Hong Kong's Next Wave of Virtual Asset Licensing: What Firms Must Do Now
Hong Kong is expanding its virtual asset regulatory perimeter again, and this time the expansion is broad enough to catch firms that assumed their existing Securities and Futures Commission licences already had them covered. The Financial Services and the Treasury Bureau (FSTB) and the Securities and Futures Commission (SFC) published consultation conclusions in December 2025 and May 2026 on proposals to license four additional virtual asset (VA) activities: dealing, custody, advisory, and management. The bill has not yet reached the Legislative Council, but the conclusions are detailed enough to act on, and the cost of waiting is potentially having to suspend VA-related operations the moment the regime commences. Robust crypto accounting software and a structured compliance programme are no longer optional for any firm with Hong Kong exposure.
The Four Licences and Why Existing Approvals Do Not Cover Them
Each of the four proposed licences mirrors a pillar of the Securities and Futures Ordinance (SFO): VA dealing maps to Type 1, VA advisory maps to Type 4, VA management maps to Type 9, and VA custody stands as its own new category. The critical point, and the one most often missed in early planning, is that none of these is bundled into an existing SFO, Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO), or virtual asset trading platform (VATP) licence. They each sit as standalone licences under the AMLO, the same statute that underpins the VATP regime.
No Grandfathering, No Deeming
The regulators have been explicit: there will be no deeming or grandfathering arrangement. A firm with a Type 1 licence that is currently providing VA dealing services under an interim "VA top-up" condition cannot assume that condition converts automatically into the new standalone licence. When the regime commences, firms without an application in motion may need to pause VA-related operations entirely. That is not a theoretical risk. It is the stated position from the consultation conclusions, and it is the kind of business disruption a structured readiness programme is built to avoid.
Where Hong Kong's VA Perimeter Stands Today
The perimeter has been expanding steadily since 2023, when VATPs were brought under mandatory SFC licensing. Fiat-referenced stablecoin issuers followed: the Hong Kong Monetary Authority (HKMA) began licensing them under the Stablecoins Ordinance, which took effect in 2025. The FSTB and SFC opened consultation on VA dealing and custody in June 2025, receiving 101 submissions on dealing and 93 on custody before the August 2025 closing date. Advisory and management proposals followed in the December 2025 and May 2026 rounds. The four new licences represent the next logical layer, and together they close most of the remaining gaps in Hong Kong's VA regulatory architecture.
Three Planning Errors That Derail Readiness Programmes
Compliance teams at banks, payment firms, and cryptoasset businesses routinely make the same three mistakes when a new licensing regime is still in the consultation phase.
Assuming an Existing Licence Already Covers the Activity
A firm that holds a Type 1, Type 4, or Type 9 SFO licence and is already providing some VA services may be doing so under a temporary "VA top-up" condition attached to that existing licence. That condition will need to convert into a standalone application under the new regime. It does not survive automatically. Any planning that starts from the assumption that the firm is already covered is starting from the wrong place.
Treating "No Grandfathering" as a Cliff Edge Rather Than a Prompt
Some teams read the no-grandfathering position as a binary outcome: either the firm is ready on day one or it is not. The more useful read is that it is a prompt to engage the SFC early. Regulators consistently respond better to firms that identify their own gaps and bring remediation plans to supervisory conversations than to firms that surface problems only when enforcement is already in motion.
Building Plans Around Capital Figures That Could Still Change
The consultation conclusions include indicative capital requirements, but those figures could still move before the bill is finalised. Firms that anchor their gap assessments to specific numbers from the consultation text risk having to redo the work. The more durable approach is to size the gap structurally, to understand the distance between current capability and the standard required, and treat the capital figure as one variable within that gap rather than the gap itself.
