Hong Kong Crypto License: The SFC VATP Licence Explained

A Hong Kong VATP licence is the licence the Securities and Futures Commission (SFC) requires for any centralised virtual asset trading platform that does business in Hong Kong or actively markets to Hong Kong investors. The regime has applied since 1 June 2023 under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, alongside the Securities and Futures Ordinance for security tokens. As of the SFC's list updated on 16 October 2026, 13 platforms hold the licence.

This guide explains how the two licences fit together, who is licensed, the capital and custody requirements, what retail investors can access, how staking and the newer product rules work, and how the stablecoin and upcoming dealer and custodian regimes sit around it.

What is the VATP licence?

VATP stands for virtual asset trading platform. According to the SFC's VATP page, centralised platforms "carrying on their businesses in Hong Kong, or actively marketing their services to Hong Kong investors, are required to be licensed and regulated by the SFC". There are two legal bases:

• AMLO (Cap. 615): a licence for "providing a virtual asset service", covering trading in non-security tokens with custody as an ancillary service.
• SFO (Cap. 571): Type 1 (dealing in securities) and Type 7 (automated trading services) licences, covering security tokens.

Because a token's classification can change over time, the SFC says it "would be appropriate" for platforms to apply under both regimes, and it accepts a single consolidated application through its WINGS portal.

The regime targets centralised venues that match client orders. Licensed platforms are also VASPs in the FATF sense; our explainer on what a VASP is covers that wider definition.

Timeline: from 2023 to today

• 1 June 2023: the AMLO licensing regime for VATPs took effect. The SFC's consultation conclusions of 23 May 2023 confirmed that licensed platforms could serve retail investors, subject to onboarding and token admission safeguards.
• 1 June 2024: the transitional period ended. Platforms that had operated before June 2023 and applied in time could continue as "deemed-to-be-licensed" applicants, which the SFC stresses are not formally licensed. Other applicants may not start business in Hong Kong until licensed.
• 19 February 2025: the SFC published its ASPIRe roadmap (Access, Safeguards, Products, Infrastructure, Relationships).
• 7 April 2025: staking guidance for licensed platforms.
• 1 August 2025: the Stablecoins Ordinance came into force.
• 3 November 2025: shared order books with overseas affiliates and wider product access.
• 11 February 2026: a framework for perpetual contracts for professional investors and permission for affiliated market makers.

Licensed VATPs in Hong Kong (October 2026)

The SFC's list of licensed platforms, last updated 16 October 2026, names 13 operators:

OSL and HashKey were licensed before the AMLO regime began on 1 June 2023, which is why their dates are earlier. The same page lists five pending applicants, including two deemed-to-be-licensed, and a separate list of applications returned, refused or withdrawn. One applicant, Matrixport HK, withdrew on 12 October 2026 and is listed as required to close down by 12 January 2027.

Always check the live register before using a platform: the list changes, and a deemed-to-be-licensed applicant may still be refused.

Licence requirements and costs

The SFC's application fees are small. Its VATP page lists HK$4,740 per regulated activity for a corporation under either ordinance, HK$1,790 for each licensed representative and HK$2,950 for each responsible officer approval. The real cost is in capital, custody, people and controls. Under the VATP Guidelines, as published with the 2023 conclusions, a platform operator must:

• maintain paid-up share capital of at least HK$5,000,000;
• maintain liquid capital of at least the higher of HK$3,000,000 and the basic amount under the Financial Resources Rules;
• hold liquid assets in Hong Kong, other than virtual assets, equal to at least 12 months of actual operating expenses;
• keep 98% of client virtual assets in cold storage, through a wholly owned associated entity;
• have an insurance or compensation arrangement for client assets, with coverage of 50% set for assets in cold storage.

Applicants must also submit their written policies and procedures and appoint an external assessor, whose report the SFC uses in its review, according to a January 2025 circular. For a cost comparison with EU CASP licences, see our CASP licence cost guide.

AML, KYC and the Travel Rule

Licensed platforms follow the SFC's AML/CFT guideline for licensed providers, which applies the Travel Rule to virtual asset transfers between institutions. The 2023 conclusions describe the Travel Rule as "a key AML/CFT measure" for VASPs. In practice platforms combine identity verification, from vendors such as iDenfy or in-house tools, with sanctions screening, wallet screening and Travel Rule messaging. Our Travel Rule guide explains the message flow.

Retail access rules

Hong Kong is one of the few major markets where licensed platforms can serve retail clients directly, but onboarding is strict. The SFC's 2023 conclusions require knowledge and risk assessments, investor training where needed, and an exposure limit per retail client. The SFC said the "terms, features and risks of virtual assets are generally not likely to be understood by a retail investor", which is why it framed onboarding in the spirit of suitability.

