Licensing also requires more than incorporation or a public-register entry. An applicant needs at least HKD 5 million paid-up share capital, liquid capital no lower than HKD 3 million or its basic amount, two responsible officers, deployed controls, and an external assessment before approval.
Key takeaways
- Security-token trading sits under SFO Types 1 and 7; non-security-token trading sits under the AMLO VATP regime, so mixed platforms normally pursue both routes.
- A VATP needs HKD 5 million paid-up capital, prescribed liquidity, two responsible officers, and one RO with at least three years of direct VATP or ATS experience.
- The application moves from a WINGS submission and written controls to SFC review, system deployment, and one external assessment under a tripartite agreement.
The licence route follows the token and platform activity
The controlling question is whether the platform operates an automated trading venue and whether the admitted token is a security. The SFC VATP licensing framework separates those routes rather than granting one universal Hong Kong crypto licence.
| Token or activity | Licence route | Responsible entity | Scope boundary |
|---|---|---|---|
| Security tokens traded on a central platform | SFO Type 1 dealing in securities and Type 7 automated trading services | SFC-licensed corporation operating the venue | Covers securities activity, not every non-security token service |
| Non-security tokens traded through an automated venue | AMLO licence for providing a virtual-asset service | Licensed VASP named on the SFC record | Covers operation of the VA exchange, not unrelated advice or management |
| Both token classes or classification uncertainty | Dual SFO Type 1 and Type 7 plus AMLO licensing | Usually the same platform operator under both regimes | Each permission and condition still needs separate verification |
| Brokerage without operating the exchange | Relevant dealing or proposed VA-dealing route | Broker or intermediary signing the customer agreement | A broker approval is not a VATP operator licence |
| Platform custody supporting trading | VATP operator and its approved associated custody entity | Entity controlling client assets and keys | Does not authorise unrelated standalone custody services |
Type 1 covers securities dealing, Type 7 covers automated trading services, and AMLO covers exchanges for non-security tokens. Dual licensing protects business continuity if token rights or classification change, but each asset, customer category, and licence condition still requires verification.
Proposed dealing, advisory, management, and standalone-custody regimes are not existing VATP permissions. A product-specific regulator map preserves those boundaries, while the stablecoin regime governs issuers.
The applicant-readiness checklist covers capital, people, and custody
A viable applicant must qualify its legal entity, owners, officers, financial resources, and custody model before treating the filing as ready. The headline application fee is small beside capital, staffing, technology, compensation, surveillance, audit, and external-assessment costs.
- Applicant eligibility and fitness. Use a Hong Kong company or registered non-Hong Kong company with a permanent local business. The applicant, controllers, owners, directors, responsible officers, and representatives must satisfy fit-and-proper checks covering integrity, competence, financial soundness, ownership, and disciplinary history.
- Capital and liquidity. Maintain at least HKD 5 million in paid-up share capital, liquid capital equal to the higher of HKD 3 million and the basic amount, and qualifying Hong Kong liquid assets covering at least 12 months of rolling operating expenses.
- Responsible officers. Appoint at least two ROs, including one executive director. One RO needs three years of direct VATP or ATS operating experience, while two dually licensed ROs can satisfy the staffing requirement across the SFO and AMLO regimes.
- Custody protection. Hold client assets on trust through the Associated Entity, keep 98% of client virtual assets in cold storage unless an exception applies, and maintain approved compensation covering 50% of cold-wallet assets and 100% of hot or other storage.
- External assessment. Deploy the relevant systems and controls before completing one direct-assurance assessment under the tripartite agreement between the applicant, SFC, and external assessor.
- Application fees. Corporate applications cost HKD 4,740 for each SFO activity or AMLO service, producing HKD 14,220 for Type 1, Type 7, and AMLO. Individual applications cost HKD 1,790 per representative activity and HKD 2,950 per RO activity.
The VATP operator guidelines tie the 12-month liquidity requirement to actual operating expenses, requiring a defensible rolling budget rather than a one-time deposit. The HKD 14,220 corporate filing total excludes individual approvals, external assurance, technology, staffing, compensation arrangements, and continuing compliance.
At least two ROs must supervise the business, including one executive director. The SFC competence requirements require one RO with three years of direct VATP or ATS experience and technical knowledge; two dually licensed ROs may cover both regimes. Fit-and-proper review tests competence, integrity, financial soundness, ownership transparency, and disciplinary history.
The enhanced application runs from WINGS to deployed controls
The current process begins with a consolidated WINGS application and ends after the SFC has reviewed an operating platform supported by external assurance. Policies written for a future system are not enough; the assessed controls must exist in the deployed environment.
The initial package includes application forms, ownership and management information, business and financial plans, and written policies and procedures. It must also identify a suitable external assessor and include evidence of that assessor’s capability to examine the proposed systems and controls.
The SFC reviews the business model, licence scope, fitness and properness, responsible officers, capital, custody, token admission, AML, cybersecurity, market surveillance, conflicts, and wind-down arrangements. Fundamental gaps can cause an incomplete application to be returned rather than progressing through an open-ended remediation cycle.
After the platform deploys its systems, the applicant, SFC, and external assessor enter a tripartite agreement defining the assessment scope. Under the enhanced licensing process, one direct-assurance assessment replaces the older two-phase model.
The external assessment tests implemented controls and reports findings to the SFC. Approval still remains the regulator’s decision. An assessor cannot cure an incorrect licence perimeter, underqualified management, insufficient capital, or a system whose evidence does not match the policies submitted through WINGS.
