Which VA activities need a licence?

Quick summary

A. Activities that need a licence

1. Operating a centralised VA trading platform / exchange in HK

Licence: VATP under AMLO Schedule 3B, and additionally SFO Type 1 + Type 7 if any listed token is a security.

• Legal basis: s. 53ZRA AMLO - it is an offence to provide a VA service without a licence (max HK$5,000,000 + 7 years).
• Concrete example: An exchange in Central running a BTC/ETH/SOL spot order book and serving any HK retail or professional clients - VATP licence required. Retail-eligible tokens must additionally satisfy the SFC's "eligible large-cap VA" criteria (inclusion in two acceptable indices) under VATP Guidelines paras 9.3-9.7.

2. Peer-to-peer (P2P) VA marketplace

Usually yes - if you ever take possession of client funds or VAs, or match orders centrally.

• The "VA exchange" definition catches any platform "(a) through which an offer to sell or purchase any virtual asset is made or accepted" where the operator "comes into possession of any money or any virtual asset at any point in time".
• A LocalBitcoins-style site holding escrow during the trade -> VATP licence required. A pure smart-contract DEX front-end with no custody is a grey zone, but fees, off-chain matching, or KYC layers will typically pull it inside.

3. OTC desk buying/selling BTC/ETH for HK clients

Currently a grey zone, changing in 2026.

• The current AMLO definition only catches "VA exchange" activity. A pure bilateral OTC desk that quotes and trades as principal does not technically operate an exchange.
• HOWEVER: the FSTB consulted in 2024 on a dedicated VA OTC dealer regime; the 24 December 2025 consultation conclusions confirm that an SFC-administered licensing regime for VA dealers is on the way. A bill is targeted for LegCo in 2026.
• Today, a fiat-leg OTC desk also triggers MSO licensing under AMLO Part 5 from the C&ED.
• Concrete example: A Sheung Wan storefront that converts HKD cash to USDT - currently MSO-only; will need a dedicated VA dealer licence once enacted.

4. VA brokerage routing HK clients to overseas exchanges

Licence: SFO Type 1 + SFC VA-dealing uplift under the Joint Circular regime.

• The Joint Circular (22 Dec 2023; supplemented 30 Sep 2025) treats distribution of VAs, omnibus account dealing, and VA dealing services for HK clients as Type 1 regulated activity - even where the actual execution venue is offshore.
• Conditions: be Type 1 licensed, obtain the SFC's VA uplift, only partner with SFC-licensed VATPs, and meet VA suitability obligations.
• Concrete example: A HK-licensed broker letting clients place BTC orders through its app, with the broker routing trades on its omnibus account at HashKey Exchange - Type 1 + VA uplift required.

5. Asset manager with >= 10% VA exposure for HK PIs

Licence: SFO Type 9, with the SFC's "Terms and Conditions for Type 9 managers managing portfolios investing in VAs".

• De minimis <10%: standard Type 9 obligations.
• >= 10%: enhanced custody, valuation, risk management, audit, segregation, and disclosure standards.
• Funds may be offered only to PIs as defined in the SFO and the Securities and Futures (Professional Investor) Rules.
• Concrete example: A discretionary mandate allocating 25% to a basket of BTC, ETH and tokenised treasuries for a HK family office - Type 9 with VA uplift.

6. Issuing a security token / tokenised bond / fund

Yes - on multiple fronts.

• Issuance: prospectus regime under the Companies (Winding Up and Miscellaneous Provisions) Ordinance (Cap. 32) for offerings of shares/debentures; or Part IV SFO authorisation for CIS interests; or rely on the PI exemption.
• Distribution: SFO Type 1 (with VA uplift if non-security VAs are also involved).
• Trading: Type 1 + Type 7 + VATP licence for the venue.
• The SFC's position since the 2019 STO Statement (and reaffirmed 2 Nov 2023): a tokenised security is a security. See the STO page.

7. Issuing a fiat-referenced stablecoin in or to HK

Licence: HKMA Stablecoin Issuer licence under the Stablecoins Ordinance (Cap. 656), in force since 1 August 2025.

• Triggers: issuing an FRS in HK; issuing an FRS that references the HKD anywhere in the world; or actively marketing an FRS to the HK public.
• Requirements: HK incorporation, HK$25m paid-up capital, 100% reserve in HQLA, full segregation, par-value redemption (typically T+1), independent reserve audit, AML/CTF, fit-and-proper, recovery and wind-down planning. Algorithmic stablecoins are not eligible.
• Marketing prohibition: it is a criminal offence to offer an unlicensed FRS to retail in HK. Only stablecoins issued by licensed issuers can be marketed to retail.

8. Standalone VA custody

Currently no standalone licence; will change.

