How to Get an SFC VATP Licence in Hong Kong

What is an SFC VATP licence and why it matters in 2026

An sfc vatp licence hong kong is the mandatory authorisation that any centralised virtual asset trading platform must obtain to operate lawfully in Hong Kong, granted and supervised by the Securities and Futures Commission (SFC). If you intend to run a virtual asset trading platform licence for spot trading, provide custody, or serve retail investors in Hong Kong, you fall squarely within the SFC’s regulatory perimeter. The regime has matured rapidly, and the landscape in 2026 is materially different from earlier years, driven by the Stablecoins Ordinance, which commenced in August 2025, and by continued legislative work led by the Financial Services and the Treasury Bureau (FSTB).

Securing an sfc vatp licence hong kong is a demanding project that blends legal analysis, financial modelling, technology assurance and governance design. It is not a form-filling exercise. Applicants must demonstrate substance in Hong Kong, robust custody arrangements, fit-and-proper leadership, and an anti-money-laundering programme that survives external scrutiny. This guide translates the SFC’s requirements into a practical, step-by-step roadmap.

• Who should read this: founders of crypto exchanges, fintech operators, custodians and advisers evaluating a hong kong crypto exchange licence.
• Expected timeline: typically 9–18 months from serious preparation to grant, depending on readiness.
• Expected outcome: a clear understanding of the requirements, evidence and project plan needed to obtain an sfc vatp licence hong kong.

Quick facts / snapshot

Key facts at a glance

• Typical timeline: approximately 9–18 months from mature preparation to licence grant, subject to the quality of the application and SFC queries.
• Capital expectations: substantial paid-up capital and liquid reserves are required; applicants should model well beyond a nominal floor to satisfy the SFC’s virtual asset guidelines.
• Retail eligibility: platforms may seek to serve retail investors subject to strict token due-diligence, disclosure and investor-protection conditions.
• External assessment: an independent external assessor report is required to validate systems and controls before and around licensing.
• Key regulator links: the SFC publishes lists of applicants and licensed platforms for public reference.

VATP application: step-by-step roadmap

The following stepwise roadmap answers the common question, “How do I get a crypto license in Hong Kong?” Each step includes a short checklist and practical tips drawn from Global Law Experts analysis of the SFC framework. Working through them in sequence de-risks the application and reduces the likelihood of costly supplementary requests once you have submitted.

Step 1, Pre-application planning and Hong Kong presence

Before anything else, establish genuine substance in Hong Kong. The SFC expects an applicant to be a locally incorporated company with a permanent place of business in Hong Kong, local senior management with real decision-making authority, and operational functions carried out onshore rather than merely referenced offshore. A shell entity with directors located overseas will not satisfy the regulator.

• Incorporate a Hong Kong company and confirm the permitted entity structure for a virtual asset trading platform licence.
• Appoint at least two responsible officers who will be physically present and accountable in Hong Kong.
• Lease genuine office premises and demonstrate that core functions, compliance, risk, technology oversight, operate locally.

Step 2, Determine scope of services and investor type

Decide precisely what your platform will offer: spot trading, staking-adjacent services, or custody. Each activity attracts distinct controls under the SFC’s virtual asset guidelines. Equally important is choosing whether you will serve professional investors only or seek the retail eligibility vatp route, which carries heavier disclosure and token due-diligence obligations.

• Map your product suite against the SFC’s permitted scope.
• Decide the retail vs professional route early, it drives capital, staffing and compliance design.
• Document the commercial rationale so it is coherent across your business plan.

Step 3, Governance and fit-and-proper evidence

The SFC assesses whether directors, responsible officers and controllers are fit and proper. This means demonstrating competence, financial soundness, honesty and reputation. Assemble comprehensive evidence, including detailed CVs, background checks and clear reporting lines.

• Prepare CVs, qualifications and regulatory history for all key personnel.
• Document governance policies, committee structures and escalation procedures.
• Evidence ongoing training and competence-maintenance programmes.

Step 4, AML/CTF programme and external assessment engagement

A rigorous anti-money-laundering and counter-terrorist-financing programme is central to any sfc vatp licence hong kong application. You must engage an independent external assessor to review systems and controls. Following the SFC’s streamlining of the process, applicants generally provide an external assessment report validating the platform’s controls, with the assessor examining custody, AML/CTF, cybersecurity and operational resilience.

