Resetting The Rules: Hong Kong's New Proposed Regulation For Virtual Assets

KEY TAKEAWAYS

• Regulators in Hong Kong i.e. the Financial Services and the Treasury Bureau (FSTB) and the Securities and Futures Commission (SFC) have released consultation papers proposing a new licensing regime for virtual asset dealing and custody. The goal is to close existing regulatory gaps (e.g., OTC trading, non-exchange-based custody) and reinforce Hong Kong's positioning as a leading global hub for digital assets.
• Under the proposals, any entity conducting VA dealing or custody "by way of business" will be required to obtain a licence. Applicants must meet strict fit‑and‑proper requirements, local incorporation/operational presence criteria, and demonstrate robust governance and compliance frameworks.
• The proposed VA custody framework prioritises entities that hold or control client private keys. It imposes stringent requirements around safekeeping, cyber‑resilience, segregation of client assets, and independent external assessments in higher‑risk situations (e.g., custodians holding private keys).
• Licensed VA dealers and custodians would face significant financial resource requirements, governance obligations, AML/CFT compliance duties, and investor protection standards. The regime will be supported by strong enforcement powers and penalties. Notably, there is no grandfathering of existing businesses — all pre-existing entities must apply afresh.
• Stakeholders are encouraged to provide feedback during the consultation period (closing 29 August 2025) and to engage early with regulators. Early participation will help firms navigate the transition, align operations, and potentially secure a first-mover advantage under the new regime.

INTRODUCTION

Hong Kong is taking decisive steps to establish itself as a global hub for virtual assets ("VAs"), with new proposals for comprehensive regulation of virtual asset ("VA") dealing¹ and custody services.² On 26 June 2025, the Financial Services and the Treasury Bureau ("FSTB") and the Securities and Futures Commission ("SFC") jointly issued two consultation papers covering:

• Consultation 25CP6: Regulation of virtual asset over-the-counter (OTC) trading (dealing)
• Consultation 25CP7: (Regulation of virtual asset custody services

This marks the latest development in a policy journey that began with the policy statement published by the FTSB on October 31, 2022, which articulated the "same activity, same risks, same regulation" principle, underscoring the regulator's intent to harmonise digital and traditional finance.³ This statement was echoed in a second statement published on 20 June 2025, immediately preceding the publication of the consultations.⁴

Parallelly, the SFC seeks to license and regulate virtual asset trading platforms ("VATPs") under the Securities and Futures Ordinance ("SFO") and the Anti-Money Laundering and Counter-Terrorist Financing Ordinance ("AMLO"). Since the introduction of the licensing regime in June 2023, 11 VATPs have received licences and are currently operational under SFO & AMLO.⁵ As of August 2025, the SFC's official registry shows 11 licensed VATPs.

Yet, major regulatory gaps remain in areas such as over-the-counter ("OTC") trading, custody services, and other non-exchange-based VA activities. As the 2023 VATP regime only covered platforms (exchanges). The current proposals aim to close these gaps through a broader, ecosystem-wide licensing framework. This article analyses the proposed regimes and explores the challenges and implications of their implementation.

VIRTUAL ASSET DEALING REGULATION

The first of the two consultation papers proposes a licensing regime for VA dealing. This is the second such consultation; the previous one, released by the FSTB on February 8, 2024, focused solely on VA OTC trading services (retail shops, kiosks, and online OTC brokers).⁶ The new consultation (ref: 25CP6) supersedes and broadens the scope beyond OTC, as it frames the licensing test around whether a person "carries on a business" in VA dealing.⁷ This includes both direct dealings and structured arrangement that generate returns.

