New Hong Kong Regulatory Requirements and Licensing Regime for Virtual Asset Trading Platforms Finalised as Legislation Takes Effect

June 7, 2023

Click for PDF

On June 1, 2023, Hong Kong’s long-awaited licensing regime for virtual asset trading platforms (“VATPs”) went live, with the Hong Kong Securities and Futures Commission (“SFC”) marking the occasion by issuing a flurry of regulatory guidance for operators of VATPs (“Platform Operators”) in the form of guidelines, FAQs and handbooks.

This client alert discusses that regulatory guidance, with a particular focus on the key practical takeaways for prospective VATP licence applicants set out in the SFC’s Consultation Conclusions on the Proposed Regulatory Requirements for Virtual Asset Trading Platform Operators Licensed by the Securities and Futures Commission (the “Consultation Conclusions”). However, the guidance issued by the SFC spans a wide range of topics, including transitional arrangements, senior management accountability, onboarding of clients and cybersecurity. Prospective VATP licence applicants should ensure that they familiarise themselves with the SFC’s guidance and expectations for Platform Operators.

Consultation Conclusions Published on May 23, 2023

In February 2023, the SFC issued a highly-anticipated consultation paper inviting public comments on the proposed regulatory requirements applicable to Platform Operators.[1] We previously published a client alert on this topic.[2] Following a feedback period that concluded on March 31, 2023, the SFC published its Consultation Conclusions on May 23, 2023, which considered 152 submissions received by the SFC from industry associations, professional and consultancy firms, market participants, licensed corporations, individuals and other stakeholders.[3]

While the SFC found respondents generally supportive of the proposed regulatory requirements for Platform Operators in Hong Kong, a number of comments noted that the technical and implementation details may have been insufficiently clear.  In response, the SFC has modified or clarified some of the regulatory requirements as set out in the Guidelines for Virtual Asset Trading Platform Operators (the “VATP Guidelines”), and also published additional circulars, FAQs and guidelines on May 31, 2023 and June 1, 2023.

The SFC maintains that providing clear regulatory expectations will be critical to fostering responsible development, especially within Hong Kong’s virtual assets (“VA”) landscape. Adopting the principle of ‘same business, same risks, same rules’, the SFC aims to support and develop the VA industry by ensuring robust investor protection and critical risk management.

Circular on Transitional Arrangements

On May 31, 2023, the SFC issued the Circular on Transitional Arrangements of the New Licensing Regime for Virtual Asset Trading Platforms (the “Transitional Arrangements Circular”) to provide additional guidance on the transitional arrangements for VATPs under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) licensing regime (the “AMLO VASP Regime”).[4]  The guidance in this Circular is consistent with the transitional arrangements explained in the SFC’s consultation paper published in February 2023 but provides further detail that will be relevant to VATPs preparing to apply for a licence by no later than February 29, 2024.

An important point to note is that, upon reviewing a licence application, if the SFC considers that the VATP licence applicant does not meet any of the deeming conditions (which includes proving to the SFC’s satisfaction that the VATP is capable of complying with the regulatory requirements applicable to VATPs), then the SFC may issue a notice to the VATP (the “no-deeming notice”) to inform the VATP that the deeming arrangement will not apply to it.  A VATP that receives a no-deeming notice will be subject to a deemed withdrawal procedure and must proceed to close down its business by May 31, 2024 or by the expiry of three months beginning on the day of the issuance of the no-deeming notice (whichever is the later), irrespective of whether it has objected to the deemed withdrawal of its licence application.  It will therefore be crucial for a VATP licence applicant to submit a robust licence application that proves that it can meet all of the deeming conditions, or else it risks being ineligible for the deeming arrangement.