A Five-Stage Readiness Framework
The SFC's own approach to compliance supervision follows a logic that compliance functions already apply to AML/CFT and operational risk: governance, identification, assessment, monitoring, and reporting. Running these as a connected system, rather than as sequential one-off tasks, is what separates readiness that holds up under regulatory scrutiny from readiness that looks adequate on paper but falls apart in practice.
Stage 1: Governance
Firms with no single named owner for a licensing programme consistently lose momentum once the initial attention around a consultation deadline fades. Governance has to come first, not as a stage to return to after the technical work is done, but as the foundation the other four stages sit on. Assign a named senior owner, typically the MLRO, head of compliance, or COO, with explicit board-level accountability for the programme. Stand up a small steering group that spans compliance, product, legal, technology, and finance. Embed VA dealing, custody, advisory, and management risk explicitly into the firm's existing risk appetite statement so none of the four activities sits as an unaddressed gap. Begin drafting the day-one policies now: custody policy, VA-specific AML/CFT procedures, and marketing and promotion policy. These are remediation items, not documents to prepare in the weeks before a licence application is submitted.
Stage 2: Identification
Risk mapping is a familiar discipline for any firm that has already mapped an SFO-regulated perimeter. The same methodology applies to virtual assets specifically, with a few additions that are unique to this regime.
Map every current and planned revenue line, including OTC desks, execution services, discretionary VA mandates, and VA-related advice, against the proposed definitions to determine which licence, if any, each line triggers. For asset managers, check every portfolio for any VA allocation, however small. The consultation conclusions confirm there will be no de minimis threshold for VA management: any discretionary portfolio management involving any amount of virtual assets requires appropriate licensing. Previously, the de minimis threshold allowed asset managers to hold modest VA positions under existing Type 9 terms with SFC-imposed VA Fund Manager conditions. That accommodation disappears under the new regime.
Separately, identify every point at which the firm holds or has access to private keys, and review current marketing of VA-related services to Hong Kong persons. Key access can trigger the VA custodian licence independently of the firm's main licensed activity. Marketing to the Hong Kong public can trigger the VA dealing licence or its associated marketing prohibition, regardless of whether the firm is otherwise in scope.
Stage 3: Assessment
This is the stage where readiness moves from a checklist to a quantified plan. Convene product, finance, legal, and compliance together to size the gap for each activity the firm intends to pursue: the capital position, the AML/CFT control changes required, staff competence against the SFC's fit-and-proper standard, and any vendor or custody dependency. Attach a cost and a time-to-close to every gap so the board receives an actionable remediation plan rather than a narrative description of risk.
Flag any self-custody arrangement under consideration, particularly for asset managers holding early-stage or bespoke tokens. Self-custody carries its own capital and licensing burden that is easy to underestimate at the planning stage. Also review for potential conflicts of interest: fee structures for VA assets often differ materially from those on conventional mandates, and with no de minimis threshold for VA management, the firm's own licensing exposure can begin to influence allocation advice alongside client suitability. That is a conduct risk that needs to be identified and managed before a licence is granted, not after.
Stage 4: Monitoring
Gap closure is not a one-off exercise. Once shortfalls are identified and a remediation plan is underway, firms need monitoring arrangements that will remain fit for purpose once a licence is granted. For firms that want to understand how continuous transaction monitoring at the wallet level differs from the rule-based fiat monitoring most compliance functions currently run, see our earlier piece on how continuous monitoring closes the post-screening risk gap in crypto AML. The key shift is operating at the wallet level rather than on transaction-value rules carried over from fiat systems: wallet clustering and attribution, multi-hop exposure scoring, and cross-chain tracing are all capabilities that will be expected under a VA-specific AML/CFT framework.
Stage 5: Reporting
Senior management and the board need visibility that is current, not retrospective. Reporting under this framework means translating the outputs of stages one through four into a format that allows decision-makers to act: remediation progress against the plan, capital position relative to the expected requirement, open policy gaps, and any regulatory engagement underway. The reporting cadence should match the pace at which the regulatory position is moving, which right now means at minimum monthly updates as the bill progresses through the Legislative Council.
