🇭🇰Hong Kong: the new virtual-asset dealing and custody licences

Concept

Hong Kong is creating two new licences for the virtual asset (VA) market: one for dealing — from VA conversions to brokerage and block trades for clients — and one for safekeeping clients' VAs. Both are to be introduced as amendments to the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO, Cap. 615) and granted by the Securities and Futures Commission (SFC). The policy was settled by the consultation conclusions published by the Financial Services and the Treasury Bureau (FSTB) and the SFC on 24 December 2025.

As at 29 September 2026 there is no statute yet. According to the Supplement to the 2026 Policy Address of 16 September 2026, the bill is being drafted and is expected to be introduced into the Legislative Council (LegCo) in the fourth quarter of 2026. No commencement date has been set, and there will be no deeming arrangement treating existing operators as licensed. The same bill will create licences for VA advisory and VA management services, whose consultation conclusions were published on 26 May 2026.

What sets the model apart

Three features determine who will need the new licences and why.

Why a new regime is needed

Today the AMLO licenses virtual asset trading platforms (VATPs): that regime has operated since June 2023, and the SFC's list showed 13 licensed platforms on 29 September 2026. Dealers and custodians operating outside platforms have no VA licence of their own: SFC intermediaries deal in VAs under additional conditions attached to their licences under the Securities and Futures Ordinance (SFO, Cap. 571), banks under the requirements of the Hong Kong Monetary Authority (HKMA), and some operators remain unregulated.

A 2024 proposal would have placed over-the-counter (OTC) VA trading under a licence from the Commissioner of Customs and Excise, but the Government's Policy Statement 2.0 on digital assets of 26 June 2025 made the SFC the leading authority for both future regimes.

Under the AMLO, "virtual asset" expressly excludes securities and futures contracts, so tokenised securities stay under the SFO. The AMLO already prohibits carrying on, or holding oneself out as carrying on, a business of providing a VA service without a licence for it (s.53ZRD); the reform adds dealing and custody to the list of VA services (custody conclusions, para 5).

The table compares the two regimes; the figures come from the consultation conclusions and papers, and the bill will fix the final values.

The custodian's paid-up capital floor, modelled on Type 13 depositaries under the SFO, is twice the dealer's. Senior people requirements are the same in both regimes, but for a custodian licensing also reaches the whole chain of access to keys.

From consultation to bill

The regimes have gone through three rounds of public consultation since 2024; the next step is the bill.

As at 29 September 2026 the bill had been neither published nor introduced: the LegCo list of bills for the 2026 session has no AMLO amendment, and the last first reading took place on 15 July 2026. The Financial Affairs Panel's position is recorded in its minutes of 1 June 2026, the Government's in its reply to LCQ11 of 24 June 2026.

What the status means

Every requirement below is a position of the consultation conclusions or a consultation-paper proposal they left unchanged; tables mark the stage where it matters. The SFC will issue codes and guidelines once the legislation is complete (FSTB and SFC paper to the LegCo Panel, para 23); none had been consulted on by 29 September 2026.

The dealing licence

The dealing regime is modelled on Type 1 (dealing in securities) under the SFO, but its perimeter is wider than the SFC's current conditions: it will reach unregulated operators and the trading platforms themselves.

A Type 1 perimeter

Following the consultation, VA dealing will cover any person who, by way of business, makes or offers to make an agreement, or induces or attempts to induce another person to enter into one, with a view to acquiring, disposing of, subscribing for or underwriting VAs (dealing conclusions, para 3).

The consultation materials and conclusions map the perimeter by type of service (press release of 27 June 2025; conclusions, paras 4–7).

The second limb of the original definition — agreements to profit from the yield of VAs or from fluctuations in their value — was dropped to avoid licensing derivatives twice (para 5). Staking and VA borrowing and lending were left open alongside margin trading (para 7).

