Hong Kong’s licensing regime for virtual assets

1. Carries on business in providing a “VA service” (i.e. operating a VA exchange) in Hong Kong,
2. Holds itself out as carrying on such business, or
3. Actively markets to the Hong Kong public any services which constitutes “VA service”

is required to obtain a licence from the Securities and Futures Commission (SFC).

The term “VA” is defined in section 53ZRA while “VA service” is defined in Part 1 of Schedule 3B of the AMLO.

The SFC generally refers this type of licence as a VA trading platform (VATP) licence. As to persons carrying on business, holds itself out as carrying on business and/or actively markets to the Hong Kong public of services related to “security” tokens (other than “non-security” tokens), the traditional securities licensing regime under Part V of the Securities and Futures Ordinance (Cap. 571) (SFO) continues to apply. Persons engaging in the “securities” related business are always required to obtain a licence from the SFC under the SFO. Therefore, from 1 June 2023 any persons who carry on business in operating a VATP, whether “security” tokens or “non-security” tokens are traded in the exchange, are required to be licensed by the SFC.

As to the question on how to distinguish between the two types of tradable VA tokens, one has to refer to the definitions of “securities” and “futures contracts” as defined in the SFO. The general rule is that anything that falls within the definition of these two defined terms are “security” tokens otherwise they are “non-security” tokens. Irrespective of the type of the subject token being traded on a VATP, both the licence issuing authority and the regulatory authority are the SFC.

Given that the terms and features of a VA may change or evolve over time, it is possible that a VA classification may change from a “non-security” token to a “security” token (and vice versa). So, in practice and for risk management reasons, it is sensible for a VATP to apply for licences under both the AMLO and the SFO regimes. It is also something recommended by the SFC.

The type of licence under the AMLO regime is the VATP licence (see the definition above). It catches centralized platforms providing trading services in “non-security” tokens using an automated trading engine which matches client orders and also providing custody services as an ancillary service to their trading services.

The types of licence under the SFO are Type 1 regulated activity (dealing in securities) and Type 7 regulated activity (providing automated trading services). It covers centralized platforms providing trading services in “security” tokens using an automated trading engine which matches client orders and also those providing custody services as an ancillary service to their trading services.

As a side issue, technically speaking, in terms of licence for Type 7 regulated activity (providing automated trading services), there are two regimes for the SFC to regulate automated trading services (ATS) under the SFO, namely, authorization to provide ATS under Part III of the SFO; and licensed for Type 7 regulated activity under Part V of the SFO.

Deemed-to-be-licensed applicants

If an existing VATP service provider wanted to continue its operation in Hong Kong, it was required to submit a licence application to the SFC by 29 February 2024. The SFC considered whether the applicant could meet the regulatory requirements and whether it had substantial operation in Hong Kong before the commencement of the licensing system (on 1 June 2023), before deciding whether to allow the provider to be deemed as licensed from 1 June 2024 until a final decision is made on its licence application by the SFC.

As at 27 January 2025, there are nine licensed providers which have been granted a VATP licence by the SFC. They are able to offer Bitcoin (BTC) and Ethereum (ETH) trading services to retail investors. There is also a separate list showing a number of VATP licence applicants in the pipeline which, presumably, have submitted applications to the SFC and yet their application results are pending.

VA regulatory requirements

VA is a risky investment. Many VAs have no intrinsic value and the prices can be highly volatile. Some unlicensed VATPs (e.g. JPEX incident) may also have been involved in fraud, leading to substantial losses to investors. For these reasons, the regulations on dealing in VA and VATP are rigorous in order to protect local investors and at the same time facilitate a healthy development of the VA ecosystem.

The SFC adopts the principle of “same business, same risks, same rules” in regulating licences issued under the SFO and AMLO. There are broadly four categories of VATP and/or VA related licensed intermediaries. They are (1) VATP operators, (2) VA fund managers, (3) Intermediaries dealing in or advising on VA and (4) intermediaries distributing VA related products.

1. VATP operators

For VATP operators, they are corporations which have been granted a licence for Type 1 and Type 7 regulated activities under section 116 of the SFO; and/or granted a licence for providing a VA service under section 53ZRK of the AMLO. As licensees, they are expected to comply with the relevant legal requirements under both the SFO and/or the AMLO. In addition, they are expected to comply with the regulatory requirements made by the SFC under the relevant codes, guidelines (including mainly the VA guidelines, the AML guidelines for VA), circulars and frequently asked questions published by the SFC from time to time. Since there are many requirements, where there are inconsistencies among these requirements, generally speaking the legal requirements should prevail and, for regulatory requirements, the SFC expects the more stringent requirement should prevail.