Specifically, a license would be required if an entity makes, offers, or induces agreements related to:

• the acquisition, disposal, subscription, or underwriting of virtual assets;
• the facilitation of profit generation through yield-bearing products or volatility exposure;
• services such as brokerage, block trading, investment advisory, or asset management; or
• conversions between VAs or between VAs and fiat currencies, whether conducted physically, digitally or through hybrid models.⁸

Notably, non-commercial, direct P2P transactions without intermediaries are outside scope. However, platforms that actively facilitate P2P trades (even if claiming "non-custodial") may still fall within scope depending on their role.⁹ Additionally, stablecoin issuers who are licensed by the and offer stablecoins they issue in the primary market, are exempt as well. However, for secondary market activities or distribution of third-party stablecoins still require licensing.¹⁰

The proposed licence would cover a broad set of activities, bringing OTC brokers, investment advisors, asset managers, and block traders under regulatory oversight. These licensees may serve both institutional and retail clients. That said, for retail clients, licensees would be expected to restrict their token offering to highly liquid VAs (i.e. Only large-cap liquid VAs that reflect SFC's existing VATP token admission criteria) and stablecoins issued by entities licensed by the HKMA (in line with Hong Kong's separate Stablecoin Regulatory Regime effective 2024/2025). These offerings must be subject to stringent due diligence and risk assessments, in line with standards imposed on licensed VATPs.¹¹

Licensed VA dealers would also be permitted to transact with trading platforms regulated overseas, provided that they implement robust investor protection measures and conduct strict counterparty due diligence.¹² Furthermore, to ensure operational transparency and safeguard client interests, all client assets must be held with SFC-licensed or registered VA custodians in Hong Kong,¹³ ensuring proper asset segregation and oversight.

VIRTUAL ASSET CUSTODY REGULATION

Under the proposed framework, entities offering VA custody services "by way of business" will be required to obtain a license, which covers both the safekeeping of digital tokens themselves and the safekeeping of instruments that allow transfers (such as private keys, seed phrases, hardware signing modules).¹⁴ This deliberately broad scope is intended to cover "key holding" as the functional core of custody. The breadth of this definition would determine whether incidental custody, i.e. where safekeeping arises as part of a licensed VA dealing services, would be covered under the licensing requirement. The framework proposes limited exemptions for regulated entities where the custody of VAs is merely incidental to the principal business of the entity, which is another regulated activity (e.g., a VA dealer holding client assets while settling a trade, then the dealer itself will not require a separate custody licence).¹⁵

A license would be required for the following entities:

• Associated entities of SFC-licensed VATPs that safeguard client keys;
• Authorised institutions (banks), their subsidiaries, or stored value facility ("SVF") licensees, if they custody client keys as part of dealing services or fund administration (i.e., not merely incidental); and
• Fund managers, if they run self-custody arrangements of VA assets in their own funds.¹⁶

However, some entities such as brokers, fund managers, or stablecoin issuers may be exempt from the licensing requirement if:

• they are already regulated by the SFC/HKMA under the SFO/Banking Ordinance (e.g., an SFC-regulated broker whose custody is ancillary to brokerage dealing).
• custody is incidental to their main regulated activity; and
• they don't hold private keys (or similar instruments) for clients. For example, bank vaults that store encrypted back-ups of private keys or technical service providers that support the provision of custody services may fall outside the licensing scope.¹⁷

Stablecoin issuers licensed by the HKMA will be exempt with respect to custody services they carry on for the stablecoins they issue, as they are already subject to the HKMA's oversight.¹⁸ The regulatory framework also proposes that licensed VA custodians may offer ancillary services (including staking) if the HKMA approve them and sufficient controls are in place. Additional investor protection safeguards will also be required to be implemented (e.g., segregation of staked vs. unstaked assets, transparency in validator selection, clear risk disclosure).¹⁹

GENERAL REQUIREMENTS

The SFC will license and supervise VA dealing and VA custodian service providers, while the HKMA will act as the frontline regulator for banks and SVF licensees, supervising their custody-related activities.²⁰ VA custodians which are subsidiaries of locally incorporated banks will be remain under the oversight of the SFC.

