Introduction
Hong Kong is quickly becoming one of the world’s most important jurisdictions for virtual asset businesses. With a clear—though still evolving—regulatory framework, tax-friendly treatment, and strong institutional support, the city is positioning itself as a preferred hub for launching crypto exchanges, virtual asset funds, token issuers, and blockchain infrastructure ventures.
But here’s what every founder, fund manager, or token project team needs to know up front: licensing is not optional. Whether you’re running a centralized exchange, managing a fund with Bitcoin exposure, or building a stablecoin wallet, you’ll need to navigate a licensing regime that involves multiple regulators, overlapping laws, and detailed compliance requirements.
This guide lays out the essentials—who regulates what, what licenses apply to different crypto businesses, and how the application process works. It’s designed to help startups and fund managers move forward with confidence in Hong Kong’s fast-moving crypto regulatory landscape.
Securities and Futures Commission (SFC)
The SFC is more or less Hong Kong's SEC. It's the main regulator for a vast majority of cryptocurrency companies—especially if your company involves trading, investing, or dealing in tokens that are securities. Thus, if you're running a central exchange like HashKey or OSL, a spot Bitcoin or Ethereum ETF (like those offered by ChinaAMC, Harvest Global, or Bosera HashKey), a tokenized bond issuance venture, or a crypto hedge fund business, you will likely need an SFC license. And depending on what you're doing, precisely, you might also need licenses from other regulators.
Under the Securities and Futures Ordinance (Cap. 571), the SFC licenses and supervises a wide range of regulated activities, especially those involving trading, investment, and dealing in tokens that qualify as “securities.”
If your business involves:
- Operating a centralized exchange (like HashKey or OSL),
- Issuing tokenized bonds,
- Running a spot crypto ETF (e.g., ChinaAMC, Bosera HashKey),
- Or managing a crypto hedge fund,
…then you’ll almost certainly need an SFC license.
And depending on your exact activities, you may need more than one.
SFC Licensing Regime (Under Cap. 571 SFO)
Here’s a simplified breakdown of the most relevant license types:
Example: Running a Crypto Trading Platform?
If you're operating a Virtual Asset Trading Platform (VATP) and enabling trades in tokens classified as securities, you’ll likely need both a Type 1 and a Type 7 license:
• Type 1 covers brokerage and dealing functions
• Type 7 covers the technology infrastructure powering the trading system
The SFC applies detailed compliance expectations to licensed VATPs, including:
• Custody: How are client assets securely stored or segregated?
• Insurance: Is there coverage in place for cyberattacks, theft, or loss?
• Tech risk management: Are there controls in place to mitigate outages or data breaches?
• Investor protection: Are your disclosures, complaint handling, and risk warnings up to standard?
How the SFC Licensing Process Works
Applying for an SFC license is not a quick formality. It’s a structured process that usually takes 6 to 9 months, or longer for more complex or novel business models. Here’s what you’ll need to prepare:
1. Submit a business plan: The BP include company structure, key products, risk controls, technology architecture, and team bios.
2. Identify Responsible Officers (ROs): These are the accountable executives for licensed activities. They must meet “fit and proper” criteria, including relevant crypto or financial experience.
3. Prepare detailed internal controls: Cover compliance manuals, cybersecurity protocols, AML/CFT procedures, and conflict-of-interest policies.
4. Undergo SFC interviews and systems reviews: The regulator will assess your internal readiness through document reviews, tech walkthroughs, and leadership interviews.
5. Meet financial soundness thresholds: Depending on your activities, minimum capital requirements apply (e.g., HK$5 million for some Type 1/7 license holders).
6. Demonstrate readiness for ongoing compliance: This includes setting up audit functions, fulfilling reporting obligations, and enabling real-time regulatory access.
The SFC prioritizes investor protection, governance, and operational transparency. Companies that come prepared—both legally and technically—are far more likely to navigate the licensing process successfully.
Hong Kong Monetary Authority (HKMA)
The HKMA is Hong Kong’s de facto central bank—but don’t let the name fool you. Its regulatory reach extends well beyond traditional banking. If you’re handling payments, wallets, stablecoins, or crypto custody, the HKMA will almost certainly be involved.
