香港VASP牌照申請元資料步驟

What is the Hong Kong VASP licence application?

The Hong Kong Virtual Asset Service Provider (VASP) licence application is the formal process by which businesses seek authorisation from the Securities and Futures Commission (SFC) to operate a centralised virtual asset trading platform in Hong Kong. Under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615), any person carrying on a business of providing a virtual asset service—specifically, operating a virtual asset exchange—must be licensed. This licensing regime, effective from 1 June 2023, marks a significant shift from the previous opt-in framework, bringing all centralised trading platforms within the SFC’s regulatory perimeter. The application process is rigorous, requiring applicants to demonstrate robust governance, adequate financial resources, effective anti-money laundering (AML) and counter-terrorist financing (CFT) controls, and fit-and-proper management. For firms considering entry into Hong Kong’s regulated digital asset market, understanding the scope and requirements of the VASP licence is the essential first step.

Who needs a VASP licence?

The obligation to obtain a VASP licence applies to any person who, in Hong Kong, carries on a business of providing a virtual asset service, or holds themselves out as carrying on such a business. A virtual asset service is defined as operating a virtual asset exchange—that is, providing services through means of electronic facilities where offers to sell or purchase virtual assets are regularly made or accepted, or where persons are regularly introduced to each other with a view to their negotiating or concluding virtual asset transactions. This captures centralised trading platforms, whether they serve retail or professional investors. It does not cover peer-to-peer trading platforms that merely provide a forum for users to post bids and offers without automatic matching, nor does it apply to over-the-counter (OTC) desks that do not operate a platform. The SFC has indicated that it will consider the specific business model and operations when determining whether a licence is required.

What are the key requirements for a VASP licence application?

Applicants must satisfy a comprehensive set of requirements designed to ensure investor protection and market integrity. These include: (1) establishing a Hong Kong incorporated company with a permanent place of business in Hong Kong; (2) appointing at least two responsible officers who are fit and proper, with relevant experience in virtual asset trading or financial services; (3) maintaining adequate financial resources, including a minimum paid-up share capital of HKD 5,000,000 and liquid capital of at least HKD 3,000,000; (4) implementing robust AML/CFT systems and controls in line with the SFC’s guidelines; (5) having appropriate policies and procedures for the custody of client assets, including the use of cold and hot wallets; (6) conducting thorough due diligence on virtual assets before listing them for trading; and (7) establishing a proper governance structure with an independent board and effective risk management. The application must be accompanied by a detailed business plan, compliance manual, and supporting documents, and the SFC will conduct a thorough review, which may include on-site inspections.

Who Should Consider a Hong Kong VASP License and Key Planning Decisions

Any business that intends to operate a virtual asset trading platform or actively market such services to Hong Kong investors should evaluate whether a VASP license is required. This includes both newly formed entities and existing offshore structures that may need to restructure to meet the Securities and Futures Commission’s (SFC) expectations. The primary planning decisions revolve around entity structure, operational substance, and compliance readiness. Applicants must decide whether to establish a Hong Kong-incorporated company—which is typically the most straightforward route—or to rely on an existing overseas entity, provided it can demonstrate adequate local presence and governance. Key considerations include appointing at least two responsible officers with relevant experience, establishing a local office, and implementing robust anti-money laundering and counter-terrorist financing (AML/CFT) controls as outlined in the SFC’s guidelines (see 證券及期貨事務監察委員會 – 反洗錢及反恐融資指引). Firms should also plan for ongoing obligations such as client asset protection, regular audits, and reporting. Early engagement with professional advisors is advisable to navigate the application process and align the business model with regulatory requirements.

Preparing for Your Hong Kong VASP Licence Application: Key Information to Gather

Before initiating the Hong Kong VASP licence application, prospective virtual asset service providers must assemble a comprehensive set of corporate and compliance documents. This preparatory phase is critical, as the Securities and Futures Commission (SFC) requires detailed evidence of the applicant’s corporate structure, beneficial ownership, and internal controls. Under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615), applicants must demonstrate robust governance and risk management frameworks. Key materials include the company’s certificate of incorporation, business registration certificate, and a clear record of significant controllers, as mandated by the Companies Registry’s Significant Controllers Register. Additionally, firms should prepare their operational policies on anti-money laundering and counter-terrorist financing, referencing guidance from the SFC and the Customs and Excise Department. Gathering these documents early streamlines the application process and helps avoid delays.

Step-by-Step Process for a Hong Kong VASP Licence Application

Applying for a virtual asset service provider (VASP) licence in Hong Kong involves a structured sequence of preparatory and submission steps. While the exact timeline depends on the applicant’s readiness and the regulator’s review, the following stages outline the typical progression.