Incorporation and Fit & Proper

License applicants must be incorporated or registered in Hong Kong, with local premises within Hong Kong for the storage of books and records.²¹ The licence applicant must also satisfy "fit-and-proper" requirements applicable to directors, significant shareholders, and key personnel.²²

Governance

Licensed entities must have a substantial operational presence in Hong Kong, supported by robust internal controls and risk management systems. Each firm must appoint at least two responsible officers approved by the SFC or the HKMA, as the case may be.²³ Individuals performing regulated functions would be subject to licensing requirements under the SFO or the AMLO.²⁴ These requirements aim to ensure accountability and uphold market integrity.

AML/CFT Obligations

The proposed regime enforces strict adherence to all anti-money laundering ("AML") and counter-terrorist financing ("CFT") requirements for licensed VA entities. Licensed entities must comply with Schedule 2 of the AMLO, covering customer due diligence, transaction monitoring, and record-keeping, along with all other applicable provisions related to AML/CFT.²⁵ Robust risk management policies would be mandated, addressing cyber-resilience, private key security, business continuity, and independent audits.²⁶ To further protect investors, licensees will be mandated to conduct suitability assessments, manage conflicts of interest, ensure clear and transparent disclosures, and undergo regular compliance audits, forming a comprehensive framework that safeguards both market integrity and client interests.²⁷

Financial Resource Requirements

The table below sets out the minimum financial thresholds proposed under the regime.

LICENSE FEES

The following fees are proposed for applicants under the new virtual asset regulatory regimes.

TRANSITIONAL REGIME

The proposed transitional regime takes a clean-slate approach, with no automatic grandfathering of existing businesses. All pre-existing entities must submit fresh license applications, though expedited processing may be available for those previously assessed by the SFC or HKMA.³² VA custodians holding private keys face added scrutiny, including mandatory independent external assessments before approval.³³ To reduce disruption, the regulators are encouraging early pre-application engagement to help firms align operations and documentation ahead of enforcement deadlines.

ENFORCEMENT, SANCTIONS, AND APPEALS:

The proposed regime includes a strict enforcement framework aimed at deterring misconduct and underscoring the seriousness of regulatory compliance. Unauthorised activity, AML/CFT breaches, and deceptive conduct are all met with significant penalties.

Key penalties include:³⁴

• Conducting or marketing regulated activities without a license: up to HK$5 million in fines and/or seven years' imprisonment.
• Breaches of AML/CFT obligations: fines of up to HK$1 million and/or two years' imprisonment.
• Fraud or misrepresentation: penalties of up to HK$10 million and/or ten years' imprisonment.
• Advertising unlicensed services: fines of HK$50,000 and/or six months' imprisonment.

CONCLUSION

With the consultation period open until 29 August 2025 and legislative proposals expected to follow soon after, Hong Kong is entering a decisive phase in its strategy to become a premier global hub for digital assets. The proposed frameworks for VA dealing and custody aim to close outstanding regulatory gaps, raise market standards, and strengthen investor protection. For industry participants, early engagement with regulators and timely preparation for licensing will be critical to ensuring a smooth transition. Proactive applicants may also benefit from a strategic first‑mover advantage, establishing regulatory credibility, strengthening client trust, and positioning themselves competitively in both local and cross‑border markets. While compliance will inevitably increase operational and cost burdens, the implementation of these regimes is expected to deliver significant long‑term benefits, including greater investor confidence, institutional readiness, and alignment with international regulatory best practices.

Footnotes

1 Available at: https://apps.sfc.hk/edistributionWeb/api/consultation/openFile?lang=EN&refNo=25CP6.

2 Available at: https://apps.sfc.hk/edistributionWeb/api/consultation/openFile?lang=EN&refNo=25CP7.

3 Financial Services and the Treasury Bureau, Policy Statement on Development of Virtual Assets in Hong Kong, (Oct. 31, 2022), https://gia.info.gov.hk/general/202210/31/P2022103000454_404805_1_1667173469522.pdf.

4 Financial Services and the Treasury Bureau, Policy Statement 2.0 on Development of Virtual Assets in Hong Kong, 20 June 2025, https://gia.info.gov.hk/general/202506/26/P2025062600269_500089_1_1750909574183.pdf.