A. Payment and Wallet Businesses
If your product stores or manages user funds—including in stablecoins—you may fall under the Stored Value Facility (SVF) regime, regulated under the Payment Systems and Stored Value Facilities Ordinance (Cap. 584).
This regime applies to:
• Crypto mobile wallets (e.g. integrated stablecoin wallets)
• Prepaid crypto payment cards
• Cross-border remittance apps using tokenized assets
• Reloadable crypto apps with balance functions
To legally operate, you’ll need to apply for an SVF license from the HKMA. The HKMA expects from SVF applicants:
• A clear business model, showing how funds are stored, how payments are processed, and how the company earns revenue
• Strong risk management, including real-time transaction monitoring, cybersecurity controls, and incident response
• Robust AML/CFT policies, aligned with the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615)
• A minimum capital base of HK$25 million
• Local presence in Hong Kong, with actual compliance personnel—not just a mailing address
Most applications take 6 to 12 months depending on your structure, documents, and responsiveness during the review process. Once licensed, ongoing compliance is serious business. Expect frequent reporting, system audits, and dialogue with HKMA supervisors.
B. Digital Asset Custody Services
If your business holds digital assets on behalf of clients, the HKMA will expect you to comply with strict custody standards—even though Hong Kong does not (yet) have a standalone custody license.
This includes:
• Crypto exchanges
• Crypto wallet providers
• Banks or fintechs providing digital asset storage
In a February 2024 circular, the HKMA made it clear that digital asset custodians must meet high operational standards. These include:
• Client asset segregation: Clear separation between customer assets and company assets
• Key management and wallet architecture: Strong internal controls around private key generation, storage, and recovery
• Cybersecurity: Advanced intrusion detection, encryption, and access control protocols
• Disaster recovery and continuity plans: Practical systems to handle outages, breaches, or DLT (distributed ledger technology) failures
• Internal audit and monitoring: Routine checks to ensure systems are functioning as intended
Even if you don’t label yourself a custodian, if you're holding user assets, you're expected to meet these standards—whether you operate directly or via third-party infrastructure.
C. Tokenized Financial Products
If you're issuing tokenized gold, bonds, deposits, or structured notes—especially in collaboration with a bank—you’ll need to comply with HKMA’s requirements around:
• Smart contract reliability: Can the code be trusted to execute properly and securely?
• Disclosure and investor protection: Are risks clearly explained to users?
• Operational risk controls: How do you manage volatility, redemption, and settlement mechanics?
These fall under the existing investor protection framework, but tokenization adds a layer of tech governance—so expect deeper scrutiny.
D. Innovation Sandbox: A Smarter Starting Point
Thinking about launching a novel crypto payment product or stablecoin-backed wallet? The HKMA’s Fintech Supervisory Sandbox offers a lower-risk way to test your idea. It allows eligible firms to pilot innovative products in a controlled environment, often with tailored regulatory oversight and limited user exposure. This may be a great option for startups exploring stablecoin payment rails, cross-border wallets integrating digital fiat, and banks launching tokenized payment instruments. BTW, you don’t need to be fully licensed to enter the sandbox, but you do need a concrete use case and a risk-mitigated launch plan.
A Note on DLT (Distributed Ledger Technology): Much of what the HKMA regulates in the crypto space relies on DLT infrastructure. If your platform suffers from a DLT failure—meaning the underlying blockchain malfunctions or becomes unreliable—you’re expected to have documented contingency plans and robust incident reporting mechanisms.
Summary: When Does the HKMA Apply?
If your project touches user funds, payments, or custody, don’t assume you can bypass HKMA rules. The standards are high—but clear—and early alignment with regulatory expectations can help you avoid costly licensing delays or compliance gaps later on.
Customs and Excise Department (C&ED)
This one may surprise you: the Customs and Excise Department (C&ED)—yes, the same agency that handles border control—is also a key crypto regulator in Hong Kong.
Why? Because under Hong Kong’s Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615), the C&ED is in charge of licensing Money Service Operators (MSOs). And many crypto businesses—even fully digital ones—fall under this category.
