1. VASP/VATP license legal access conditions and core establishment
Physical and workplace substance
Must be a company incorporated in Hong Kong or a registered non-Hong Kong company。Mandatory requirement to provide a non-residential local physical office address (commercial office building) for statutory record keeping and SFC surprise inspections，Never accept virtual addresses or purely overseas remote operations。
Legal capital and current reserves
Must always maintain at least 500 paid-up share capital of HK$10,000 and 300 10,000 HKD liquid capital。also，Must have beneficial ownership in Hong Kong sufficient to cover the future 12 Monthly statutory current assets for actual operating expenses (it is strictly prohibited to use any virtual assets to offset this indicator)。
Executive configuration (RO & MIC)
The platform must appoint at least 2 Responsible Officer (RO)，of which at least 1 executive director，And at least 1 resident in Hong Kong。At the same time, a core functional manager (MIC) must be appointed in accordance with the law to cover 8 Large control areas。All senior executives must be approved by the Securities Regulatory Commission as a fit and proper candidate (Fit & Proper) review。
Asset custody and insurance mechanism
Client assets must be kept in an independent trust by a wholly-owned subsidiary (AE) holding a TCSP license。At least 98% Assets must be stored in cold wallets，The private key must be generated and kept securely in Hong Kong。Hot wallet required 100%、Cold wallets require ≥50% statutory insurance or compensation coverage。
Absolutely prohibited business red lines
At this stage，SFC strictly prohibits licensed platforms from providing virtual asset futures and related derivatives transactions；Leverage/margin financing is prohibited；Proprietary trading by the platform or affiliated companies is strictly prohibited (except for back-to-back transactions)；And it is strictly prohibited to use customer assets for financial management、Activities such as pledging to earn interest。
2. 2023-2026 Evolution of Hong Kong’s virtual assets regulatory framework and bill revisions
- 2024December
External Evaluation (EAR) Program Optimization：SFC releases circular，Streamline and optimize the original long-time "two-stage external independent expert evaluation procedure" to "mainly one-time evaluation"，Significantly shorten the compliance rectification cycle。same day，Several Chinese-backed platforms were collectively approved under simplified procedures。
- 2024March-April
Spot ETF and stablecoin sandbox launched：Asia’s first virtual asset spot ETF launched in 4 Listed in month；at the same time，Hong Kong Monetary Authority (HKMA) launches stablecoin issuer sandbox，JD Coin Chain、Yuancoin Innovation and other entities enter the box to test the issuance of legal currency stablecoins。
- 2025February-August
Roadmap Release and Stablecoin Legislation：SFC launches “ASPIRe” roadmap，Planning staking and derivatives rules；"Stablecoin Ordinance" 2025 Year 8 moon 1 Officially effective on，It is expressly stipulated that the issuance of fiat stablecoins in Hong Kong requires a license，Trading is not currently open to retail investors。
- 2026year progress
Discussion on Tokenized Securities Retail Trading：SFC is developing relevant regulatory requirements and risk management and control guidelines，Consider allowing licensed virtual asset trading platforms (VATPs) to provide secondary market trading services for tokenized securities to retail investors，Broaden business outreach。
3. Statutory Application Submission File and Substantive Examination Elements
Consolidated Application Form for Category 1 and 7 Regulated Activities and VASPs，Comes with documents for a penetrating review of all ultimate owners (UBOs) and corporate structures。
Capital verification report in compliance with the Financial Resources Rules，as well as 12 Proof of liquidity reserve for monthly operating expenses。
External Evaluation Expert Report (EAR)，Covers platform system design、Asset custody structure、Cybersecurity and AML/CFT enforcement effectiveness audits。
Token Inclusion and Review Committee Procedures、Smart Contract Independent Audit Report，and risk disclosure and transaction limit assessment systems for retail investors.。
Responsible Officer (RO)、Proof of Competency for Core Function Managers (MIC) and Licensed Representatives (LR)、Dual certification of HKSI examination results and no criminal record。
Statutory compensation arrangement documents that comply with SFC regulatory requirements (including third-party insurance policy Binder or evidence of own funds set aside in trust)。
4. Hong Kong Huitong Legal Agency：Dual license application end-to-end process
Stage one：Pre-communication and structure placement (1-2months)
