Hong Kong SFC VASP Licence: 2026 Practitioner Guide

A regime built quickly, then bedded in

For most of the last decade Hong Kong’s crypto position read as a study in restraint — interested, exploratory, but not quite committed. That changed with the Anti-Money Laundering and Counter-Terrorist Financing (Amendment) Ordinance 2022, which came into force on 1 June 2023. The legislation introduced licensing for Virtual Asset Service Providers (VASPs), supervised by the Securities and Futures Commission (SFC), and codified it inside Hong Kong’s existing AML ordinance — Cap. 615.

What that did, in effect, was bring centralised virtual-asset trading platforms inside a real regulatory perimeter — investor protection, custody, AML — in a way Hong Kong had not done before. The regime is now bedded in, and it is not a fast door.

What the VASP licence covers

The core activity caught by the new regime is operating a Virtual Asset Trading Platform (VATP) — a centralised exchange that allows participants to buy or sell virtual assets in exchange for money or other virtual assets. A platform that wants to provide that service to Hong Kong investors, including retail, needs a VASP licence from the SFC.

The SFC’s approach is investor-protection-heavy. Standards on custody and segregation, listing policy, conduct of business, AML/CFT and risk management are demanding — deliberately, because the regime was designed to allow retail participation safely.

The parallel SFO route

This is the part founders frequently miss. Where the virtual assets traded are securities or futures — a fact-specific question turning on the legal nature of the token, not on labels — SFC licensing under the Securities and Futures Ordinance (SFO) applies in parallel. In practice, that typically means a Type 1 (dealing in securities) and Type 7 (providing automated trading services) licence, on top of or instead of the VASP licence under Cap. 615.

A platform that picks “we’ll get a VASP licence and that’s it” without classifying the assets has scoped against one half of the regime. Counsel that does the classification before the licensing plan is doing the right work.

The comparison frame, where it matters

Hong Kong’s regime is closer to a comprehensive licensing framework than the UK’s AML-registration regime — see our UK FCA cryptoasset registration vs MiCA comparison for that contrast. It is also distinct from MiCA: not just non-EU, but designed against a different supervisory tradition and a different home-market profile.

Dimension	Hong Kong (SFC VASP)	EU (MiCA CASP)
Regulator	Securities and Futures Commission	National competent authority in each member state
Legal basis	AML Ordinance (Cap. 615), in force 1 June 2023	Regulation (EU) 2023/1114 (MiCA)
Scope	VATP licensing for non-securities virtual assets; SFO Type 1/7 for securities	All CASPs under one regime
Investor protection	Heavy — custody, segregation, listing standards	Comprehensive — capital, conduct, complaints
Passport	None — Hong Kong is not in the EU	Yes — across 27 EU member states
Best fit	Asia-headquartered platforms serving HK and regional investors	Firms whose market is the EU single market

Substance — same rule, different jurisdiction

The substance test in Hong Kong is the test in every serious jurisdiction. The SFC expects real local presence: management actually based in Hong Kong, compliance leadership in the jurisdiction, and operations that run from there rather than being controlled at distance.

A nameplate Hong Kong entity layered over a team in another time zone is exactly the structure that does not get over the line. The SFC reads the structure for what it is.

The EU caveat

A Hong Kong VASP licence authorises activity in and from Hong Kong. It is not an EU authorisation and does not passport into EU member states. The Hong Kong regime’s strength does not substitute for the passport an EU-facing firm needs.

So:

• A firm whose market is the EU needs a MiCA CASP — see the crypto licensing pillar guide.
• A firm building for Hong Kong or the wider region is in the SFC’s territory.
• A firm targeting both is, predictably, a two-licence project.

Working with counsel on a Hong Kong setup

The diagnostic for counsel: ask them to classify the virtual assets first, then map the licensing — VASP under Cap. 615 alone, the SFO Type 1/7 in parallel, or both — and to scope substance honestly against the SFC’s investor-protection bar. Counsel that pitches “we’ll get the VASP licence” without the SFO question has skipped the classification that decides which rulebook applies. The firms in our index with Asia-Pacific experience are listed below.