If your startup deals with fiat-to-crypto exchanges, OTC desks, stablecoin remittances, or any kind of crypto payment service that connects virtual assets with real-world currency, this is the license you need to know about.
What Exactly Is a “Money Service”?
Under the law, a “money service” generally includes:
• Money changing — like exchanging foreign currency for HKD or vice versa (including crypto-to-fiat).
• Remittance services — sending or receiving money across borders, even if your platform is just connecting users.
Here’s the key point:
You don’t have to handle physical cash to be regulated. If your platform helps people move funds from one place (or currency) to another, especially across borders, you’re likely offering a regulated service—whether you call it “OTC,” “P2P,” or “crypto settlement.”
OTC Desks: Legal, But Only if Licensed
Hong Kong has a vibrant OTC market. Some of these businesses operate out of physical storefronts—you walk in, exchange cash for crypto or stablecoins (like USDT), and walk out. Others operate entirely online, matching buyers and sellers for large trades.
Whether in-person or virtual, most OTC desks involve money changing or remittance-like services—which means they must be licensed as MSOs under Cap. 615.
So yes, OTC desks are legal in Hong Kong—but only if they’re properly licensed and following AML rules.
When Do You Need an MSO License?
If your crypto business involves any of the following, you likely need to apply for an MSO license from the C&ED:
• Helping users exchange crypto for fiat (or the other way around)
• Enabling cross-border payments involving stablecoins or crypto
• Running a crypto OTC desk—whether online or physical
• Offering wallet features that facilitate remittances or conversions
Even if you're not holding the money yourself, arranging or facilitating these types of transactions puts you on the regulator’s radar.
What the Licensing Process Looks Like
Getting licensed isn’t complicated, but it does require good preparation. Here's what the process typically involves:
1. Submit a Business Plan
You’ll need to explain your product clearly:
• How your platform works
• Where your customers are located
• What types of transactions you process
• What your AML safeguards look like
2. Build Your AML/CFT Program
The C&ED really cares about this. You’ll need to show:
• How you verify customer identities (CDD)
• How you monitor transactions for suspicious activity
• What happens when you detect red flags
• How your staff is trained and audited
3. Pass the “Fit and Proper” Test
All directors, controllers, and beneficial owners must undergo background checks. The C&ED will look into:
• Your personal and professional integrity
• Financial history
• Any previous run-ins with regulators
4. Secure a Physical Office in Hong Kong
Even if your team is remote, you need a local address. And it can’t just be a mailing address or PO box—the C&ED will inspect your office before granting the license.
5. Appoint Key Compliance Personnel
You’ll need two core roles:
• A Compliance Officer to manage internal controls
• A Money Laundering Reporting Officer (MLRO) to deal with regulators and file reports
If you're a small team, these roles can overlap—but the people in charge must actually understand and implement AML policies.
Timing and Ongoing Obligations
How long does it take? Most applications take about 4 to 6 months from submission to approval—depending on how complete and clear your documentation is.
Once licensed, then what?
• You’ll need to keep detailed transaction records
• File annual license renewals
• Notify the C&ED if you change ownership, business model, or launch new services
• Expect occasional on-site inspections
Heads up: Operating without an MSO license is a criminal offense. You could face up to 2 years in prison and a HK$1 million fine if caught offering unlicensed money services.
Quick Summary: Does Your Crypto Business Need an MSO License?
If your business moves fiat in or out of the crypto ecosystem—or even facilitates that movement—you’re likely subject to C&ED oversight.
Inland Revenue Department (IRD)
The IRD is Hong Kong’s tax authority, and it decides how your crypto-related profits are taxed. Here’s the good news up front: Hong Kong does not have a capital gains tax. So if your business simply holds crypto or digital assets for long-term investment, profits from eventual sales are generally not taxable. But—and this is key—if you’re actively doing business with or through crypto, your income may be treated as trading profits, and profits tax will apply.
Please see our blog How to Use Hong Kong as a Strategic Regional Base: Legal, Tax, and Employment Guide for a comprehensive discussion on Hong Kong tax rules.
What Triggers Tax in Crypto?
