Ether in their current regulatory characterisation) are regulated only under the Cap. 615 VASP regime. Hong Kong's decision to introduce a thorough mandatory VASP licensing regime — in contrast to many jurisdictions that have taken a more restrictive or prohibitive approach to retail cryptocurrency trading — reflects a deliberate policy to position the territory as a regulated virtual asset hub in Asia, attracting compliant global cryptocurrency exchanges while maintaining investor protection, AML/CFT standards consistent with FATF recommendations, and cybersecurity requirements appropriate for platforms holding significant client digital assets. Forms-legal.com provides this VASP Licence Application Support document for Hong Kong virtual asset exchange operators seeking to understand and prepare for the SFC's licensing requirements under Cap. 615.

Forms-legal.com provides this VASP Licence Application template for Hong Kong virtual asset trading platforms, covering all SFC requirements under Cap. 615 and Cap. 571, AML/CTF programme documentation, cybersecurity policy frameworks, client asset segregation obligations, and the Responsible Officers' fit-and-proper declarations required before submission.

A Hong Kong VASP Licence Application is required whenever a person or company proposes to operate a centralised virtual asset exchange accessible to Hong Kong users, or otherwise carry on a business of providing virtual asset services as defined under Cap. 615. The mandatory nature of the VASP licensing requirement means there is no opt-out for businesses that fall within the definition.

Cryptocurrency exchanges operating platforms through which users buy, sell, and exchange virtual assets for fiat currencies (HKD, USD) or other virtual assets, and which hold virtual assets on behalf of users, fall squarely within the VASP licensing requirement. Both Hong Kong-incorporated operators and foreign operators with a significant presence or marketing directed at Hong Kong users must consider their VASP licensing obligations.

Over-the-counter (OTC) virtual asset trading businesses — physical or online desks supporting person-to-person virtual asset transactions at agreed prices — may fall within the VASP definition depending on the scale and manner of their operations. OTC businesses above certain thresholds require VASP licensing.

Fintech startups building centralised virtual asset custody, exchange, or trading products for Hong Kong users should engage with the VASP licensing process at the earliest possible stage of business development. The SFC actively encourages pre-application meetings with its Licensing Department to clarify the regulatory framework applicable to proposed business models.

Existing virtual asset businesses that operated in Hong Kong before 1 June 2023 and made use of the transitional period to continue operating while preparing their licence applications must now have full VASP licences or be in the licensed application queue to continue operating lawfully.

DeFi (decentralised finance) protocols and non-custodial wallet providers generally fall outside the VASP licensing requirement under Cap. 615, as the regime targets centralised intermediaries that hold client assets. However, the boundary between centralised and decentralised services is a regulatory grey area, and businesses operating in this space should obtain specific legal advice on their licensing position.

Overseas virtual asset exchanges seeking to access Hong Kong retail investors must obtain a VASP licence before soliciting Hong Kong residents, and the application document records the regulatory submissions, AML/CTF policies, and governance structure filed with the SFC under Cap. 615 and Cap. 571.

A complete Hong Kong VASP Licence Application must satisfy all the requirements published by the SFC in its Licensing Handbook for Virtual Asset Trading Platforms (VATPs) and the conditions set out in Cap. 615 and associated SFC circulars.

The corporate structure documentation must demonstrate that the VASP applicant is a company incorporated in Hong Kong (or a foreign company registered to carry on business in Hong Kong) with a genuine physical presence in Hong Kong. The SFC requires evidence of the Hong Kong office, board composition, and at least one Responsible Officer ordinarily resident in Hong Kong.

The Responsible Officers (ROs) section requires detailed profiles of each proposed RO. Each RO must apply separately to the SFC for individual approval. The SFC evaluates each RO's fitness and propriety based on their qualifications, experience in virtual asset operations or financial regulation, compliance track record, and character references. At least two SFC-approved ROs are required for the VASP licence, with at least one being an executive director ordinarily resident in Hong Kong.

The business plan and whitepaper must describe in detail the virtual assets to be listed on the platform, the trading mechanics, the client onboarding process, the risk management framework, the liquidity management approach, and the fee structure. The SFC scrutinises the token listing process carefully — applicants must demonstrate a sound methodology for assessing each virtual asset's regulatory status, technical security, market liquidity, and susceptibility to manipulation.

The client asset protection framework must demonstrate compliance with the SFC's mandatory cold storage requirements (at least 98% of client virtual assets in offline cold wallets), client asset segregation from the VASP's own assets, and the insurance arrangements covering potential client asset losses.

The AML/CFT compliance programme must comply with Cap. 615 and FATF standards, including: full customer due diligence (CDD) with enhanced due diligence for high-risk clients; blockchain analytics integration for transaction monitoring (screening for links to sanctioned addresses, darknet markets, and high-risk activity); travel rule compliance for virtual asset transfers above the applicable threshold; suspicious transaction reporting to the Joint Financial Intelligence Unit (JFIU); and thorough record-keeping for at least 5 years.

The cybersecurity programme must meet the SFC's detailed technical standards, including annual independent penetration testing, 24/7 security monitoring, incident response procedures, and regular security audits of the platform's smart contracts and custody systems.

The financial resources documents must confirm minimum paid-up capital of at least HK$5 million and demonstrate that the applicant can maintain the SFC's liquid capital requirements on an ongoing basis.

AML/CTF Programme: The SFC requires VASP applicants to submit a detailed AML/CTF programme compliant with Cap. 615 and the SFC's AML/CTF guidelines, covering customer due diligence procedures, transaction monitoring systems, suspicious transaction reporting under the Drug Trafficking (Recovery of Proceeds) Ordinance (Cap. 405) and the Organized and Serious Crimes Ordinance (Cap. 455), and staff training requirements. Virtual asset exchanges must implement travel rule compliance for transfers above the threshold specified by the Financial Action Task Force (FATF) recommendations adopted by the SFC.

Cybersecurity and Custody: The SFC's Guidelines for Virtual Asset Trading Platforms impose specific requirements on cold wallet storage — at least 98% of client assets held in cold storage — and cybersecurity controls including penetration testing, intrusion detection, and incident response plans. The application must demonstrate that the platform's custody arrangements meet SFC standards and that client assets are held separately from the operator's proprietary assets, protected against insolvency risk.

Forms-legal.com provides this VASP Licence Application template covering all SFC submission requirements, AML/CTF programme structure, cybersecurity policy frameworks, and responsible officer declarations under Cap. 615 and Cap. 571.