Other regulatory guidance applicable to VATPs

In addition to the recently published Consultation Conclusions, the VATP Guidelines, and the Transitional Arrangements Circular, operators of VATPs should also be aware of additional regulatory guidance contained in the following documents published between May 31 and June 1, 2023:

  • Licensing Handbook for Virtual Asset Trading Platform Operators;[5]
  • Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations and SFC-licensed Virtual Asset Service Providers);[6]
  • Prevention of Money Laundering and Terrorist Financing Guideline issued by the Securities and Futures Commission for Associated Entities of Licensed Corporations and SFC-licensed Virtual Asset Service Providers;[7]
  • Disciplinary Fining Guidelines;[8]
  • Scope of External Assessment Reports;[9]
  • Circular on implementation of new licensing regime for virtual asset trading platforms;[10]
  • Eight (8) FAQs on VATP licensing-related matters;[11] and
  • Nine (9) FAQs on VATP conduct-related matters.[12]

The regulatory guidance set out in the documents above, in addition to the VATP Guidelines, will be essential to VATP licence applicants, as applicants will need to ensure that its licence application provides to the SFC that it is capable to comply with these regulatory requirements – or else the applicant may be issued a non-deeming notice (as explained above).

VATP licence application forms

The licensing forms for the new AMLO VASP licensing regime (which includes making a simultaneous licence application under the Securities and Futures Ordinance (Cap. 571) (“SFO”) for Type 1 and Type 7 regulated activities) are also now available on the SFC’s licensing forms website.[13]  Licensing forms will need to be submitted to the SFC electronically through the WINGS platform.

Some of the key aspects of the regulatory requirements highlighted in the Consultation Conclusions

Licensing requirement

The SFC has reiterated that Platform Operators should, as a matter of prudence, apply for approvals under both the existing SFC licensing regime and the AMLO licensing regime[14] to ensure business continuity, given that a VA’s classification may change from security to non-security, or vice versa. The SFC rejected the propositions that Platform Operators under the AMLO regime can withdraw a particular token which evolves into a security token and simply allow the client to sell down the token, as this will not be in the client’s best interests.  This stance suggests that applicants seeking an AMLO only licence should expect to face tough questions from the SFC as to their rationale for not also seeking a licence under the SFC’s existing licence regime.

The SFC has also stated that the AMLO regime will cover VA trading platforms which are centralised and function in a manner similar to the types of automated trading venues licensed under the SFO – i.e., they use automated trading engines which match client orders and provide custody services as an ancillary service to their trading services. Given this, the SFC has also clarified that the scope of the AMLO regime does not include over-the-counter VA trading activities and VA brokerage activities, as these do not involve providing VA services with an automated trading engine and ancillary custody services.

Retail access and onboarding requirements

Platform Operators will be allowed to provide their services to retail investors provided that they comply with a range of robust investor protection measures covering onboarding, governance, disclosure and token diligence and admission, before providing services to retail investors.

The SFC notes that it is crucial for retail investors to understand the features and risks of investing in VAs, as well as the potential losses.  As such, the SFC will require Platform Operators to conduct the full scope of the onboarding requirements, including assessing the investor’s risk tolerance, conducting an holistic assessment of the investor’s understanding of the nature and risks of VAs, etc.  The assessment made during the onboarding process will also be relevant in order to comply with the suitability requirements.

It is relevant to note that Platform Operators will be required to comply with the full scope of the onboarding requirements, even if the retail client is knowledgeable about VAs (e.g. as a result of trading VAs for a number of years) or the client is an individual professional investor.  These requirements are broadly consistent with the regulatory requirements applied to traditional licensed corporations more generally.

The SFC has also now issued FAQs providing further guidance on onboarding requirements, including matters such as how to assess an investor’s knowledge of VAs and risk tolerance levels.[15]


A Platform Operator will be required to set up a token admission and review committee that consists of senior management who are principally responsible for managing the Platform Operator’s key business line, compliance, risk management, and information technology functions (i.e., at a minimum the Manager in Charge (MICs) for these functions).

