Crypto Law Profile

Guidelines for Virtual Asset Trading Platform Operators (Hong Kong)

Hong Kong SFC guidance for licensed centralized virtual asset trading platform operators, covering conduct, financial resources, custody, token admission, market surveillance and cybersecurity controls.

Hong Kong Effective Agency guidance Jun 1, 2023

At a glance

Regulator Issued and administered by the Hong Kong Securities and Futures Commission.
Status Listed by the SFC as effective from 1 June 2023 and treated here as in force.
Scope Covers SFO and AMLO platform operators carrying on relevant VATP activities.
Core focus Conduct, custody, token admission, surveillance, financial soundness and cybersecurity.

Overview

The Guidelines for Virtual Asset Trading Platform Operators are Hong Kong Securities and Futures Commission guidance for centralized virtual asset trading platforms operating in Hong Kong or actively marketing to Hong Kong investors. As of 17 June 2026, the SFC lists the Guidelines as an operative code-and-guidelines instrument dated 1 June 2023, and they sit within the broader licensing framework under the Securities and Futures Ordinance and the Anti-Money Laundering and Counter-Terrorist Financing Ordinance.

The Guidelines are designed for platform operators licensed under the SFO and/or AMLO when they carry on relevant virtual asset trading platform activities. They should be read with the SFC’s licensing materials, virtual-asset AML/CFT guideline, FAQs, circulars, and later supervisory materials. This profile summarizes the instrument as a legal-reference entry and is not compliance advice.

Scope of the Hong Kong VATP Guidelines

The SFC states that centralized virtual asset trading platforms carrying on business in Hong Kong, or actively marketing services to Hong Kong investors, are required to be licensed and regulated by the SFC. The VATP page distinguishes the SFO regime for platforms dealing in security tokens from the AMLO regime for platforms dealing in non-security tokens, while noting that a token’s classification may change over time.

The Guidelines themselves state that they apply to all Platform Operators, whether licensed under the SFO and/or AMLO, when they carry on relevant activities. For dually licensed operators, the SFC expects compliance with the SFO, AMLO, SFC codes, guidelines, circulars and FAQs, with the more stringent requirement prevailing where requirements are inconsistent.

Key provisions for virtual asset trading platform operators

Licensing conduct and financial soundness

The Guidelines set conduct principles covering honesty and fairness, due skill and diligence, disclosure, client-asset safeguarding, proper records and senior-management responsibility. Platform operators are also expected to maintain liquid assets in Hong Kong equivalent to at least 12 months of operating expenses and paid-up share capital of not less than HK$5 million.

Token admission, retail access and client onboarding

A platform operator must establish a token admission and review committee, perform due diligence on virtual assets before admitting them to trading, and conduct ongoing monitoring. For retail trading, the Guidelines require additional safeguards, including high liquidity and, at minimum, inclusion in two acceptable indices issued by at least two different index providers unless the SFC considers a case-specific proposal. The client-facing provisions also address investor knowledge, know-your-client checks, risk tolerance, client agreements, risk disclosures and suitability obligations.

Custody, market integrity and cybersecurity

The custody provisions require client virtual assets to be safeguarded through an associated entity, segregated from the assets of the platform operator and associated entity, and generally held 98% in cold storage. The Guidelines also set expectations for private-key controls, wallet whitelisting, compensation arrangements, market surveillance, prohibitions on specified manipulative practices, restrictions on proprietary trading, cybersecurity governance, two-factor authentication and recordkeeping.

Status and transitional timeline

The SFC issued the implementation circular and transitional circular on 31 May 2023. The new AMLO licensing regime came into effect on 1 June 2023. Pre-existing non-security-token VATPs could rely on a non-contravention arrangement until 31 May 2024 if they met the stated conditions, and fully completed applications submitted by 29 February 2024 could qualify for a deeming arrangement from 1 June 2024 pending determination.

On 28 May 2024, the SFC reminded the public that the non-contravention period would end on 1 June 2024 and that all VATPs operating in Hong Kong must be licensed or deemed-to-be-licensed applicants. The SFC also stated that deemed applicants are not formally licensed and remain subject to the SFC’s supervisory, disciplinary and other applicable powers. Later SFC circulars and licensing-process updates should be checked alongside the Guidelines for the most current supervisory expectations.

Key provisions

SFO and AMLO scope

Applies to Platform Operators licensed under the SFO and/or AMLO when they carry on relevant virtual asset platform activities.

Licensing Jun 1, 2023 Source

Financial resources

Requires liquid assets in Hong Kong equal to at least 12 months of operating expenses and paid-up share capital of at least HK$5 million.

Financial soundness Jun 1, 2023 Source

Token admission review

Requires token admission criteria, due diligence, ongoing review and extra liquidity safeguards for virtual assets made available to retail clients.

Market perimeter Jun 1, 2023 Source

Client onboarding safeguards

Addresses investor knowledge, KYC, risk tolerance, client agreements, risk disclosure and suitability standards for non-professional clients.

Consumer protection Jun 1, 2023 Source

Custody of client assets

Requires client virtual assets to be segregated, held via an associated entity and generally kept 98% in cold storage with private-key controls.

Custody Jun 1, 2023 Source

Market abuse controls

Requires surveillance policies and controls to identify, prevent and report manipulative or abusive trading and restricts proprietary trading.

Market abuse Jun 1, 2023 Source

Cybersecurity and records

Sets expectations for platform security, access controls, client authentication, incident controls and records sufficient for audit and supervision.

Cybersecurity Jun 1, 2023 Source

Timeline

  1. Consultation paper issued

    SFC consulted on proposed regulatory requirements for VATP operators.

    Under consultation Source
  2. Consultation conclusions issued

    SFC published conclusions on proposed regulatory requirements for licensed VATP operators.

    Enacted Source
  3. Implementation circular issued

    SFC highlighted regulatory requirements, licensing materials and filing channels for the new regime.

    Enacted Source
  4. Guidelines effective

    SFC listed the VATP Guidelines as effective from 1 June 2023.

    In force Source
  5. Transitional filing deadline

    Pre-existing VATPs needed completed applications by this date to qualify for deeming.

    Enacted Source
  6. Non-contravention period ended

    All VATPs operating in Hong Kong had to be licensed or deemed-to-be-licensed applicants.

    In force Source

Who it affects

Actors

Securities and Futures Commission, Virtual asset trading platform operators

Asset classes

Non-security tokens, Security tokens, Virtual assets

Official sources

Editorial note

Profile covers the SFC Guidelines for Virtual Asset Trading Platform Operators as a standalone agency-guidance instrument. Parent statutory authority and related AMLO/SFO licensing requirements are summarized for context.