Hong Kong Crypto License Explained: The VATP Regime in Detail

As of early 2025 Hong Kong had issued roughly ten Virtual Asset Trading Platform (VATP) licenses — a small headcount but a meaningful number in the global compliance map. Each license represents an exchange that has cleared full Securities and Futures Commission (SFC) review and can lawfully serve Hong Kong residents, including retail investors. Within three years Hong Kong went from “crypto’s legal status is fuzzy” to “Asia’s compliance probe.” This article walks through the regime from origins to application.

VATP Regime Origin: From Restriction to Open Invitation

Hong Kong’s path went through “tight — open — refined.” In 2018 the SFC issued its DLT-asset regulatory position statement, placing security-class tokens under the Securities and Futures Ordinance. In 2019 it launched a voluntary VASP licensing framework — opt-in, only proactive projects applied.

The turn came at the Hong Kong FinTech Week in October 2022. The government published a policy statement explicitly welcoming Web3 and virtual asset teams to set up in Hong Kong. On 1 June 2023 the VASP licensing regime became mandatory — every centralized crypto exchange operating in Hong Kong must apply for a VATP license. From voluntary to mandatory; Asia’s first regulated exchange regime open to retail.

OSL and HashKey received the first licenses (they had already obtained them under the voluntary regime in 2020). Bullish, HKbitEX, PantherTrade, VDX followed across 2024, bringing the total to about ten by early 2025, with another ten-plus in “deemed-to-be-licensed” transition or in application.

License Classes: Retail vs Professional Investor

VATP licenses are nominally an SFC Type 1 (dealing in securities) plus Type 7 (automated trading services) combination, but the business scope splits in two tiers.

Professional-Investor-only (PI-only) licenses serve only professional investors (in Hong Kong, individuals with HKD 8 million-plus in investable assets, or institutional investors). The early OSL and HashKey licenses were PI-only.

Retail licenses can serve both retail and professional investors and carry tighter compliance. From August 2023 SFC allowed upgrades from PI-only to Retail — HashKey and OSL obtained Retail status in the second half of 2023. Additional Retail requirements include stricter customer due diligence, mandatory token due diligence committee review of every listing, enhanced disclosure for retail clients, and a compulsory compensation safeguard fund.

Listing scope under a Retail license is meaningfully restricted — SFC requires only “large-cap crypto-assets included in two independent index providers.” BTC, ETH, SOL, AVAX clear the bar; long-tail tokens do not.

Application Process and Core Requirements

Filing for a VATP license is not a paper exercise but an 18-to-24-month project. Key thresholds:

Capital: paid-up capital no less than HKD 5 million, liquid capital no less than HKD 3 million. Modest on its own, but other requirements stack.

Personnel: at least two Responsible Officers (RO) qualified for Type 1 and Type 7, with at least one as an executive director. RO qualification requires SFC examination plus industry-experience review, and qualified ROs are a scarce resource.

Customer asset custody: 98 percent or more of client crypto assets must be held in cold wallets; hot-wallet assets must be backed by equivalent insurance or a compensation fund. This rule explicitly targets the FTX collapse lesson.

AML and KYC: full identity verification, suspicious transaction reporting, onchain tracing capacity — bank-grade compliance.

Cybersecurity audit: at least one annual third-party security audit; critical vulnerabilities reported to SFC within 72 hours.

Listing due diligence: an independent token due diligence committee evaluating each prospective listing across technical, compliance, and market dimensions. Members cannot have conflicts of interest with the issuer.

Market estimates put single-applicant compliance spending at HKD 15–30 million, on top of an 18-month-plus wait. The bar filters out “open first, comply later” players.

Hong Kong vs Singapore MAS

The two regimes get compared often.

Singapore MAS uses the Major Payment Institution (MPI) license under the Payment Services Act — payments-service oriented, open to retail but with restrictions on retail-targeted advertising and promotion. From 2022 MAS tightened retail protection, banning retail-facing crypto wealth products and advertising, and introducing a dedicated Single-Currency Stablecoin (SCS) framework for stablecoin issuers.

Hong Kong’s VATP takes a more direct “securities” angle, applying the existing Type 1 plus Type 7 license stack from the securities regulator, retail-open but with listing-scope and compensation requirements as risk controls.

Both move in the same direction — clear compliance to attract projects — but bet on different angles. Hong Kong bets on retail openness to attract market liquidity, Singapore bets on institutional-friendliness to attract infrastructure. By 2024 the two attracted different project mixes — the former more exchanges and payments, the latter more infrastructure and compliant stablecoins.

What It Means for Mainland Users

Mainland China’s complete prohibition shows no sign of relaxing. But Hong Kong, as a Special Administrative Region, has its own financial regulator, and the VATP regime does not directly serve mainland residents — licensed exchanges’ KYC processes reject mainland IDs and only accept Hong Kong residents, legally working non-residents, and qualifying overseas residents.

For mainland users planning to work, study, or relocate to Hong Kong, the VATP regime offers a compliant on-ramp into crypto markets. Trading major cryptos within a regulated framework, using institutional custody, accessing compliant stablecoins (like the future Hong Kong version of MiCA-compliant USDC) — these are options mainland identity did not have before. At a macro view of top exchanges comparison, Hong Kong licensed venues are likely to take an increasingly important role in Asian compliant markets.

What This Southern Window Becomes Next

The window to mainland China’s south is becoming Asia’s compliance probe. Hong Kong moved itself from “gray zone” to “one of the world’s first retail-open crypto markets” in three years, and the consequences have barely started to appear in 2026. For projects, it offers a retail-compliant channel; for users, it offers compliance-identity access to crypto markets; for regulators, it inserts an “open experimental zone under Chinese sovereignty” into the global framework. Next to watch: license issuance pace, stablecoin framework rollout, and the lateral comparison forming between MiCA, Singapore MAS, and Hong Kong.