Accounting and Audit Implications
The new licensing regime creates obligations that flow directly into financial reporting and audit work. Firms applying for VA dealing or custody licences will need to demonstrate capital adequacy on an ongoing basis, which requires clean, auditable records of VA holdings valued consistently with the applicable accounting standard. For Hong Kong entities reporting under HKFRS, the relevant standard is HKFRS 9 for most cryptoasset holdings, though the International Accounting Standards Board's IFRS 18 and IAS 38 positions on intangible assets remain relevant context for non-financial token classifications.
Custody Accounting and Segregation
The proposed VA custodian licence will carry client asset segregation requirements that are analogous to those in the SFO's existing client money and securities rules. For accounting teams, this means custody arrangements need to be reflected accurately in the balance sheet or off-balance-sheet disclosures depending on whether the custodian consolidates client assets under its own control. Firms that currently treat client VA holdings inconsistently across entities in the same group face an audit finding risk once the licensing regime is in force and the SFC begins examining custody controls directly.
The AICPA's recent guidance updates are instructive context here: our coverage of what the AICPA's updated stablecoin and mining guidance means for digital asset accounting sets out how US standard-setters are approaching the same custody and revenue recognition questions. Hong Kong auditors will face parallel questions as the HKMA's stablecoin regime and the SFC's new custody licence both become operational.
AML/CFT Systems and Crypto Bookkeeping Software
Firms relying on manual processes or fiat-era transaction monitoring to support their current VA activity will face a direct capability gap when the new licences require them to demonstrate a VA-specific AML/CFT control environment to the SFC. The practical implication is that digital asset accounting software and AML/CFT systems need to be evaluated as part of the gap assessment at stage three, not left as a technology procurement question to resolve after the licence application is submitted. Auditors conducting readiness reviews should treat the adequacy of the firm's crypto bookkeeping software as a first-order control question, not a back-office detail.
Frequently Asked Questions
Does a current VATP licence cover VA dealing under the new regime?
No. The VATP licence covers on-platform trading within the licensed platform operator. VA dealing under the proposed new regime is a separate licence under AMLO and covers a broader set of dealing activities. Firms that operate a VATP and also conduct off-platform VA dealing will need to assess whether the dealing activity requires a standalone VA dealing licence.
What triggers the VA custodian licence?
The consultation conclusions indicate that holding, or having access to, private keys on behalf of clients is the primary trigger. This is an independent gateway: a firm can trigger the custody licence requirement even if its main business is advisory or management rather than custody itself. Any firm that controls or has access to client private keys as part of its service model needs to include the custodian licence in its scope assessment.
Is there any transition period for firms currently providing VA services under an SFO "top-up" condition?
The consultation conclusions state there will be no deeming or grandfathering arrangement. Firms operating under interim "VA top-up" conditions on existing SFO licences will need to apply for the relevant standalone VA licence. The bill has not yet specified a transition window, so firms should engage the SFC early rather than wait for the legislative text to be finalised.
What does "no de minimis threshold" mean for asset managers with small VA allocations?
Under the previous SFC framework, asset managers could hold a modest VA position in an otherwise conventional portfolio without triggering a standalone VA licensing requirement, provided they operated under SFC-imposed VA Fund Manager conditions attached to their Type 9 licence. The consultation conclusions confirm this threshold is being removed. Any discretionary management of a portfolio containing any amount of virtual assets will require a VA management licence once the new regime commences.
When should firms start engaging the SFC?
Now. Regulatory supervisors consistently respond more constructively to firms that come forward with self-identified gaps and structured remediation plans than to firms that surface issues only under examination. The bill has not yet been finalised, but the consultation conclusions are detailed enough to support a credible pre-application engagement. Early engagement also reduces the risk of having to suspend operations at commencement if an application is not already in motion.
Source: Elliptic