The SFC has also now issued FAQs to augment the accountability of the senior management of Platform Operators through the imposition of a Manager in Charge regime for Platform Operators, which the SFC acknowledges is ‘substantially the same’ as that applicable to licensed corporations.[16]


The SFC notes that, although it understands the potential challenges of obtaining and verifying information provided by the issuer of a VA, it will still expect a Platform Operator to conduct due diligence on each virtual asset prior to admission for trading. As such, the Platform Operator is expected to obtain information for each VA which it can be reasonably satisfied is reliable and sufficient to base its token admission decision on. Accordingly, the SFC will require Platform Operators to take all reasonable steps to ensure that product specific information that they disclose is not false, biased, misleading or deceptive.

The SFC has set out in the VATP Guidelines the minimum information that Platform Operators are required to disclose with regards to the risk disclosure statements, disclosures regarding the platform’s operations, and VA-specific disclosures.

Token admission

Similar to the SFC’s product due diligence requirements applicable to licensed corporations in respect of traditional financial products, the SFC will require a Platform Operator to  conduct due diligence on each VA it plans to admit for trading on its platform to ensure that the VA complies with the admission criteria established by the token admission and review committee.

These due diligence requirements apply even if the VAs are not intended to be made available to retail investors, although there will likely be material differences in the admission criteria applicable to VAs that are or are not available for trading by retail investors. Furthermore, there is no exemption from conducting due diligence even if the VA in question has already been admitted for trading on another licensed VATP.

Relevantly, the SFC has decided that it will not relax the requirement for a non-security token to have at least a 12-month track record (as it is one of the factors which the token admission and review committee must consider). The result is that a newly or recently launched VA with less than a 12-month track record cannot be admitted for trading by a Platform Operator, even if it is not available for trading by retail investors.

However, the SFC has relaxed one aspect of its token admission requirements, with Platform Operators no longer being required to submit to the SFC written legal advice confirming that each token made available for trading by retail clients would not amount to a security token. Nevertheless, Platform Operators will still need to take reasonable steps to ensure that security tokens are not made available for trading by retail clients, as this could be a breach of the prospectus regime under the Companies (Winding Up and Miscellaneous Provisions) Ordinance (Cap. 32).

The SFC has emphasised in the Consultation Conclusions the importance of having additional minimum criteria that need to be satisfied before a non-security token can be made available for trading by retail users. In this respect, the SFC has further tightened the eligible large-cap VA requirements to stipulate that at least one of the two acceptable indices must be issued by an independent index provider (that has experience publishing indices for conventional securities markets, and that is also compliant with the IOSCO Principles for Financial Benchmarks).

Furthermore, in addition to being independent of the Platform Operator, the two index providers will also need to be independent of the issuer of the VA.  Additionally, the SFC emphasised in the Consultation Conclusions that being included in two acceptable indices is merely the minimum criterion for admitting a VA for retail trading, and that Platform Operators will also need to ensure that tokens admitted satisfy the Platform Operator’s token admission criteria (and also ensure that such tokens have high liquidity for tokens available for retail trading).


The SFC has also clarified in the Consultation Conclusions that, prior to stablecoins being subject to regulation by the Hong Kong Monetary Authority (“HKMA”), Platform Operators should not admit stablecoins for retail trading.  The HKMA published the conclusions on its discussion paper on crypto-assets and stablecoins in January 2023, and the regulatory arrangements for stablecoins are expected to be implemented in 2023/24.  We previously published a client alert on this consultation.[17]

Insurance and compensation arrangements

The SFC will now require Platform Operators to have in place a compensation arrangement approved by the SFC to cover potential loss of 50% of client VAs in cold storage and 100% of client VAs in hot or other storage held by its custodian (see below for further discussion on custody arrangements). The SFC has also noted that the arrangement should be made up of the following:

  • Third-party insurance;
  • Funds (held in a demand deposit or time deposit with less than 6 months maturity) or VAs of the Platform Operator or any corporation within the same group as the Platform Operator which are set aside on trust and designated for such a purpose; and/or
  • A bank guarantee from an authorised financial institution in Hong Kong.