1. Pre-Application Preparation and Corporate Structuring

Before lodging a formal application, the applicant must ensure its corporate structure meets Hong Kong’s requirements. This typically involves incorporating a Hong Kong limited company, as the VASP licensing regime is designed for locally registered entities. The Companies Registry provides guidance on forming a local company under the Companies Ordinance (Cap. 622). The company must have at least one director, a company secretary, and a registered office address in Hong Kong. Additionally, the applicant should establish a clear ownership and control structure, as the regulator will scrutinise the fitness and propriety of substantial shareholders and officers.

2. Developing Internal Policies and Controls

A critical component of the application is demonstrating robust anti-money laundering and counter-terrorist financing (AML/CTF) systems. The applicant should draft comprehensive policies and procedures aligned with the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) and the relevant guidelines issued by the Securities and Futures Commission (SFC). These policies must cover customer due diligence, transaction monitoring, record-keeping, and suspicious transaction reporting. The firm should also appoint a Money Laundering Reporting Officer (MLRO) and ensure staff receive adequate training.

3. Engaging Professional Advisers

Given the complexity of the VASP licensing process, most applicants engage professional advisers such as law firms, compliance consultants, or corporate service providers licensed under the Trust or Company Service Provider (TCSP) regime. These advisers can assist with document preparation, gap analysis, and liaison with the SFC. The Companies Registry’s TCSP licensing system provides a list of licensed TCSPs that may offer relevant support.

4. Submission of the Application to the SFC

The formal application is submitted to the SFC, which is the primary regulator for VASPs in Hong Kong. The application package typically includes the completed application form, business plan, AML/CTF manuals, organisational charts, and details of the management team. The SFC will review the submission and may raise queries or request additional information. Applicants should be prepared for a potentially iterative process, as the regulator seeks to ensure full compliance with the Securities and Futures Ordinance and the Guidelines for Virtual Asset Trading Platform Operators.

5. Post-Submission Review and Approval

After submission, the SFC conducts a thorough assessment, which may include interviews with key personnel and on-site inspections. The regulator evaluates the applicant’s financial soundness, operational capability, and commitment to investor protection. If satisfied, the SFC will grant a licence, allowing the firm to operate a virtual asset trading platform in Hong Kong. Post-licensing, the VASP must maintain ongoing compliance and submit regular reports to the SFC.

Document Checklist for a Hong Kong VASP Licence Application

Preparing a complete and well-organised set of documents is critical to the success of a Hong Kong VASP licence application. The Securities and Futures Commission (SFC) requires extensive information to assess the fitness and properness of the applicant, its management, and its operational readiness. Below is a structured checklist of key document categories and an explanation of why each matters.

1. Corporate and Structural Documents

Applicants must provide certified copies of the company’s certificate of incorporation, business registration certificate, and articles of association. These establish the legal identity and constitutional framework of the entity. For Hong Kong-incorporated companies, the Companies Registry maintains records under the Companies Ordinance (Cap. 622). If the applicant is part of a group, an organisational chart showing the ultimate beneficial owners (UBOs) is required. This aligns with the significant controllers register requirements under the same ordinance, ensuring transparency of control and ownership.

2. Management and Key Personnel Information

The SFC scrutinises the competence and integrity of directors, responsible officers (ROs), and managers. Documents include detailed curricula vitae, proof of academic and professional qualifications, and employment references. Each individual must demonstrate relevant experience in virtual asset services, financial regulation, or technology. Additionally, fit and proper declarations, criminal record checks, and financial soundness statements are necessary. This category is vital because the SFC holds individuals accountable for compliance, and any gaps in expertise or integrity can lead to refusal.

3. Business Plan and Operational Policies

A comprehensive business plan outlining the proposed VASP activities, target markets, and revenue model is mandatory. It must be supported by operational policies and procedures covering anti-money laundering and counter-terrorist financing (AML/CTF), client asset protection, cybersecurity, and data privacy. These documents demonstrate the applicant’s ability to comply with the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) and the Personal Data (Privacy) Ordinance. The SFC expects policies to be tailored to the specific risks of virtual asset services, not generic templates.

4. Financial Resources and Audited Accounts

Evidence of sufficient financial resources is a core requirement. Applicants must submit audited financial statements or, for new entities, a projected balance sheet and funding plan. The SFC assesses whether the applicant can meet the minimum paid-up capital and liquid capital requirements, which are set to ensure the VASP can withstand operational shocks and protect client assets. Bank reference letters and proof of funding sources further support financial soundness.

5. Compliance and Risk Management Framework

Documents in this category include the AML/CTF policy, risk assessment methodology, client due diligence procedures, and suspicious transaction reporting protocols. The SFC expects a robust, risk-based approach aligned with international standards. The framework must also address sanctions screening, record-keeping, and independent audit arrangements. This demonstrates the applicant’s commitment to preventing financial crime and maintaining market integrity.