5 Securities and Futures Commission, Lists of Virtual Asset Trading Platforms, https://www.sfc.hk/en/Welcome-to-the-Fintech-Contact-Point/Virtual-assets/Virtual-asset-trading-platforms-operators/Lists-of-virtual-asset-trading-platforms.

6 Financial Services and the Treasury Bureau, Public Consultation on Legislative Proposals to Regulate Over-the-Counter Trading of Virtual Assets, https://www.fstb.gov.hk/fsb/en/publication/consult/doc/VAOTC_consultation_paper_en.pdf.

7 Paragraph 2.8 of Draft Regulation for Virtual Asset Dealing Services Providers.

8 Paragraph 2.9 of Draft Regulation for Virtual Asset Dealing Services Providers.

9 Paragraph 2.10 of Draft Regulation for Virtual Asset Dealing Services Providers.

10 Paragraph 1.10 of Draft Regulation for Virtual Asset Dealing Services Providers.

11 Paragraph 2.19 of Draft Regulation for Virtual Asset Dealing Services Providers.

12 Paragraph 2.22 of Draft Regulation for Virtual Asset Dealing Services Providers.

13 Paragraph 2.23 of Draft Regulation for Virtual Asset Dealing Services Providers.

14 Paragraph 2.16 of Draft Regulation for Virtual Asset Custodian Services Providers.

15 Paragraph 2.19 of Draft Regulation for Virtual Asset Custodian Services Providers.

16 Paragraph 2.21 of Draft Regulation for Virtual Asset Custodian Services Providers.

17 Paragraphs 2.17 to 2.18 of Draft Regulation for Virtual Asset Custodian Services Providers.

18 Ibid.

19 Paragraph 2.30 of Draft Regulation for Virtual Asset Custodian Services Providers.

20 Paragraphs 2.34 to 2.36 of Draft Regulation for Virtual Asset Dealing Services Providers and Paragraph 2.12 of Draft Regulation for Virtual Asset Custodian Services Providers.

21 Paragraph 2.14 of Draft Regulation for Virtual Asset Dealing Services Providers.

22 Paragraph 2.15 of Draft Regulation for Virtual Asset Dealing Services Providers.

23 Paragraph 2.16 of Draft Regulation for Virtual Asset Dealing Services Providers and Paragraph 2.26 of Draft Regulation for Virtual Asset Custodian Services Providers.

24 Paragraph 2.15 of Draft Regulation for Virtual Asset Dealing Services Providers and Paragraph 2.31 of Draft Regulation for Virtual Asset Custodian Services Providers

25 Paragraph 2.24 of Draft Regulation for Virtual Asset Dealing Services Providers and Paragraph 2.12(c) of Draft Regulation for Virtual Asset Custodian Services Providers

26 Paragraph 2.25(c) of Draft Regulation for Virtual Asset Dealing Services Providers and Paragraphs 2.38 and 2.39 of Draft Regulation for Virtual Asset Custodian Services Providers

27 Paragraph 2.39 of Draft Regulation for Virtual Asset Custodian Services Providers and Paragraph 2.24 of Draft Regulation for Virtual Asset Dealing Services Providers.

28 Paragraph 2.25 of Draft Regulation for Virtual Asset Dealing Services Providers.

29 Paragraph 2.39 of Draft Regulation for Virtual Asset Custodian Services Providers.

30 Paragraph 2.32 of Draft Regulation for Virtual Asset Dealing Services Providers.

31 Paragraph 2.44 of Draft Regulation for Virtual Asset Custodian Services Providers.

32 Paragraph 2.41 of Draft Regulation for Virtual Asset Custodian Services Providers and Paragraph 2.29 of Draft Regulation for Virtual Asset Dealing Services Providers.

33 Paragraph 2.42 of Draft Regulation for Virtual Asset Custodian Services Providers.

34 Paragraph 2.39 of Draft Regulation for Virtual Asset Custodian Services Providers and Paragraph 2.51 of Draft Regulation for Virtual Asset Dealing Services Providers.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.