Section 3 of 5

Helping clients buy and sell virtual assets - does it need a licence?

Short answer: almost always yes. The exact licence depends on what asset you are dealing in, the role you play, and how you reach clients. This page walks through the decision tree the SFC and HKMA apply under the Joint Circular on Intermediaries' VA-related Activities.

The headline answer

[!]
If you are helping clients buy and sell virtual assets in any capacity beyond a passive technical referral, you almost certainly need an SFC licence.

For security tokens it is SFO Type 1 (and Type 4 if you advise; Type 7 if you match orders; Type 9 if you manage). For non-security VAs (BTC, ETH, etc.) it is SFO Type 1 plus the SFC's "VA-dealing uplift" under the Joint Circular - and execution must go through a SFC-licensed VATP. If you operate your own matching engine or hold client assets, that is a VA exchange and triggers the AMLO VATP licence.

Step 1 - What is the asset?

Security tokens

Tokenised shares, debentures, fund units, profit-sharing or asset-backed STOs. Examples: HKMA tokenised green bond, tokenised money-market funds, equity tokens.

SFO regime applies in full

Non-security VAs

BTC, ETH, most major L1/L2 tokens, utility tokens. Regulated under AMLO Schedule 3B for exchange operators; the SFC's VA-dealing uplift is required for intermediaries.

AMLO + SFC uplift

Stablecoins

Fiat-referenced stablecoins are licensed under the Stablecoins Ordinance (Cap. 656) at the issuer level. Distribution and dealing are subject to the marketing prohibition - only HKMA-licensed FRS may be offered to retail.

Cap. 656 + Joint Circular

Hybrid platforms offering both security and non-security tokens trigger both regimes.

Step 2 - What is your role?

(a) Pure introduction / referral

Forwarding a prospective client's contact details to an SFC-licensed VATP for a referral fee is generally outside Type 1 and outside Schedule 3B - provided you do not:

  • give advice on whether to buy or sell;
  • handle client money or VAs;
  • transmit orders;
  • hold yourself out as arranging deals.

Once you do any of those, the activity becomes "dealing" under SFO Schedule 5 Part 2 (which captures making or offering to make agreements to buy/sell securities), or operating a VA exchange under AMLO. Even pure referral can be Type 1 if the underlying tokens are securities and you are remunerated as agent.

(b) Full intermediation

Order handling, omnibus accounts, possibly custody. Always licensable.

  • Security tokens -> Type 1 (and Type 4 if you also advise; Type 7 if you match on an ATS).
  • Non-security VAs -> SFO Type 1 with VA dealing uplift, executing through a SFC-licensed VATP. If you run your own matching engine, that is a VA exchange = AMLO VATP licence.

(c) Custody

Holding client wallet keys or fiat used to fund VA trades pulls you into the VATP / intermediary perimeter, with VATP Guidelines Schedule 2 custody rules - 98% cold storage, insurance/compensation, key ceremony controls. The 14 Aug 2025 enhanced custody circular adds further controls (whitelisting, real-time threat monitoring, designated custody RO).

Step 3 - Agent or principal?

  • Agent (broker) routing client orders externally - licensable as Type 1 (with VA uplift) regardless of whether the tokens are securities.
  • Principal (market-maker / OTC desk) trading bilaterally with the client at quoted prices - today often outside AMLO if you are not running an exchange, but expect to need the new VA dealer licence (2026 bill). For security tokens, principal dealing is still Type 1.

Step 4 - How are you reaching clients?

  • Online platform/app available in HK = active marketing presumption -> licence required if dealing.
  • Face-to-face in HK (RM, advisor, branch) = clearly carrying on business in HK -> licence required.
  • Corporate / institutional clients only (PIs) = still licensable, but lighter conduct standards (e.g. the SFC Code of Conduct paras 15.3A-15.6 and the Joint Circular's PI carve-outs - further relaxed by the 30 Sep 2025 supplemental circular for institutional / qualified corporate PIs in VA futures).

The decision tree, summarised

Is the asset a security token?
YES -> SFO Type 1 (and Type 4/7/9 as relevant). Mandatory.
NO -> Is your activity merely passive referral with no orders, funds, or advice?
YES -> Generally no licence (document the boundary carefully).
NO -> Are you running a centralised exchange / matching engine, or holding client VA / fiat?
YES -> VATP licence under AMLO Schedule 3B (+ Type 1/7 if any security tokens listed).
NO -> Are you a Type 1 broker routing to a licensed VATP?
YES -> SFO Type 1 + SFC VA-dealing uplift (Joint Circular).
NO -> Likely OTC; expect to need the new VA dealer licence under the 2026 bill.

Worked examples

Family office desk dialling HashKey to buy BTC

Acting as agent for a HK client. Type 1 + VA uplift

Wealth platform, "Buy ETH" button routed via OSL

PI clients only, but still distributing VA dealing services. Type 1 + VA uplift + SFC sign-off on the partner VATP.

Private bank RM emailing altcoin research

If the tokens are securities, Type 4 advisory; if non-security VAs, the Joint Circular still requires Type 1 with VA uplift because "soliciting" is providing VA dealing services.

Crypto media site with "buy BTC" affiliate button

If the click-through and fee mean you are introducing for reward, you need at minimum a VATP referral arrangement compliant with the VATP Guidelines, and possibly Type 1 if security tokens.

OTC desk in Sheung Wan trading USDT for HKD cash

MSO licence today; will need a VA dealer licence once the 2026 bill commences. AML/CTF and Travel Rule apply throughout.

Tokenised bond marketed to HK PIs

Issuance: Part IV SFO authorisation or PI exemption. Distribution: Type 1. Trading on a venue: Type 1 + Type 7 + VATP.

Sources

Not legal advice. The exact licence position depends on the facts of each case. Take independent legal advice and engage with the SFC's licensing team early.