• Draft AML/CTF policies covering KYC, sanctions screening and transaction monitoring.
• Engage a qualified external assessor early and agree scope and deliverables.
• Remediate gaps the assessor identifies before formal submission where possible.

Step 5, Custody model design and vendor assessments

Custody is one of the most scrutinised areas. The SFC expects strict segregation of client virtual assets, predominant use of cold storage, robust private-key management and appropriate insurance or compensation arrangements. Whether you build in-house custody, appoint a third-party custodian, or run a hybrid model, you must evidence the security architecture in detail. Global Law Experts guidance on VATP custody and security controls sets out the design questions to resolve.

• Segregate client assets from proprietary assets in a bankruptcy-remote structure.
• Design multi-signature and hot/cold wallet architecture with documented key ceremonies.
• Assess third-party custodians and insurers, and evidence reconciliation controls.

Step 6, Capital modelling and financial projections

The SFC requires applicants to hold adequate paid-up capital and liquid reserves, and to demonstrate that the business can withstand stressed scenarios. Build financial projections that show sustained solvency, and prepare proof documents such as bank statements and audited financials. Consider using VATP capital modelling templates to structure your submission.

• Model baseline and stressed capital and liquidity positions.
• Evidence the source and availability of capital.
• Document assumptions clearly so the SFC can follow the logic.

Step 7, Prepare application pack and SFC submission

Assemble the complete application pack, including required forms, business plan, policies, custody documentation, capital evidence and the external assessment report. Submit through the SFC’s channels and be prepared for supplementary information requests. A well-organised pack shortens the review cycle materially.

• Complete all SFC forms accurately and consistently.
• Cross-reference supporting documents so reviewers can navigate the pack.
• Anticipate follow-up questions and pre-prepare responses.

Step 8, Post-submission engagement and pre-launch checks

After submission, expect interviews with responsible officers, potential on-site inspections and detailed queries. The SFC may impose licence conditions and conditions precedent that must be satisfied before you go live. Treat this phase as collaborative rather than adversarial.

• Prepare senior management for SFC interviews on controls and governance.
• Satisfy all conditions precedent before launching operations.
• Complete pre-launch testing of trading, custody and monitoring systems.

What licence do you need? SFC VATP compared with HKMA and other options

A recurring question is, “What is the difference between an HKMA license and an SFC license?” The short answer: the SFC licenses virtual asset trading platforms, while the Hong Kong Monetary Authority (HKMA) oversees banking and payment-related activities, including the licensing of fiat-referenced stablecoin issuers under the Stablecoins Ordinance. The table below compares the two regimes so businesses can identify which authorisation their model requires. For a deeper treatment, see the HKMA vs SFC licensing comparison.

In practice many businesses need to consider both regimes. A platform that lists a Hong Kong-issued stablecoin, for instance, interacts with the HKMA regime for issuance while remaining under the SFC for trading. Getting this delineation right at the outset avoids duplicated work and regulatory gaps.

VATP licence requirements, capital, custody, fit & proper, AML/CTF, systems

This section answers “What are the SFC virtual asset guideline requirements?” in detail. The SFC’s virtual asset guidelines set out the core pillars that every applicant for an sfc vatp licence hong kong must satisfy. Understanding each pillar, and the evidence the SFC expects, is essential to building a credible submission.

Fit and proper, evidence required and disqualifying issues

The fit-and-proper test flows from the Securities and Futures Ordinance (Cap. 571), which underpins the SFC’s licensing and enforcement powers. Applicants must demonstrate that directors, responsible officers, substantial shareholders and controllers possess the integrity, competence and financial standing to run a regulated platform. The SFC examines regulatory history, criminal records, financial soundness and relevant experience.

Disqualifying issues include prior regulatory sanctions, unresolved insolvency, dishonesty findings or a demonstrable lack of competence. Senior management suitability is assessed both individually and collectively, the leadership team must cover trading, compliance, risk, technology and finance. For a structured evidence pack covering these points, see our guidance on VATP AML/CTF and fit-and-proper evidence. Applicants should treat vatp fit and proper preparation as an ongoing exercise, refreshing evidence as personnel change during the review.

