General information only. CryptoRegHub provides summaries for informational purposes and does not constitute legal or compliance advice. Always verify with official sources and consult qualified legal counsel before making compliance decisions.
CryptoRegHub provides plain-English summaries of crypto regulations for informational purposes only. This does not constitute legal, compliance, or financial advice. Regulations change frequently — always verify information with official sources and consult qualified legal counsel before making any compliance decisions.
Hong Kong introduced a mandatory licensing regime for virtual asset trading platform operators (VATPs) under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) from 1 June 2023. Prior to this, an optional regime existed under the Securities and Futures Ordinance (SFO) for platforms trading security tokens. The mandatory AMLO regime now requires all centralised crypto exchanges operating in or from Hong Kong to be licensed by the SFC. The regime applies the "same activity, same risks, same regulation" principle, aligning VATP oversight with that of traditional brokerages. In November 2025, the SFC expanded the regime to allow VATPs to integrate order books with global affiliate platforms for shared liquidity, and removed the 12-month track record requirement for assets made available to professional investors. The SFC's February 2025 ASPIRe roadmap sets out plans to further develop the regulatory framework including new regimes for VA dealers, custodians, advisers and managers.
Applies to any person operating a centralised virtual asset trading platform in Hong Kong — i.e. using an automated trading engine to match client orders in virtual assets, while also providing ancillary custody services. The regime covers platforms serving both professional investors (assets ≥ HKD 8 million) and retail investors. Pure OTC trading and brokerage activities without an automated matching engine are not currently in scope.
Key requirements: (1) SFC licence under AMLO — fit-and-proper tests for directors and responsible officers (minimum 2 SFC-approved ROs required). (2) 98% of client assets must be held in cold storage. (3) Client assets must be held by a wholly-owned subsidiary custodian — third-party custodians not accepted. (4) Full KYC/CDD required at onboarding; enhanced due diligence for high-risk clients. (5) Travel Rule: applies to all virtual asset transfers; transfers above HKD 8,000 require full originator/beneficiary information. (6) Retail investor protections: appropriateness assessment, risk disclosures, limits on leverage. (7) Cybersecurity: regular independent audits and penetration tests. (8) Internal governance and risk management frameworks. (9) External assessment by SFC-approved assessor required at licensing.
Always refer to official sources to confirm current requirements. CryptoRegHub summaries are for general guidance only.
Large fines, licence revocation, or criminal referral risk
This summary is for general informational purposes only and does not constitute legal advice. Always verify with official sources and consult qualified legal counsel.