Conduct informal communication (Pre-application Engagement) with SFC to define product boundaries。Set up a company in Hong Kong and establish an AE subsidiary to obtain a TCSP license，Match Responsible Personnel (RO) with practical experience。
Stage 2：System construction and external evaluation (3-4months)
Write business plan and AML/CFT policy (including Travel Rule implementation plan)，Finish 98% Cold wallet and private key physical infrastructure construction in Hong Kong。Engage a qualified independent third party to complete the external assessment report (EAR)。
Stage three：WINGS declaration and administrative inquiries (4-6months)
Officially submit the "1+7+VASP" comprehensive application through the SFC WINGS system。Response to the China Securities Regulatory Commission’s response to the custody structure、Multiple rounds of questioning on the anti-money laundering system and token listing mechanism。
Stage four：AIP approved and officially licensed (1-2months)
Obtain conditional approval in principle (AIP) from the China Securities Regulatory Commission。After completing the final walkthrough of the system、After the insurance agreement takes effect and the core personnel are officially hired,，Replace a formal virtual asset trading license。
5. Analysis of SFC statutory fees and VASP rigid compliance operating costs
| Categories of funds and fees | Legal regulatory standards and amount assessment |
|---|---|
| statutory capital bottom line | Minimum paid 50010,000 Hong Kong dollars；Minimum liquid capital 30010,000 Hong Kong dollars；An equivalent value must be kept independently 12 Legal non-crypto liquid assets for monthly operating expenses。 |
| SFC official application and annual fee | Institution VASP/Category 1/Category 7 application fee each 4,740Hong Kong dollar；Personal RO Application Fee 2,950HKD/item，LR application fee 1,790HKD/item。Pay an equal annual fee every year after obtaining the license。 |
| External evaluation and system audit | Hire an independent expert to issue an EAR assessment report of approx. 8010,000-3 million Hong Kong dollars；Annual network security and system penetration testing costs approx. 5010,000-1.5 million Hong Kong dollars。 |
| Insurance and core labor costs | Covering 100% of hot wallets/50% of cold wallets with premiums reaching millions。Dual license RO、The estimated annual salary expenditure for MIC and IT compliance teams is between 60010,000-15 million Hong Kong dollars。 |
6. The absolute red line that triggers SFC disapproval or administrative penalties
Private key and cold wallet violations： not at least 98% of customers’ virtual assets are stored in cold wallets，Or the encryption seed/private key is not securely stored in an entity in Hong Kong，Directly trigger qualification rejection。
Derivatives and interest-earning business cross the line： Platform violates regulations by providing virtual asset futures to customers、Margin leverage trading，Or use customer assets without authorization to conduct DeFi pledge lending and interest-generating activities。
Not approved for M&A closing： Attempts to bypass approval by acquiring existing licensed/pending platforms，Significant equity (≥10%) "delivered first and then submitted for approval" without prior written approval from SFC，a serious illegal act。
7. Industry cutting edge：Approval and implementation cases of Chinese-funded/Chinese-backed entities
Futu (Panthertrade) with tiger (NEAR) approved
2025January，Cheetah Trading, a subsidiary of Futu Holdings, and YAX, a subsidiary of Tiger International, obtained VATP licenses in accordance with the law。This marks the successful extension of the leading Chinese-funded Internet securities firm's securities trading risk control system to the Web3 native asset trading field.。
DFX Labs, a wholly-owned subsidiary of Lianlian Digital, was approved
2024December，Cross-border payment giant Lianlian Digital 100% DFX Labs, a majority-owned company, successfully obtained a license under the simplified “one-time assessment” procedure，Establish a legal closed loop from compliance payment to underlying liquidation of virtual assets。
OSL and HashKey establish early compliance advantage
As the earliest compliance platform in Hong Kong，OSL Digital Securities and HashKey Exchange rely on their profound blockchain underlying technology and senior Chinese executive team background，Become one of the first licensed pioneers in the early stages of the regulatory framework。
Victory Securities achieved retail and tens of billions of transaction volume breakthroughs
Victory Securities, a long-established Hong Kong securities company, will 1 License for virtual asset upgrade (VA Uplift)，Became the first securities firm approved to carry out retail virtual asset transactions，And recorded a virtual asset trading volume of over 10 billion Hong Kong dollars in a compliant manner。
JD Coin Chain and Yuancoin Innovation Enter HKMA Sandbox
