Hong Kong’s virtual asset regulation: Licensing for dealing and custody

EN / 简

Hong Kong’s virtual asset regulation: Licensing for dealing and custody

The strategic rationale 

To appreciate why Hong Kong is tightening its VA regulatory framework, it is essential to understand the broader context. VAs operate in a unique space where traditional financial safeguards can appear ambiguous. Previous regulatory initiatives, including the 2022 policy statement on VA development and the 2023 licensing regime for VA trading platforms, laid the groundwork, but gaps remained. The new proposals fill those gaps by addressing two critical functions: the buying and selling of VAs and the safekeeping of the VAs once purchased.

For people entering the VA space, this regulatory tightening offers reassurance. It means that when they deposit cryptocurrency with a licensed custodian or trade tokens through a regulated dealer, there are now measurable standards, capital requirements and compliance obligations are in place to protect their interests. 

The VA dealing regime

The proposed VA dealing regime targets a broad spectrum of market participants, including cryptocurrency exchanges, over-the-counter brokers, block traders and digital asset advisers. Importantly, it captures all dealing services, whether conducted through brick-and-mortar outlets, digital-only platforms or hybrid models. The one exception is peer-to-peer trading between private individuals, which remains unregulated.

Eligibility and governance requirements. The regulatory framework demands substantial corporate discipline. Applicants must be locally incorporated or registered in Hong Kong, ensuring accountability within the jurisdiction. The “fit-and-proper” test applies not just to the corporation itself, but to substantial shareholders and individuals performing VA dealing functions. This multi-layered governance approach recognises that regulatory compliance fails when responsibility diffuses among parties who lack proper incentives or qualifications.

A novel requirement mandates at least two responsible officers for anti-money laundering and counter-terrorist financing (AML/CFT) compliance. This dual-officer model prevents a single individual from cutting corners or succumbing to conflicting pressures.

Capital and compliance obligations.  The regime imposes financial thresholds: HKD5 million in minimum paid-up capital, plus liquid capital requirements ranging up to HKD3 million depending on the business model and scale, along with excess liquid capital equivalent to at least 12 months of actual operating expenses. These figures create a financial cushion to protect clients in case of failures. 

AML/CFT obligations align with Hong Kong’s existing Anti-Money Laundering and Counter-Terrorist Financing Ordinance. Customer due diligence and meticulous record-keeping become non-negotiable. For large dealers, regulatory knowledge qualifications are mandatory, meaning compliance personnel must demonstrate competency through formal assessment.

Token admission and investor safeguards.  Not all tokens qualify for trading. The regime establishes token admission criteria mirroring the requirements for VA trading platforms, restricting retail investors to high-liquidity tokens and HKMA-licensed stablecoins. This gatekeeping function protects investors from highly speculative or illiquid assets. Enhanced due diligence on client suitability, risk assessment and asset segregation further shields the public from predatory practices.

The VA custodian regime

If dealers represent the marketplace, custodians represent the vault.

Defining the custodian landscape.  The regime targets entities safeguarding VAs or managing private keys and authentication credentials on clients’ behalf. This expansive definition captures traditional banks diversifying into digital assets, fund managers accepting crypto allocations, and specialist VA custodians. Notably, certain entities are exempt from licensing: technical service providers offering generic security solutions, bank vaults storing encrypted key backups and HKMA-licensed stablecoin issuers maintaining only their own assets. 

Operational and technical requirements.  Private key storage must employ advanced cryptographic techniques, multi-party computation, key sharding, or equivalent measures to prevent single points of failure. Client assets must be segregated, preventing custodians from co-mingling or misusing customer holdings. Cybersecurity measures are raised to institutional standards, with explicit requirements to prevent breaches.

Financial thresholds and accountability.  Capital requirements for custodians exceed those for dealers: HKD10 million minimum capital, plus up to HKD3 million in required liquid capital. This distinction reflects custodians’ heightened responsibility as they hold people’s wealth. Non-bank custodians must publish audited accounts, ensuring transparency and enabling regulators to continuously monitor financial health.

Enforcement and the cost of non-compliance

Both regimes carry serious sanctions. Operating without a licence risks a fine of up to HKD5 million and seven years’ imprisonment. Fraudulent or deceptive conduct in VA transactions escalates to a HKD10 million fine and ten years’ imprisonment. These penalties deliberately match or exceed sanctions for traditional financial fraud, establishing a clear principle of enforcement equivalence for VA offences.

Looking forward

The consultation period represents a critical opportunity for industry participants, technology providers, and compliance professionals to engage constructively with regulators, raising practical concerns while demonstrating commitment to responsible growth. Well-calibrated feedback can refine provisions that may inadvertently impede innovation or create unintended compliance burdens.

For market participants, preparation is vital. Organisations currently operating without licences must chart a path toward compliance. Those seeking new VA business lines must integrate licensing requirements into their planning. Legal advisers should familiarise themselves with the detailed criteria, as licensing applications will demand meticulous documentation and governance structuring.

These proposed regimes, if thoughtfully refined through consultation, position Hong Kong as a jurisdiction where investors feel secure, and innovators can flourish responsibly.

YYC Legal LLP is in Association with East & Concord Partners (Hong Kong) Law Firm.

First published in November 2025 YYC Legal - legal trends of China Business Law Journal.