Licensing creates continuing filing and monitoring duties
Approval starts ongoing supervision rather than completing the compliance project. The SFC post-licence framework requires continuing notifications, annual returns, financial returns, business-and-risk questionnaires, and reporting of material breaches or non-compliance through the prescribed channels.
The operator must continue monitoring capital and liquid assets, while custody teams reconcile client assets and test compensation coverage daily. A persistent shortfall requires prompt remediation and SFC notification; changes to the compensation arrangement require prior approval rather than retrospective disclosure.
Material changes to ownership, responsible officers, licence conditions, record-keeping premises, business plans, custody, or regulated services can trigger notification or prior application requirements. The audit questionnaire is due within four months after financial year-end, so evidence ownership should be built into normal operations rather than assembled only before an inspection.
Thirteen VATPs were licensed in the May 2026
Hong Kong had 13 formally licensed VATPs on the SFC platform list updated 29 May 2026. NewBX Limited, trading as Bixin.com, received its licence on 18 May 2026 and became the thirteenth entry, replacing the 12-platform count recorded at 31 March 2026.
The list distinguishes licensed operators from applicants, deemed applicants, withdrawn applications, returned applications, and closing-down platforms. An applicant is not licensed, and a deemed applicant has not received final approval. The legal entity and dated status should be reproduced exactly rather than compressed into the word “regulated.”
The SFC warns that its licensed list does not guarantee performance or creditworthiness. A status check establishes regulatory standing for the named operator; it does not establish solvency, service quality, asset availability, or whether a global affiliate supplies the feature shown to a Hong Kong customer.
Custody and market integrity determine operational risk
Client assets must be held on trust through the platform’s Associated Entity and segregated from operator assets. The VATP custody requirements require 98% of client virtual assets in cold storage unless the SFC permits a limited exception.
The compensation arrangement must cover 50% of client assets in cold storage and 100% in hot and other storage. The operator must monitor coverage daily, document wallet transfers, reconcile balances, control private keys, and show how clients would be compensated after hacking, fraud, or default.
Token admission is controlled by a committee rather than the listing team alone. It must set admission criteria, perform and record due diligence, monitor admitted assets, and reassess legal classification, technology, governance, liquidity, market integrity, smart-contract, sanctions, and money-laundering risks.
For retail trading, a token must qualify as an eligible large-cap virtual asset by appearing in at least two acceptable indices from separate, independent providers. Index inclusion is only a liquidity gate: the committee must still complete due diligence and suspend retail access if the asset stops meeting admission criteria.
Product access remains asset and investor specific
A VATP licence does not make every token or global feature available in Hong Kong. Retail eligibility, professional-investor access, tokenised securities, leverage, lending, staking, and perpetual contracts must be matched to the licensed entity, current terms, and relevant product permission.
That boundary appeared in a Hong Kong cash-out discussion reviewed on 20 August 2026. One HashKey user described converting ETH back to HKD, while participants disagreed about funding requirements and USDT access. The report cannot establish current platform terms or reliability.
It does reveal that the SFC controls operator status, HashKey controls onboarding and eligible assets, and the bank controls the fiat leg. A reader can test that handoff with a small deposit-trade-withdrawal cycle, recording the legal entity, conversion asset, landed HKD, elapsed time, and any rejected step.
Verification starts with the legal entity and exact service
A reliable licensing check starts with the company named in the customer agreement, not the brand in an advertisement. Search the live SFC list by legal name and trading name, then record the licence date, status, conditions, investor category, permitted product, and custody entity.
Next, compare the register with the platform’s Hong Kong terms, asset list, risk disclosures, withdrawal rules, and complaints route. The approval of a Hong Kong broker for virtual-asset trading illustrates why intermediary approval should not be relabelled as a VATP licence.
Singapore’s Investor Alert List treatment of Bybit is not equivalent to Hong Kong applicant or licensed VATP status. A crypto regulator watchlist should preserve those labels instead of assigning one generic compliance score.
For a commercial relationship, request the licence record, contracting entity, custody chain, market-surveillance controls, sanctions process, incident notification, financial resources, and wind-down plan. For a retail review, prioritise whether the exact asset is available and whether deposits, withdrawals, complaints, and loss limitations are explained clearly.
Conclusion
Hong Kong VATP licensing is a dual-perimeter decision. Security-token platforms generally need SFO Type 1 and Type 7 licences, non-security-token exchanges need the AMLO licence, and mixed venues should pursue both where token classification may change.
The practical barrier is operational readiness, not the filing fee. Before launch, the operator must align capital, liquid assets, responsible officers, customer scope, custody, token admission, surveillance, and deployed technology with the WINGS application and external assessment.
Users and counterparties should then verify the named entity and exact product against the live SFC list. A licence supports accountability for a defined activity, but it does not guarantee solvency, execution quality, unrestricted token access, or recovery from every loss.
Frequently asked questions
Does an SFC VATP licence cover every crypto product?
No. The permission applies to the named entity, licence route, product scope, investor category, and conditions. Retail tokens, professional-investor products, security tokens, perpetual contracts, custody, advice, and management can require different permissions or restrictions.
Is a VATP applicant the same as a licensed platform?
No. An applicant has not received final approval, and a deemed applicant remains a transitional applicant rather than a formally licensed VATP. Check the SFC’s separate lists and record the status and verification date exactly.
Why would a platform apply under both the SFO and AMLO?
A dual application allows the same operator to handle security and non-security tokens within the relevant permissions. It also reduces disruption if a token’s classification changes, although each activity, investor scope, and licence condition still needs separate verification.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