Hong Kong Monetary Authority launches stablecoin sandbox，JD Coin Chain, a subsidiary of JD Technology、Yuanbi Innovation, which is a shareholder of Zhongan Online, and institutions such as Standard Chartered Bank are among the first batch to enter the box，Test according to law 1:1 A fiat stablecoin issuance mechanism linked to the Hong Kong dollar。
8. Practical Legal Questions and Answers (FAQ)：Analysis of licensing conditions and core compliance pain points
Absolutely prohibited。Applicants must register a company in Hong Kong，Mandatory requirement to have a fixed physical office space for commercial purposes (cannot be residential or shared space)，And at least 1 Responsible officers (ROs) must be resident in Hong Kong to perform supervisory functions。
The legal bottom line is：Paid-up capital 500 10,000 Hong Kong dollars，Liquid capital 300 10,000 Hong Kong dollars。Additional deposits must be made in full to cover 12 Legal non-crypto liquid assets for monthly operating expenses。Transmitted online 400 The bank deposit of 10,000 yuan is only for internal account opening risk control of individual banks.，non-statutory standards。
In practice, it is strongly recommended to apply for dual licenses。Securities tokens cannot be traded with a VASP license only。Simultaneous application for Section 1 under SFO via consolidated form 1 kind、No. 7 Class and VASP license under AMLO，Can completely avoid illegal risks caused by token attribute conversion。
The platform must at least appoint 2 Name RO (at least 1 executive director，1 resident in Hong Kong)。At the same time, a MIC must be appointed to be responsible for 8 Big core functions。All personnel must pass the HKSI statutory examination，Tool 3 year industry and 2 Years of management experience，and pass the fit and proper review。
Permitted by law，But with strict preconditions。Retail investors must complete knowledge and risk assessment before opening an account，And the platform can only provide "eligible large-scale virtual assets" covered by at least two independent indices to retail investors.。
Must be held in an independent trust by a wholly-owned subsidiary (AE) holding a TCSP license。At least 98% Assets must be stored in cold wallets，It is also legally required that encryption seeds and private keys must be generated and securely stored in Hong Kong.，Offshore is strictly prohibited。
Mandatory requirements。Compensation arrangements or insurance approved by the Securities and Futures Commission must be established，The statutory coverage is：Hot wallet assets 100%，Cold wallet assets are at least 50%，To resist potential risks such as hacker theft or internal operations。
Business plan required、AML policy、Token inclusion mechanism, etc.。The core link is to hire independent experts to issue an external evaluation report (EAR)。2024At the end of the year, SFC has optimized it to "mainly one-time evaluation"，Reduces the time cost of repeated audits and rectifications。
Acquisition approval (4-6 months) is indeed faster than new applications。But compliance is extremely strict，Prior approval from the SFC is required before acquiring a significant equity stake of ≥10%，"Delivery first and then submission for approval" is absolutely prohibited (it is illegal)，And the original compliance and safety standards cannot be downgraded after the acquisition.。
Difficult in practice。Many banks refuse to open an account before obtaining the license。However, if an application has been submitted to SFC and received an Acknowledgment Letter or Approval in Principle (AIP)，Some banks can open restricted accounts in accordance with the law for operational preparation。
Absolutely prohibited at this stage。SFC strictly prohibits licensed platforms from providing customers with derivatives transactions such as virtual asset futures contracts，Leverage margin financing is prohibited，Customer assets are also not allowed to be misappropriated to provide deposit interest or DeFi pledge lending.。
Before the regulatory details are clarified，Stablecoin trading is temporarily prohibited for retail customers。As for OTC OTC trading，If it is carried out by the platform for customers，must be equivalent to the business within the platform，Fully covered by the same AML/KYC and risk control compliance regulations。
Traditional licensed brokers can apply for "Virtual Asset Uplift" (VA Uplift) to the SFC，in the original no. 1 Class license (securities trading) based on，Access to licensed VATP platforms through integrated account arrangements，Legally provide customers with crypto asset trading brokerage services。
The license is an open license，No fixed expiry date。But holders have extremely high ongoing reporting obligations：Submit financial resource reports monthly/annually，An independent agency must be appointed to conduct statutory and cyber security audits every year，and pay in full the annual license fees for each regulated activity。