Under the current terms and conditions, the SFC has since 11 February 2026 allowed VA brokers that already provide securities margin financing to extend credit to those margin clients for VA dealing, accepting only bitcoin and ether as VA collateral with a haircut of at least 60% (SFC circular 26EC5). On 27 May 2026 the HKMA applied similar standards to banks (HKMA circular).

Who must be licensed

Of the groups the consultation paper expects to obtain a dealing licence or registration, three remain in the dealing regime (para 2.12).

• Existing SFC-licensed or registered intermediaries that already deal in VAs for clients under conditions attached to their licences.
• SFC-licensed trading platforms, whether or not they engage in off-platform transactions.
• Unregulated dealers, including OTC desks and physical exchange outlets.

The first two will have an expedited approval process; the fourth group in the paper, VA fund managers, was later moved to the separate VA management regime.

A money service operator (MSO) licence from the Customs and Excise Department (C&ED) covers only a money changing service or a remittance service, and the C&ED licensing guide for MSOs (May 2026 edition) does not mention virtual assets. Converting VAs into fiat or other VAs falls within dealing, so once the regime commences an OTC desk holding an MSO licence will also need a VA dealing licence or registration. The MSO regime itself is covered in the article on the MSO licence in Hong Kong.

Exemptions

The list of exemptions is not closed: some items are settled, others only under consideration.

Until the bill is published, the exemptions in the last row remain proposals (dealing conclusions, paras 10–11; advisory and management conclusions, paras 38–39). The stablecoin issuer regime is covered in the article on the Stablecoins Ordinance and the HKMA issuer licence.

Requirements for dealers

Dealer requirements follow the Type 1 model; the last column shows which are settled in the conclusions and which remain proposals of the June 2025 consultation paper.

Responsible officers (ROs) are individuals approved by the SFC to supervise the regulated business; the two-RO rule is taken from the SFO and the platform regime. Liquid capital depends on the business model, and the 12-month operating-expense buffer, which the consultation paper proposed as a standing requirement, became a discretionary power of the SFC in the conclusions (dealing conclusions, para 29).

The hardest constraint is custody: citing enforceability, regulatory oversight and investor protection, the SFC will not accept overseas-regulated custodians, at least while the regime is new (para 26). Whether a dealer may source liquidity from platforms or providers without an SFC licence was left open; as a first step, the SFC has let licensed platforms share an order book with intra-group liquidity and is reviewing its requirements for VA service providers (paras 17–18).

The custodian licence: the private-key test

The custody regime turns on one question: who controls the instrument that moves clients' VAs. A licence will be required by whoever safekeeps such an instrument for any person — in practice private keys or similar instruments (custody conclusions, paras 6–7); the decisive feature is the ability to move the assets.

Who needs a licence

The conclusions work through the common custody models; the outcomes are summarised below (paras 8–16, 32).

The territorial test is where the service is run: from Hong Kong, a licence will be needed even if every client is overseas. A licensed custodian may use its group's overseas infrastructure if it keeps the ability to move client assets independently and unilaterally.

Who will need a separate licence

The conclusions name those that safekeep keys today and will need a separate custodian licence or registration (para 35).

• Associated entities of licensed platforms that safekeep clients' keys and wish to continue doing so.
• Type 13 licensees under the SFO, banks, subsidiaries of locally incorporated banks and SVF licensees, where they safekeep keys themselves.
• Fund managers that self-custody their funds' VAs.

The HKMA expects SVF licensees to provide dealing and custody only in specified stablecoins issued by licensed stablecoin issuers, and no VA advisory or management services (FSTB and SFC paper to the LegCo Panel, footnote 2). Under the consultation paper, a custodian that also wants to convert VAs or trade them spot would need a dealing licence or a separate entity for that service (custody consultation paper, para 2.29).

Exemptions

An HKMA-licensed stablecoin issuer under the Stablecoins Ordinance (Cap. 656) that holds in custody only the stablecoins it issues will be exempt from the custodian licence, even though it safekeeps private keys (custody conclusions, para 34). The Government intends to add two further exemptions (paper to the LegCo Panel, para 16).

