Crypto Law Profile

Hong Kong SFC AML/CFT Guideline for Licensed Corporations and VASPs

SFC AML/CFT guidance for licensed corporations and SFC-licensed VASPs, covering risk-based controls, CDD, monitoring, suspicious reporting, records, training, virtual asset risks and Travel Rule requirements.

Hong Kong Effective Agency guidance Jun 1, 2023

At a glance

Status In force since 1 Jun. 2023; immediate Travel Rule information submission phased in on 1 Jan. 2024.
Regulator Issued by Hong Kong’s SFC for licensed corporations and SFC-licensed VASPs.
Legal basis Published under AMLO ss. 7 and 53ZTK and SFO s. 399; enforced through AMLO and SFO processes.
Coverage Covers AML/CFT systems, CDD, monitoring, STRs, records, training, VA risks and transfer controls.

Overview

The SFC AML/CFT Guideline for licensed corporations and SFC-licensed virtual asset service providers is Hong Kong’s operative Securities and Futures Commission guidance on anti-money laundering and counter-financing of terrorism controls for securities-sector intermediaries and SFC-licensed VASPs. The guideline is issued under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) and the Securities and Futures Ordinance (Cap. 571). The current seventh edition is dated June 2023, with most revised requirements effective from 1 June 2023 and the immediate-submission element of the virtual asset Travel Rule effective from 1 January 2024.

Key provisions of the Hong Kong SFC AML/CFT Guideline

The guideline is designed to set out statutory and regulatory AML/CFT requirements and the standards that licensed corporations and SFC-licensed VASPs should meet. It covers risk-based AML/CFT systems, customer due diligence, ongoing monitoring, terrorist financing, sanctions and proliferation financing controls, suspicious transaction reports, record-keeping, staff training, wire transfers, third-party deposits and payments, and virtual asset-specific controls.

Scope and legal effect

The guideline applies to licensed corporations and virtual asset service providers licensed by the SFC under the AMLO. It does not operate as standalone criminal liability for every failure to comply, but the guideline is admissible in proceedings under the AMLO or SFO, and relevant provisions must be taken into account where applicable. The SFC may also consider failures to comply in disciplinary, misconduct, or fitness-and-properness assessments.

Risk-based AML/CFT systems

The guideline expects financial institutions to take reasonable measures to mitigate money laundering and terrorist financing risks and to implement AML/CFT systems commensurate with identified risks. Those systems include compliance management arrangements, independent audit, employee screening, ongoing training, senior management oversight, and the appointment of compliance and money laundering reporting officers.

Customer due diligence and monitoring

Chapter 4 addresses customer due diligence and how firms should determine the extent of measures under a risk-based approach. The 2023 amendments also aligned the guideline with legislative changes on politically exposed persons, trust beneficial ownership, and recognized digital identification systems. The SFC describes these amendments as linked to the Anti-Money Laundering and Counter-Terrorist Financing (Amendment) Ordinance 2022.

Virtual asset requirements and the Travel Rule

Chapter 12 is the central crypto-related component. It addresses money laundering and terrorist financing risks involving virtual assets, including risk assessments, virtual asset-specific CDD and ongoing monitoring, virtual asset transfers, and third-party deposits and payments made in virtual assets. For Chapter 12, virtual assets include virtual assets as defined in AMLO section 53ZRA and security tokens that constitute securities under the SFO.

The guideline treats virtual asset transfers as a distinct AML/CFT risk area. It requires ordering, intermediary, and beneficiary institutions to handle required originator and recipient information when a virtual asset transfer is conducted. The SFC describes the relevant transfer requirements as the Travel Rule, reflecting FATF Recommendation 16 adapted for virtual assets. Required information must be submitted securely, and from 1 January 2024 the relevant immediate-submission requirement applies before or when the virtual asset transfer is conducted.

Status and timeline

The SFC announced the revised AML/CFT guidelines on 24 May 2023, following consultation on proposed regulatory requirements for virtual asset trading platform operators. The Gazette notice was published on 25 May 2023 and stated that the AML/CFT Guideline would become effective on 1 June 2023, except for paragraphs 12.11.10 and 12.11.13, which became effective on 1 January 2024. As of 17 June 2026, the SFC guidelines index continues to list this guideline as the latest version dated 1 June 2023.

Why it matters for Hong Kong virtual asset regulation

The guideline is part of Hong Kong’s broader SFC virtual asset trading platform regime. Its AML/CFT provisions sit alongside the SFC’s VATP Guidelines and related licensing materials, but this profile focuses only on the AML/CFT guideline. It should be read as a legal-reference summary for editorial and research purposes, not as legal, compliance, tax, investment, or trading advice.

Key provisions

Legal basis and supervisory effect

Issued under AMLO ss. 7 and 53ZTK and SFO s. 399; SFC may consider non-compliance in discipline, misconduct, and fitness-and-properness reviews.

AML/CFT Jun 1, 2023 Source

Risk-based AML/CFT systems

Requires AML/CFT systems commensurate with identified risks, including compliance management, audit, screening, training, senior oversight, CO and MLRO roles.

AML/CFT Jun 1, 2023 Source

Customer due diligence and monitoring

Sets CDD, beneficial ownership, PEP, non-face-to-face onboarding, customer risk assessment, ongoing monitoring, record-keeping and STR-related standards.

AML/CFT Jun 1, 2023 Source

Virtual asset risk controls

Chapter 12 addresses VA ML/TF risks, VA-specific CDD and monitoring, transfers, third-party deposits and payments, unhosted wallets and risk indicators.

Virtual assets Jun 1, 2023 Source

Virtual asset Travel Rule

Ordering, intermediary and beneficiary institutions must handle required originator and recipient information securely; immediate submission phased in on 2024-01-01.

Payments Jan 1, 2024 Source

Suspicious activity and law enforcement

Includes guidance on suspicious transaction reporting, law enforcement requests, sanctions, terrorist financing, proliferation financing and VA red flags.

Enforcement Jun 1, 2023 Source

Timeline

  1. Amendment Ordinance enacted

    SFC said the 2023 AML/CFT amendments incorporated provisions and guidance linked to the Amendment Ordinance.

    Enacted Source
  2. VATP consultation issued

    SFC issued a consultation on proposed requirements for licensed virtual asset trading platform operators.

    Under consultation Source
  3. Consultation conclusions published

    SFC published conclusions and final proposed regulatory requirements, including the revised AML/CFT Guideline.

    Enacted Source
  4. SFC circular announced revisions

    SFC announced revised AML/CFT guidelines and noted gazettal and effective-date timing.

    Enacted Source
  5. Gazette notice published

    G.N. 3120 of 2023 published the AML/CFT Guideline and its effective-date statement.

    Enacted Source
  6. Most requirements in force

    The revised guideline took effect for most requirements and superseded previous versions.

    In force Source
  7. Travel Rule phase-in completed

    Immediate submission requirements in paras. 12.11.10 and 12.11.13 became effective.

    In force Source

Who it affects

Actors

Securities and Futures Commission

Asset classes

Security tokens, Virtual assets

Official sources

Editorial note

Legal-reference summary only; not legal advice. Status reflects official SFC materials reviewed on 2026-06-17. The immediate-submission element of the virtual asset Travel Rule phased in on 2024-01-01.