Whether your crypto profits are taxable depends on what you're doing, how you're doing it, and where it’s happening. The IRD looks at three main things:
- Are you carrying on a business in Hong Kong? (e.g. team, servers, management, or operations are based here)
- Is your income sourced in Hong Kong? (based on where profit-generating activities happen—not just where your customers are)
- Is your crypto activity investment or trading in nature? (the line is drawn based on intent, frequency, and business-like setup)
Key Point for Token Issuers
If you're launching an ICO or token sale, how you structure and document the rights attached to the token matters. The IRD will look beyond labels and examine substance.
- A utility token (e.g. grants access to a future platform) is likely treated as revenue—taxed when the service is delivered or prepaid.
- A security token (e.g. representing equity or debt) may be considered capital—proceeds are not taxed.
Other Crypto-Related Scenarios
• Mining: Taxable if done as a business (depends on organization, scale, and intention)
• Using crypto to pay for goods/services: Transactions are recognized based on crypto’s market value at the time
• Receiving crypto as salary or compensation: Taxable as employment income at market value
Examples of Taxable Crypto Activities
Here’s how different crypto-related business models are typically taxed:
Reference for Advisors: The IRD has issued DIPN No. 39 (Revised), a detailed guidance document covering how it treats digital assets, e-commerce, and token transactions. It’s a must-read for in-house counsel, accountants, and legal advisors structuring token offerings or digital asset businesses in Hong Kong.
Financial Services and the Treasury Bureau (FSTB)
The FSTB doesn’t directly issue licenses or conduct supervision, but it plays a crucial behind-the-scenes role. Think of it as the architect of Hong Kong’s long-term regulatory blueprint for crypto and fintech.The Bureau is responsible for shaping policy and proposing legislation for the financial services sector—including virtual assets. If you’ve read about a new licensing regime or public consultation on stablecoins or OTC crypto trading, that’s likely the FSTB at work.
Its 2022 Policy Statement on the Development of Virtual Assets made one thing clear: Hong Kong sees virtual assets as part of the future of finance. The government wants to support sustainable innovation while keeping guardrails in place for investor protection, AML/CFT, and financial stability. So, while you won’t apply for a license from the FSTB, you’ll definitely feel its influence when it comes to the rules you need to follow—and where Hong Kong’s crypto laws are headed next.
Insurance Authority (IA)
The intersection between crypto and insurance is still emerging—but it’s growing fast. That’s where the Insurance Authority (IA), Hong Kong’s insurance regulator, comes in.
While it hasn’t rolled out a full licensing framework specific to crypto yet, it’s made it clear that insurers and brokers must proceed with caution when engaging in virtual asset-related activities. That could mean anything from offering custody insurance for wallets or exchanges, issuing token-linked policies to using blockchain for smart contracts in insurance.
In a 2022 circular, the Insurance Authority made its position clear: if you're an insurer dealing with anything crypto-related, you need to treat it like any other serious risk. That means doing proper due diligence on virtual asset service providers (VASPs), putting solid cybersecurity systems in place, and making sure your customers actually understand what they’re buying—especially when their policy benefits are tied to something as volatile as a token.
Insurers are also expected to comply with Hong Kong’s AML/CFT rules when dealing with VASPs or accepting premiums in virtual assets. And if they’re serving offshore clients, they must consider foreign regulatory risks too.
In short: if your crypto business touches insurance—directly or indirectly—the IA wants to make sure risks are assessed, customers are informed, and regulatory obligations are met.
Summary: Licensing in Practice
Now that we've covered the key regulators and licensing regimes, here’s how it all plays out in real-world crypto business models. Even if your business is incorporated overseas, if you're actively targeting customers in Hong Kong or offering services into the local market, you’re expected to comply with Hong Kong regulations.
Note: "AMLO" refers to compliance obligations under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615). It's not a license, but it's a mandatory part of the regulatory framework.
Final Thoughts
Hong Kong has one of the clearest and most comprehensive regulatory frameworks for virtual asset businesses in Asia. Whether you’re launching a trading platform, managing a crypto fund, or building a stablecoin app, understanding the licensing landscape—and getting it right from the start—is critical.
Need help navigating the process? Trustiics connects crypto and fintech companies with trusted legal experts who have expertise in global virtual asset regulatory compliance.