Token admission is also tighter for retail. As a minimum, a token offered to retail must be an eligible large-cap virtual asset included in at least two acceptable indices from at least two different index providers, and it must normally have a 12-month track record. The SFC's 3 November 2025 circular changed two things:

• the 12-month track record no longer applies to tokens offered only to professional investors;
• stablecoins from an HKMA-licensed issuer are exempt from the track-record rule and can be offered to retail.

For other tokens offered to retail, the 12-month rule still applies.

Staking, shared liquidity and new products

The original VATP Guidelines barred platforms from using client assets to generate returns, which effectively prohibited staking, lending and earn products. The SFC's staking circular of 7 April 2025 opened staking through modified licence conditions. A platform needs prior SFC approval, must keep control of client assets rather than hand custody to third parties, and must disclose risks such as slashing, lock-ups and technical failures. For background, see our guide to crypto staking.

Since then the SFC has widened the menu further:

• Shared order books. Licensed platforms may combine orders with affiliated overseas platforms in a shared order book, the first step under ASPIRe's Access pillar, per the SFC's 3 November 2025 announcement.
• Distribution and custody. Platforms can apply to distribute tokenised securities and digital asset products and to custody tokens they do not list.
• Perpetuals and market makers. On 11 February 2026 the SFC published a framework for perpetual contracts offered only to professional investors and allowed affiliates of licensed platforms to act as market makers. Our perpetual futures explainer covers how these contracts work.

Stablecoins and the coming dealer and custodian licences

Stablecoins Ordinance

The Stablecoins Ordinance (Cap. 656) took effect on 1 August 2025. Issuing fiat-referenced stablecoins in Hong Kong, or Hong Kong dollar stablecoins anywhere, now needs a licence from the Hong Kong Monetary Authority, not the SFC. The HKMA granted the first two licences on 10 April 2026, to HSBC and to Anchorpoint Financial, a joint venture of Standard Chartered, HKT and Animoca Brands. Our overview of stablecoin issuers in 2026 puts them in a global context.

Virtual asset dealers and custodians

The VATP licence covers trading venues only. On 24 December 2025, the Financial Services and the Treasury Bureau and the SFC published consultation conclusions confirming they will legislate separate licensing regimes for virtual asset dealing and custodian services, with no deeming arrangement for existing custodians. The government's 2026 Policy Address supplement (16 September 2026) says drafting is under way and the amendment bill, which also covers virtual asset advisory and management services, is expected to be introduced into the Legislative Council in the fourth quarter of 2026. No commencement date has been set.

For how Hong Kong compares with the EU, Dubai and Singapore, read our CASP licence jurisdictions comparison and the sibling guide to the VARA licence in Dubai.

Frequently asked questions

Do I need a licence to run a crypto exchange in Hong Kong?

Yes, if it is a centralised platform that does business in Hong Kong or actively markets to Hong Kong investors. It needs an SFC licence under the AMLO for non-security tokens, and the SFC recommends also applying under the SFO for security tokens.

How many crypto exchanges are licensed in Hong Kong?

The SFC's list of licensed virtual asset trading platforms, last updated on 16 October 2026, names 13 operators, from OSL Exchange and HashKey Exchange to the most recent addition, Bixin.com, licensed on 18 May 2026.

What capital does a Hong Kong VATP need?

Under the SFC's VATP Guidelines, a platform needs paid-up share capital of at least HK$5 million, liquid capital of at least the higher of HK$3 million and the basic amount, and liquid assets covering 12 months of operating expenses.

Can retail investors trade on licensed Hong Kong platforms?

Yes. Licensed platforms may serve retail clients after knowledge and risk assessments and with an exposure limit. Retail tokens must meet extra admission criteria, including inclusion in two acceptable indices and, except for HKMA-licensed stablecoins, a 12-month track record.

Can Hong Kong exchanges offer staking?

Yes, since the SFC's staking circular of 7 April 2025, but only with the SFC's prior approval and under specific licence conditions, including keeping control of client assets and disclosing risks such as slashing and lock-ups.

Keep reading

• CASP licence jurisdictions compared
• What is a VASP?
• The crypto Travel Rule explained
• VARA licence in Dubai
• Crypto custody explained

This article is educational and is not financial or legal advice. Licence lists, requirements and legislative status are taken from SFC, HKMA and Hong Kong government sources and law-firm summaries as checked on 17 October 2026, and they can change; confirm current requirements with the SFC and qualified Hong Kong counsel. Sources are linked throughout.