What Hong Kong Actually Requires From a Licensed Crypto…

Hong Kong's pitch as a regulated digital-asset hub can make obtaining a crypto licence sound like an administrative gateway. The actual Securities and Futures Commission rules are considerably more demanding. A centralised crypto exchange serving Hong Kong faces requirements covering its corporate structure, responsible officers, capital, custody architecture, compensation arrangements, token selection, retail onboarding, cybersecurity and external assessment. Several of those requirements have also changed since the licensing regime began on 1 June 2023. The result remains a relatively small regulated market. The SFC's register, checked on 26 August 2026, lists 13 formally licensed virtual asset trading platforms, despite Hong Kong having operated its dedicated VATP regime for more than three years. The latest licence shown on the register was granted to Bixin.com operator NewBX Limited on 18 May 2026. That number helps explain the difference between Hong Kong's broad policy support for digital assets and the operational bar firms have to clear before they can run an exchange.

Which Licence a Crypto Platform Actually Needs, and From Whom

For a centralised platform operating in Hong Kong or actively marketing to Hong Kong investors, the regulator is the Securities and Futures Commission. Under the framework effective from 1 June 2023, a platform trading non-security virtual assets needs a licence under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance to provide a virtual asset service. A platform dealing in security tokens falls within the Securities and Futures Ordinance and requires Type 1, dealing in securities, and Type 7, providing automated trading services, licences. In practice, the SFC recommends applying under both regimes. A token's legal classification can change, and dual licensing reduces the risk that an exchange falls outside its permissions when a token moves between security and non-security treatment. Applicants can submit the two applications together through the SFC's WINGS portal. The licensing process itself became more structured on 16 January 2025. New applicants must identify an external assessor and deploy the systems and controls they intend to use before undergoing an independent direct-assurance assessment. The SFC is itself a party to that assessment arrangement. HashKey Exchange's head of compliance, Samuel Lok, described the practical distinction in a 2024 interview: "Obtaining a license and actually operating are two different domains." His point was that satisfying the regulatory framework on paper is only the beginning; the controls then have to work inside a live crypto business.

Custody and Insurance — the Requirements That Bite Hardest

Custody is one of the clearest examples of how high Hong Kong has set the bar. The VATP Guidelines introduced with the regime require a platform to keep 98% of client virtual assets in cold storage, leaving no more than 2% in hot wallets. SFC inspections later found errors in how some applicants classified wallets and calculated that ratio, prompting the regulator on 16 January 2025 to restate that all relevant client assets must be included and that breaches of the 98/2 ratio should be corrected promptly. The platform also cannot simply place client crypto on its own balance sheet. Client assets must be held on trust through an associated entity. That entity must be incorporated in Hong Kong, be a wholly owned subsidiary of the platform operator and hold the necessary trust or company service provider licence. Its business is restricted to receiving or holding client assets for the platform. Then comes loss protection. Since the VATP Guidelines took effect in June 2023, platforms have been required to maintain an SFC-approved compensation arrangement covering potential losses equal to 50% of client assets held in cold storage and 100% held in hot or other storage. Importantly, this does not have to consist entirely of conventional insurance. The SFC permits combinations including third-party insurance and qualifying assets set aside on trust for compensation purposes. The regulator tightened operational custody expectations again on 15 August 2025, with minimum standards covering private-key management, wallet infrastructure, transaction approval, access controls and senior-management oversight. Those requirements took immediate effect.

Token Admission and Who Can Trade What

Getting licensed does not give an exchange an unrestricted menu of crypto assets. A VATP must maintain a token admission and review process and perform due diligence covering matters including a token's development team, regulatory status, liquidity, technical structure, governance, market risks, money-laundering exposure and smart-contract risks. Retail distribution carries an additional hurdle. A virtual asset offered to retail clients must generally qualify as a highly liquid, eligible large-cap asset. At minimum, it must appear in at least two acceptable indices produced by two independent index providers. The rules changed materially on 3 November 2025. The SFC removed the previous 12-month trading-history requirement for virtual assets offered only to professional investors. The 12-month requirement still applies to other virtual assets offered to retail investors. Licensed stablecoins received separate treatment. Hong Kong's Stablecoins Ordinance took effect on 1 August 2025, placing fiat-referenced stablecoin issuance under the Hong Kong Monetary Authority. The HKMA granted its first two issuer licences on 10 April 2026. Stablecoins issued by an HKMA-licensed issuer can be offered by VATPs to retail investors without satisfying the normal 12-month track-record requirement. The SFC added further requirements for activities involving these regulated stablecoins on 27 May 2026. The distinction matters: a VATP licence and a stablecoin issuer licence are not the same permission. The exchange remains under the SFC; issuance of the regulated fiat-referenced stablecoin sits with the HKMA.

Capital, Personnel and the Responsible-Officer Requirement

The financial requirements start with HK$5 million in paid-up share capital. A VATP must also maintain required liquid capital equal to the higher of HK$3 million or its calculated regulatory requirement. On top of that, it must keep sufficiently liquid assets in Hong Kong, excluding virtual assets, equal to at least 12 months of actual operating expenses, calculated on a rolling basis. Personnel requirements create another hurdle. A platform needs at least two responsible officers supervising its licensed activities. At least one must be an executive director, and at least one responsible officer must ordinarily reside in Hong Kong. For a dually licensed VATP, two appropriately dually licensed ROs can satisfy both regimes. At least one RO must also have no less than three years of direct industry experience operating a VATP or providing automated trading services, together with sufficient technical knowledge of the platform's systems and controls. Those requirements make the licence partly a staffing exercise: capital alone cannot compensate for the absence of SFC-approved people with the required combination of management, regulatory and technical experience.

How Many Platforms Are Licensed, and What That Tells You

As of 26 August 2026, the SFC's published list contains 13 licensed VATPs. Six additional applicants remain on its applicant list, including entities associated with Crypto.com, Matrixport and Bybit, although the SFC explicitly warns that appearing as an applicant does not mean a platform is licensed or will eventually receive approval. The count has increased from the earliest days of the regime, but it remains small relative to the number of global crypto exchanges capable of serving a market the size of Hong Kong. That is the practical answer to what a Hong Kong crypto licence requires. It is not simply an AML registration attached to an exchange business. It combines traditional securities-style governance and capital requirements with crypto-specific custody, wallet security, token admission and client-asset rules, followed by continuing regulatory assessment after approval. Hong Kong has continued to broaden what licensed firms can do, including changes to token admission and stablecoin activity. But it has done so without removing the controls that made entry difficult in the first place. That is also the context for Hong Kong's new and proposed crypto licensing requirements: the city is widening the regulated digital-asset perimeter, while keeping the threshold for operating inside it high.