Custody and security requirements

In this aspect of the Consultation, the SFC had sought industry suggestions in relation to technical solutions that could mitigate risks associated with custody of client assets, particularly in hot storage.

However, the SFC’s response in the Consultation Conclusions focused on reiterating the SFC’s view that, given the importance of safe custody of VAs, the SFC will require what it terms a ‘direct regulatory handle’ over a firm exercising control of client VAs, and as such will require custody to be undertaken by a wholly-owned subsidiary of a Platform Operator. For the same reason, the SFC will require  all seeds and private keys holding customer VAs to be securely stored in Hong Kong, noting that if they were stored overseas, this would substantially hinder the SFC’s supervision and enforcement efforts.  As a result, the SFC has reiterated in the Consultation Conclusions that the use of third-party custodians will not be allowed.

The SFC also noted that it had received ‘many’ comments requesting that the SFC amend the requirement that 98% of client VAs must be stored in cold storage and only 2% could be stored in hot or other storage so to permit a lower cold to hot storage ratio to be adopted. However, the SFC has reiterated that it believes that this ratio should not be lowered and that the ‘bulk’ of client VAs should be held in cold storage given that it is generally free of hacking / other cybersecurity risks. Further, while many respondents had indicated that they believed that a lower cold to hot storage ratio was required in order to ensure more expedient asset withdrawals, the SFC appears to have had little sympathy for this position. Instead, the SFC has reminded Platform Operators of the requirement under the Guidelines for Platform Operators’ comprehensive trading and operational rules to cover withdrawal procedures, including the time required to transfer VAs to a client’s private wallet after receiving a withdrawal request on its website.

Virtual asset derivatives

This aspect of the Consultation had sought input in relation to business models that would be adopted by Platform Operators if allowed to provide trading services in VA derivatives and the types of investors that would be targeted.

The SFC noted in the Consultation Conclusions that respondents expressed general support for allowing Platform Operators to provide trading services in VA derivatives, and that the SFC understood the importance of VA derivatives to institutional investors. However, the revised Guidelines maintain the prohibition on Platform Operators offering trading or dealing in VA derivatives, with the SFC instead indicating in the Consultation Conclusions that it will conduct a separate review of this issue ‘in due course’.

Proprietary trading and other services

The SFC has noted that it received submissions suggesting that proprietary trading, including proprietary market making by a Platform Operator’s affiliates, should be allowed in order to enhance liquidity.

While maintaining the prohibition on proprietary trading, the SFC has amended the requirements in the Guidelines to allow trading by affiliates of a Platform Operator other than trading through the Platform Operator (regardless of whether such trading is on-platform or is off-platform). The SFC noted that this amendment has been made on the basis that the previous iteration of the draft Guidelines effectively prohibited group companies of a Platform Operator from having any positions in VAs.

The SFC also noted that it received a number of responses in relation to whether Platform Operators could provide other VA services such as earning, deposit-taking, lending or borrowing. The SFC’s position, however, is that allowing such services could create potential conflicts of interest for Platform Operators (and would require additional safeguards) and as such Platform Operators will not be permitted to conduct these activities ‘at this stage’.

The SFC has also clarified in the Consultation Conclusions that while Platform Operators are prohibited from providing algorithmic trading services to their clients, the platform’s clients can use their own algorithmic trading systems when trading on a licensed platform.

Disciplinary Fining Guidelines

The SFC has clarified that all Platform Operators will be subject to the same fining criteria[18] regardless of the regime under which the Platform Operator is licensed. In rejecting a submission proposing that fines should be determined with reference to the total annual turnover of the Platform Operator, the SFC has stated that it will continue to determine quantum based on the legislative requirement in the AMLO that a fine should not exceed the higher of HK$10 million or three times the profit gained or loss avoided. However, the SFC has also noted that it will closely monitor the implementation of the Fining Guidelines, and determine whether legislative change may be required.