• Companies that hold VAs in custody for their group companies.
• Lawyers and accountants whose VA custody is wholly incidental to their professional practice, such as holding back-ups of clients' private keys or administering assets by court appointment.

For fund managers, the May 2026 conclusions announced no numerical self-custody threshold. Where no qualified custodian supports a token, the SFC will prescribe self-custody requirements for that VA; where the custody amounts to a business, a custodian licence will be needed (advisory and management conclusions, para 57).

Requirements for custodians

Custodians will face stricter requirements than dealers on capital and on who must be licensed.

The custody chain is drawn widely: senior management, anyone with direct access to private keys or authority to initiate or approve transfers, participants in multi-signature or threshold signing, and staff with access to key generation, storage or recovery. Group staff performing these functions are accredited to the licensed custodian; clerical staff and internal corporate functions — HR, finance, legal and compliance — fall outside (custody conclusions, paras 23–27).

The SFC will build its rules on Chapter X of the Guidelines for VATP Operators on custody of client assets, as elaborated in circular 25EC44. The circular requires at least one RO or manager-in-charge to oversee custody, the generation and safeguarding of seeds and private keys on air-gapped cold-wallet devices, and whitelist controls against transfers to unapproved addresses; the SFC stated that these standards will also be core expectations for custodians.

The SFC proposes to let custodians offer staking with robust safeguards similar to its guidance for platforms, and is reviewing its policy on third-party transfers. It will not restrict which VAs a custodian may hold, but will require robust token due diligence (paras 37, 40).

Trust, cold storage and compensation

Three parameters that decide how a client fares if a custodian fails are not yet fixed for the new regime; the platform rules and the HKMA's bank requirements of 27 May 2026 serve as benchmarks.

The platform rules sit in paras 10.1, 10.6 and 10.22 of the Guidelines for VATP Operators. For custodians, the SFC will explore a dynamic approach to custody technologies and storage ratios, and compensation and insurance will be the subject of a separate consultation; whether a standalone custodian will owe an express duty to hold assets on trust was not decided (custody conclusions, paras 38, 43–44; custody consultation paper, para 2.39).

Banks already have their rules: on 27 May 2026 the HKMA issued updated guidance on custody of digital assets, including VAs, by banks and subsidiaries of locally incorporated banks, replacing its circular of 20 February 2024 (HKMA circular). A bank may delegate VA custody only to another bank or such a subsidiary, an SFC-licensed platform, or an HKMA-licensed stablecoin issuer for that issuer's own stablecoins (annex, paras 11 and 14). For a non-bank custodian, capital and fees are known from the conclusions, while insurance and compensation costs will remain unknown until the SFC consults.

SFC and HKMA: who supervises whom

There are two regulators, and their roles depend on the type of applicant. The SFC sets the requirements for both regimes and supervises licensees directly; the HKMA is the frontline regulator for banks and SVF licensees registered to provide dealing or custody (press release of 27 June 2025; custody consultation paper, para 2.12).

Only banks will be able to register with the SFC for VA advisory and management services; the HKMA does not expect stablecoin issuers or SVF licensees to provide them. The Government will amend the Banking Ordinance (Cap. 155) and the Payment Systems and Stored Value Facilities Ordinance (Cap. 584) as needed; the SVF regime is covered in the article on the SVF licence in Hong Kong.

Commencement without deeming

The Government and the SFC have decided against a deeming arrangement that would treat existing dealers and custodians as licensed pending their applications: in the FSTB and SFC's view, it could create confusion over regulatory status and may not be optimal for investor protection. Each regime will take full effect on the commencement date of the statutory provisions, which will be chosen allowing time for market participants to adjust their business models (dealing conclusions, paras 31–32; custody, paras 48–49).