• VATP-bundled custody is regulated under Schedule 2 to the VATP Guidelines (98% cold storage, insurance/compensation, key controls) and the 14 Aug 2025 enhanced custody circular.
• Type 9 fund managers must use SFC-acceptable custody arrangements for >=10% VA portfolios.
• The 24 Dec 2025 consultation conclusions confirm a dedicated VA custodian licensing regime is on the way - bill targeted for 2026.

9. Marketing or distributing a VA fund in HK

Licence: SFO Type 1 with VA uplift; retail distribution only for SFC-authorised VA funds.

• Currently authorised retail VA products include the spot Bitcoin and Ether ETFs listed on HKEX from 30 April 2024.
• Pitching a Cayman BTC fund to HK PIs - Type 1 with VA uplift; pitching the same fund to retail - prohibited unless SFC-authorised.

10. Operating a VA ATM (fiat <-> VA kiosk)

Currently MSO; new VA OTC regime imminent.

• Today subject to MSO licensing under AMLO Part 5 (C&ED) because the operator handles fiat money-changing.
• The proposed VA dealer regime (2026) explicitly targets physical VA kiosks/ATMs.

B. Activities that do NOT need a licence (with caveats)

1. Individual buying BTC for personal investment

AMLO catches persons "carrying on a business" of providing VA services. A natural person investing for their own account is not a service provider. Caveat: regularly buying/selling for friends or family for a spread can amount to "carrying on a business".

2. Merchant accepting USDT for goods/services

Accepting VA as payment for goods/services is not "operating a VA exchange". Caveat: offering conversion services (USDT to HKD cash) is OTC activity and triggers MSO/forthcoming OTC dealer rules. Profits-tax reporting under the IRO still applies.

3. Open-source DeFi smart contract publication

Writing and open-sourcing code is not regulated activity. Caveats: (i) operating a front-end, taking fees, or controlling upgrade keys/treasury can pull you inside the regime in substance; (ii) code that is part of a securities offering can engage s. 103 SFO.

4. Mining BTC in HK

Mining itself is not a regulated activity. Caveats: pooled mining-as-a-service that promises a return can be a CIS. Electricity, planning and tax all still apply.

5. Bona fide play-to-earn gamer

Earning utility tokens through gameplay is consumption, not a financial service. Caveat: scaling to a guild model with investor-backed scholarships looks like a managed pool with profit expectation - i.e. a CIS.

6. Purely overseas VATP, no HK marketing

AMLO Schedule 3B applies to a person carrying on the business in HK or actively marketing to the HK public (s. 53ZRD mirrors the SFO's "active marketing" concept in s. 115(1)(b)). Caveats: a Chinese-language site with HKD pairs, HK-targeted ads, HK influencer campaigns, or a HK BD team will all evidence active marketing. The SFC has issued public warnings naming non-compliant offshore exchanges.

7. Media outlet writing about crypto

Editorial journalism is not "advising on securities". Caveats: paid buy/sell calls on specific security tokens engage Type 4. Promotional shilling can also breach s. 300 SFO and Part XIVA market misconduct rules where the token is a security.

8. Blockchain technical consulting

Architecture, code audit, integration consulting are not regulated activities. Caveats: asset-specific advice (which token to launch, list or invest in) for a fee can engage Type 4/6 if the tokens are securities.

9. Holding governance tokens

Mere ownership and on-chain voting is not a service. Caveats: a token that is in substance a security is caught by the SFO when distributed; running a paid delegated-voting service can be advisory.

10. Self-custody / non-custodial wallet software

Pure software wallets where the user controls their keys do not "come into possession of any money or VA" and so sit outside Schedule 3B. Caveats: MPC/SaaS wallets where the provider holds a key share may flip into the perimeter once the custody regime commences. Bundling swap/bridge functionality with fees can pull the provider into "exchange" territory.

Penalties for getting it wrong

• Unlicensed Type 1 dealing under SFO s. 114: max HK$5,000,000 fine + 7 years' imprisonment.
• Unlicensed VA service under AMLO s. 53ZRA: max HK$5,000,000 + 7 years, plus continuing-offence daily fines.
• Unauthorised offer of investments under SFO s. 103: max HK$500,000 + 3 years.
• Unlicensed FRS issuance under the Stablecoins Ordinance: max HK$5,000,000 + 7 years.
• Personal liability extends to directors and Responsible Officers under SFO s. 390 and the AMLO equivalent.

Authoritative sources

• SFO (Cap. 571) - eLegislation
• AMLO (Cap. 615) - eLegislation
• Stablecoins Ordinance (Cap. 656)
• SFC Guidelines for VATP Operators
• SFC-HKMA Joint Circular on Intermediaries' VA-related Activities (22 Dec 2023)
• Supplemental Joint Circular (30 Sep 2025)
• SFC AML/CFT Guideline for LCs and SFC-licensed VASPs
• SFC Public Register