In response to a comment, the SFC specifically noted that the fact that a particular type of conduct is widespread in unregulated entities would not be considered a mitigating factor for any misconduct by licensed Platform Operators.

In the context of submissions requesting greater clarity on factors relevant to the SFC’s decision to take enforcement action against Platform Operators and/or individuals, the SFC has stated that it will take a holistic approach to disciplinary action in order to ensure that all culpable parties are held accountable for their conduct. In this vein, the SFC has noted in the Consultation Conclusions that the VATP Guidelines already provide that senior management of a Platform Operator bear the primary responsibility for ensuring compliance with the rules and guidelines applicable to Platform Operators. Further, as noted above, the SFC has also issued an FAQ on the augmentation of the accountability of senior management for Platform Operators, which extends the SFC’s Manager in Charge regime to Platform Operators.[19]


[1]  “Consultation Paper on the Proposed Regulatory Requirements for Virtual Asset Trading Platform Operators Licensed by the Securities and Futures Commission”, published by the SFC (February 20, 2023), available at

[2]  “Hong Kong SFC Consults On Licensing Regime For Virtual Asset Trading Platform Operators”, published by Gibson, Dunn & Crutcher (March 2, 2023), available at

[3] “Consultation Conclusions on the Proposed Regulatory Requirements for Virtual Asset Trading Platform Operators Licensed by the Securities and Futures Commission”, published by the SFC (May 23, 2023), available at

[4] “Circular on transitional arrangements of the new licensing regime for virtual asset trading platforms” published by the SFC (May 31, 2023), available at:

[5] Published by the SFC on June 1, 2023, and available at:

[6] Published by the SFC on June 1, 2023, and available at:

[7] Published by the SFC on June 1, 2023, and available at:

[8] Published by the SFC on June 1, 2023, and available at:–SFC-Disciplinary-Fining-Guidelines-Eng.pdf?rev=9a355f946ff74c7892a921ab73461314&hash=0A14F0BC24C3854FB909953BEA90FC2A.

[9] Published by the SFC on June 1, 2023, and available at:

[10] Published by the SFC on May 31, 2023, available at:

[11] Published by the SFC on May 31, 2023, and available at:

[12] Published by the SFC on May 31, 2023, and available at:

[13] Available at:

[14] Licensing regime for Platform Operators under the Anti-Money Laundering Ordinance and Counter-Terrorist Financing Ordinance (Cap. 615).

[15] Published by the SFC on May 31, 2023 and available at:

[16] Published by the SFC on May 31, 2023, and available at:

[17] “Hong Kong Monetary Authority Introduces Plans To Regulate Stablecoins” published on February 7, 2023, and available at:

[18] Published by the SFC on June 1, 2023, and available at:–SFC-Disciplinary-Fining-Guidelines-Eng.pdf?rev=9a355f946ff74c7892a921ab73461314&hash=0A14F0BC24C3854FB909953BEA90FC2A.

[19] Published by the SFC on May 31, 2023, and available at:

The following Gibson Dunn lawyers prepared this client alert: Will Hallatt, Emily Rumble, Arnold Pun, Becky Chung, and Qingxiang Toh.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding these developments. If you wish to discuss any of the matters set out above, please contact any member of Gibson Dunn’s Digital Asset Taskforce or the Global Financial Regulatory team, including the following authors in Hong Kong and Singapore:

William R. Hallatt – Hong Kong (+852 2214 3836, [email protected])
Grace Chong – Singapore (+65 6507 3608, [email protected])
Emily Rumble – Hong Kong (+852 2214 3839, [email protected])
Arnold Pun – Hong Kong (+852 2214 3838, [email protected])
Becky Chung – Hong Kong (+852 2214 3837, [email protected])
Qingxiang Toh – Singapore (+65 6507 3610, [email protected])

© 2023 Gibson, Dunn & Crutcher LLP

Attorney Advertising:  The enclosed materials have been prepared for general informational purposes only and are not intended as legal advice. Please note, prior results do not guarantee a similar outcome.