The regulators describe the route to a licence in three stages.

1. Pre-application to the SFC or the HKMA: the regulator walks the applicant through the licensing or registration process.
2. For a custodian, an external assessment of policies, procedures, systems and controls after the systems are deployed, with the SFC party to the engagement.
3. A licence or registration by the commencement date; from that date the business cannot be carried on without one.

Expedited approval will be available to SFC-licensed platforms and to licensed corporations and registered institutions already providing VA dealing. For custody, the expedited route covers platform associated entities, banks and bank subsidiaries that have already been assessed by the SFC or the HKMA and are already providing such services (paras 35–36; custody, para 51).

For existing SFC intermediaries this means a fresh application: the dealing, advisory and management regimes will replace the conditions now attached to their SFO licences (advisory and management conclusions, para 62), and expedited approval only shortens that route.

Marketing, sanctions and appeals

Once the regimes commence, no one — in Hong Kong or elsewhere — will be allowed to actively market VA dealing services to the Hong Kong public unless licensed by or registered with the SFC; the same prohibition is to apply to custody, advisory and management services. The SFC will issue guidance on what "actively market" covers (dealing conclusions, paras 40–41).

The proposed sanctions mirror the platform regime, and the conclusions confirmed the proposal will be taken forward. The consultation papers and the paper to the LegCo Panel set out the following (dealing consultation paper, para 2.39; paper to the LegCo Panel, para 26).

Appeals against specified SFC or HKMA decisions under the new regimes will go to the existing Anti-Money Laundering and Counter-Terrorist Financing Review Tribunal established under the AMLO.

VA advisory and management

The same bill will introduce two further licences. The consultation on them ran from 24 December 2025 to 23 January 2026 and drew 51 submissions; under the conclusions of 26 May 2026, VA advisory is aligned with SFO Type 4 (advising on securities) and VA management with Type 9 (asset management) (press release of 26 May 2026). The types themselves and the current VA conditions are covered in the companion article on SFC licensing in Hong Kong (Types 1, 2, 4 and 9 and responsible officers).

The four regimes can be compared along three axes: their SFO model, their capital and where client assets sit.

Where a firm holds several licences, the highest capital requirement will apply, and matching SFO and VA licences will not double the capital (advisory and management conclusions, paras 25–26, 48–49). The management regime will have no de minimis threshold: Type 9 managers whose portfolios hold VAs below today's 10% trigger will also need a VA management licence (para 51). A manager dealing in VAs solely for its mandate will need no separate dealing licence (para 38), and private funds, unlike dealers, will be able to keep VAs with qualified custodians anywhere in the world (paras 56–57).

Place among existing regimes

The table shows which existing Hong Kong regime each new licence complements and where the boundary runs.

The boundary follows the service, so one company may need several authorisations at once. The crypto licence map compares the platform regime with other crypto regimes, and the profile of HashKey Group shows a Hong Kong group with a licensed platform. The European licence for the same services is the MiCA CASP licence; Hong Kong companies and licences generally are covered in the hub “Hong Kong: Companies, Residency, Banking and Licences”.

Risks and open questions

The main risk is the hard commencement date without deeming. The second is dealers' dependence on SFC-regulated custodians: while overseas custodians are excluded, a dealer holding client VAs relies entirely on the Hong Kong custody market. The third is six questions the conclusions left open, which will shape the economics of both regimes.

• Whether dealers may offer margin trading, staking and VA lending.
• Whether dealers may source liquidity from providers without an SFC licence.
• Whether a custodian will owe an express duty to hold assets on trust.
• What share of assets a custodian must keep in cold storage.
• What compensation and insurance requirements custodians will face.
• Which exemptions from the dealing regime make it into the statute.

Groups with a licensed platform are affected twice: an associated entity that safekeeps clients' keys today and wishes to continue will need its own custodian licence with HK$10 million of paid-up capital, and the platform itself a dealing licence.