Capital requirements, modelling approach and proof points

The SFC requires platforms to maintain adequate paid-up share capital and liquid capital to absorb losses and continue operating under stress. While published minimum figures provide a floor, mature applicants model materially above the minimum to reflect operational reality. The vatp capital requirements analysis should combine a static capital position with dynamic stress testing.

Build your capital model around several scenarios: normal operations, a sharp downturn in trading volumes, a security incident requiring remediation, and a liquidity squeeze. Each scenario should show that the platform remains solvent and can meet client obligations. Proof points include audited financial statements, bank confirmations, and evidence of committed shareholder funding. The SFC scrutinises the source of funds, so document the origin and availability of capital transparently. A well-constructed capital narrative, supported by clear assumptions, significantly strengthens an application and reduces the volume of supplementary questions.

Custody and operational resilience

Custody sits at the heart of the vatp custody requirements. The SFC expects client virtual assets to be held in a bankruptcy-remote structure, strictly segregated from the platform’s own assets, with the substantial majority stored in cold wallets. Private-key management must follow documented ceremonies, employ multi-signature or equivalent controls, and restrict access on a least-privilege basis.

Operational resilience extends beyond custody to system availability, disaster recovery and cybersecurity. Applicants must evidence penetration testing, incident-response plans, reconciliation processes and appropriate insurance or a compensation arrangement to cover potential losses. Third-party custodians, where used, must themselves meet high standards, and vendor due diligence must be documented. Regular reconciliation between on-chain balances and internal ledgers is a baseline expectation. Because custody failings are among the most common reasons applications stall, investing early in a defensible custody architecture is one of the highest-value actions an applicant can take.

AML/CTF and transaction monitoring

The SFC applies rigorous anti-money-laundering and counter-terrorist-financing expectations, aligned with Hong Kong’s broader AML framework. Applicants must implement risk-based KYC and customer due diligence, ongoing sanctions and PEP screening, and effective transaction monitoring calibrated to virtual asset typologies such as chain-hopping and mixer use.

The transaction-monitoring programme should generate meaningful alerts, feed a documented investigation workflow, and support suspicious-transaction reporting where required. A qualified money-laundering reporting officer must own the programme, and the external assessor will test its effectiveness. Weak or untested AML controls are a frequent stumbling block, so applicants should validate rule logic against realistic scenarios well before submission.

Typical VATP application timeline, cost drivers and why applications fail

Timeline milestones

An honest timeline for an sfc vatp licence hong kong typically spans several distinct phases. Serious preparation, incorporation, hiring, policy drafting and custody build, often takes three to six months. Engagement with the external assessor and remediation can add several more months. Formal SFC review, including interviews, inspections and supplementary requests, commonly runs six to twelve months, after which conditions must be satisfied before the licence is granted and operations can begin.

Cost drivers

• Legal and advisory hours: structuring, drafting and managing the SFC engagement.
• External assessor fees: the independent report validating systems and controls.
• Technology remediation: upgrades to custody, monitoring and security infrastructure.
• Capital: the paid-up and liquid capital that must be committed and maintained.
• Custodian and insurance onboarding: vendor selection, contracting and cover.

Common refusal grounds and how to mitigate them

Applications commonly falter on insufficient Hong Kong substance, weak custody controls, undercapitalisation, incomplete AML testing and gaps in fit-and-proper evidence. Mitigation is straightforward in principle: build genuine local operations, design custody to the SFC’s standards from day one, model capital conservatively, test AML controls rigorously, and prepare comprehensive personnel evidence. Addressing these areas before submission is far cheaper than remediating them mid-review.

Post-licence compliance you must prepare for

Ongoing reporting, inspections and licence variations

Obtaining an sfc vatp licence hong kong is the beginning of a continuing compliance relationship, not the end of the project. Licensed platforms must comply with ongoing reporting obligations, submit to periodic SFC inspections, and maintain their systems and controls to the standard demonstrated at licensing. Any material change to the business, new products, changes in control, or expanded services, may require a licence variation and prior SFC engagement.