To name a few requirements, a platform operator is expected to set up a token admission and review committee which shall be responsible for, among others, VA to be admitted, suspended and withdrawn for trading. It shall perform all reasonable due diligence on all VA before including them for trading taking into account of, for example, the background of management or development team of a VA, regulatory status of the VA in Hong Kong etc. Before making any VA available for trading by retail clients, the platform operator is expected to take all reasonable steps to ensure the VA does not fall within the definition of “securities” under the SFO, unless the offering of such VA to the retail clients complies with the prospectus requirements for offering of shares and debentures under the Companies (Winding Up and Miscellaneous Provisions) Ordinance (Cap. 32) and does not breach the restrictions on offers of investments under Part IX of the SFO.

A platform operator is also expected to ensure that it complies with the applicable laws and regulations in the jurisdictions to which it provides services. This includes implementing measures to prevent persons from jurisdictions (e.g. Mainland China) which have been banned from trading in VA from accessing its services (for example, by checking IP addresses and blocking access).

2. VA fund managers

The SFC regulates these fund managers through the imposition of certain terms and conditions on their licences. The SFC states that based on “same business, same risks, same rules” principle, the conditions are requirements derived from existing regulatory requirements applicable to SFC licensed fund managers but which are adapted to address the specific risks posed by VA.

Management of portfolios that invest less than 10 percent (the de minimis threshold) of the gross asset value of the portfolio or indirectly invest in VAs are exempted from compliance with the said terms and conditions. But it appears that the SFC still expects these exempted fund managers to notify SFC of its plan to manage VA before the mange should commence.

3. Intermediaries dealing in or advising on VA

Similar to the regulation as mentioned above, the SFC regulates these licensed intermediaries through the imposition of certain terms and conditions (which are different from the terms for VA fund managers) on their licences.

4. Intermediaries distributing VA related products

According to the SFC’s website, the SFC regulates intermediaries distributing VA-related products under the existing SFO regime. Therefore, all existing requirements for distribution of securities products (e.g. suitability requirement) apply.

Breaches and offences

SFC enforcement power

The SFC has broad supervisory powers to enforce the AML/CTF and other legal & regulatory requirements under the AMLO and SFO. For example, it can enter the business premises of licensed VATPs and their associated entities, without a court warrant, to conduct routine inspection; request production of documents and records; investigate breaches and sanction licensed persons involved in the breaches. It can also compel people to produce documents and records, attend interview and to give answers. Licensees are subject to disciplinary proceedings of the SFC. The SFC’s disciplinary sanctions include reprimand, an order for remedial action, a fine and suspension or revocation of the person’s licence.

For breaches of law, there are various offences punishable by fines and/or imprisonment in the AMLO:

Carrying on a business of providing a VA service without a VATP licence (section 53ZRD of the AMLO)

It is an offence to carry on a business of providing a VA service in Hong Kong, or to hold oneself out as doing so, without a licence. The offence carries a maximum penalty of HK$5 million fine and seven years’ imprisonment and a daily fine of HK$100,000 for each day that the offence continues.

Offence to issue advertisements relating to an unlicensed person’s provision of a VA service (section 53ZRE of the AMLO)

It is an offence for an unlicensed person to issue, or possess for the purpose of issue, an advertisement which holds the person out as prepared to provide a VA service. The offence carries a sanction of a HK$50,000 fine and six months’ imprisonment.

Offence involving fraudulent or deceptive devices etc. in transactions in VAs (section 53ZRF of the AMLO)

It is an offence if, in a transaction involving VAs, a person: (i) employs any device, scheme or artifice with intent to defraud or deceive; or (ii) engages in any fraudulent or deceptive act, practice or business. The maximum penalties are a HK$10 million fine and 10 years’ imprisonment.

Fraudulently or recklessly inducing others to invest in VAs (section 53ZRG of the AMLO)

It is an offence to make a fraudulent or reckless misrepresentation to induce an acquisition or disposal of a VA, whether or not the transaction takes place on a licensed VA exchange. The offence carries a maximum penalty of a HK$1 million fine and seven years’ imprisonment.

This article was written by Philson Ho, Principal at Philson Ho & Associates, Solicitors, and member of the Institute’s Financial Services Interest Group Organizing Committee.