The SFC retains broad enforcement powers under the Securities and Futures Ordinance, ranging from restrictions and conditions to suspension, revocation and disciplinary sanctions. Platforms should embed a strong compliance culture, maintain records that evidence continuous adherence, and treat regulatory correspondence with the seriousness it demands. Proactive engagement with the regulator, flagging issues early and remediating promptly, is the surest way to avoid disciplinary outcomes and preserve the value of the licence.

VATP application evidence checklist

Before you submit, assemble a complete evidence pack. The list below covers the core documents the SFC expects. For a structured, downloadable version, refer to our VATP application checklist.

• Incorporation documents: Hong Kong company registration and constitutional documents.
• Audited financials: most recent audited statements and management accounts.
• Proof of capital: bank confirmations and evidence of committed funding.
• Custodian contracts: agreements, insurance and vendor due-diligence records.
• AML policies: KYC, sanctions screening and transaction-monitoring frameworks.
• External assessment report: the independent assessor’s findings and remediation status.
• IT security assessment: penetration test results and cybersecurity documentation.
• Senior management CVs: qualifications, experience and regulatory history.
• Business plan and stress tests: financial projections and stressed scenarios.

Risks applicants face and how to avoid them

Even well-funded applicants stumble when they underestimate the depth of the SFC’s expectations. Understanding the common pitfalls, and building mitigations into the project from the outset, dramatically improves the odds of securing an sfc vatp licence hong kong efficiently.

Over-reliance on overseas operations

Attempting to run core functions offshore while presenting a thin Hong Kong front is a frequent and fatal error. The SFC expects genuine local substance. Mitigation: locate decision-making, compliance and risk functions in Hong Kong, and staff them with experienced local personnel.

Weak custody controls

Inadequate segregation, over-reliance on hot wallets, or undocumented key management will draw immediate concern. Mitigation: design a bankruptcy-remote custody structure with predominant cold storage, documented key ceremonies and independent assurance.

Incomplete AML testing

Policies that look strong on paper but fail in practice are a common weakness. Mitigation: test monitoring rules against realistic scenarios, evidence alert-to-investigation workflows, and have the external assessor validate effectiveness.

Undercapitalisation and insufficient local staff

Modelling only to the minimum capital floor, or thin staffing across key functions, signals fragility. Mitigation: model capital conservatively across stressed scenarios, evidence committed funding, and recruit a leadership team that covers trading, compliance, risk, technology and finance. Suggested assurance items include an independent capital review, a custody penetration test, and an AML control-effectiveness audit before submission.

What to do next (project plan and who to involve)

Preparing an sfc vatp licence hong kong application is a cross-functional programme, and assembling the right team early is decisive. A credible project brings together legal counsel to structure the entity and manage the SFC engagement, a compliance lead to own AML/CTF and fit-and-proper evidence, a CTO to deliver custody and cybersecurity infrastructure, an external assessor to validate controls, and a custodian and insurer to underpin client-asset protection.

Adopt a phased plan: first, establish Hong Kong substance and appoint key personnel; second, design and build custody, AML and capital frameworks; third, engage the external assessor and remediate findings; fourth, compile and submit the application; and finally, manage SFC review and satisfy conditions precedent before launch.

• Confirm your service scope and retail-versus-professional strategy.
• Assemble your legal, compliance, technology and assurance team.
• Sequence custody, capital and AML workstreams in parallel.
• Engage the external assessor early to avoid late surprises.

Bottom line, is a VATP licence the right step?

For any centralised platform serving Hong Kong users, an sfc vatp licence hong kong is not optional, it is the gateway to lawful, sustainable operation in one of Asia’s most credible regulatory environments. The compliance costs are real, spanning capital, custody, technology and assurance, but so are the strategic benefits: market access, institutional trust and a defensible competitive position. The right next action is to build a phased project plan, secure genuine local substance, and prepare a rigorous, evidence-led application that meets the SFC’s standards first time.

Sources

• Securities and Futures Commission, Virtual Asset Trading Platform (VATP) guidance
• SFC, Lists of virtual asset trading platforms (applicants and licensees)
• Financial Services and the Treasury Bureau (FSTB), announcements and policy statements
• Hong Kong e-Legislation, Stablecoins Ordinance 2025
• Securities and Futures Ordinance (Cap. 571)
• Hong Kong Monetary Authority (HKMA)