6. Technology and Security Documentation

Given the digital nature of virtual assets, applicants must provide details of their IT infrastructure, wallet management, private key storage, and cybersecurity measures. Penetration test reports, disaster recovery plans, and system architecture diagrams are often requested. This documentation assures the SFC that client assets are safeguarded against theft, loss, or unauthorised access, and that the platform can operate reliably.

Each document category serves a distinct regulatory purpose, and omissions or inadequacies are common grounds for application delays or rejection. Engaging professional advisers familiar with SFC expectations can help ensure the checklist is tailored and complete.

Corporate Structuring for VASP Applicants: Choosing the Right Entity

Selecting an appropriate corporate vehicle is a foundational step in the 香港 VASP 牌照申請 process. The Securities and Futures Commission (SFC) does not prescribe a single entity type, but the chosen structure must be a company incorporated in Hong Kong or an overseas company registered under the Companies Ordinance (Cap. 622). Most applicants opt for a private company limited by shares, as it offers clear governance, limited liability, and familiarity to regulators. When incorporating, founders must consider the company’s objects clause, ensuring it explicitly covers virtual asset services. The 香港公司註冊處 – 成立本地有限公司 provides guidance on incorporation procedures, while the 香港公司註冊處 – 公司條例 (第622章) outlines statutory requirements. For overseas entities, registration with the Companies Registry is mandatory before applying for a VASP licence, and the branch must maintain a place of business in Hong Kong.

Substance and Governance Requirements

Beyond mere registration, the SFC expects applicants to demonstrate adequate substance. This includes a physical office in Hong Kong, locally based key personnel, and a governance framework that supports compliance with anti-money laundering and counter-terrorist financing obligations under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615). The 香港公司註冊處 – 重要控制人登記冊 must be maintained, and ultimate beneficial owners should be transparent. While the provided sources do not detail specific VASP requirements, analogous regimes such as the 香港海關 – MSO 反洗錢指引 and 證券及期貨事務監察委員會 – 持牌人及註冊機構 emphasize the importance of robust internal controls. Applicants should also consider tax implications; the 香港稅務局 – 利得稅 two-tiered rates may apply, and proper structuring can optimize tax efficiency while remaining compliant. Engaging a professional firm familiar with 香港公司註冊處 – TCSP 牌照制度 can help navigate these complexities, ensuring the corporate structure aligns with both regulatory expectations and business objectives.

Common Mistakes and Risk Controls in Hong Kong VASP Licence Applications

Applicants pursuing a 香港 VASP 牌照申請 often underestimate the depth of documentation and ongoing compliance required. A frequent mistake is submitting incomplete or inconsistent business plans that fail to demonstrate a genuine commitment to anti-money laundering and counter-terrorist financing (AML/CTF) obligations under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) [386]. Another pitfall is neglecting the fit-and-proper assessment of ultimate beneficial owners and responsible officers, where gaps in personal probity or professional competence can delay or derail approval. To mitigate these risks, firms should implement robust internal controls, including independent compliance audits, staff training programmes, and transaction monitoring systems aligned with the Securities and Futures Commission’s AML/CTF guidelines [380]. Engaging a licensed trust or company service provider (TCSP) [186] early can help structure the applicant entity correctly and ensure all corporate records—such as the significant controllers register [366]—are maintained to the standard expected by the Companies Registry. Practical next steps include conducting a pre-application gap analysis against the SFC’s licensing requirements, preparing a detailed operational manual, and seeking professional advice to navigate the complexities of the 香港 VASP 牌照申請 process.

Closing Section: Your Next Steps Toward a Hong Kong VASP Licence

Navigating the Hong Kong VASP licence application process demands meticulous preparation, from establishing a suitable corporate structure to implementing robust anti-money laundering (AML) and counter-terrorist financing (CTF) frameworks. As the regulatory landscape continues to evolve, engaging with professional service providers who understand the nuances of the Securities and Futures Commission (SFC) requirements can streamline your path to compliance. Whether you are a start-up exchange or an established platform seeking to expand into Asia, early planning and expert guidance are essential to avoid common pitfalls and delays.

Frequently Asked Questions

What is the first step in applying for a Hong Kong VASP licence?

The initial step is to incorporate a Hong Kong limited company and ensure it has a registered office and a company secretary. You must also appoint at least two responsible officers with relevant experience in virtual asset services and AML compliance. Early engagement with the SFC is advisable to understand the specific documentation required.

How long does the VASP licence application process typically take?

The timeline varies depending on the completeness of your application and the SFC’s review. While the SFC does not guarantee a specific processing period, applicants should anticipate a thorough examination of their business plan, AML policies, and fitness and propriety of management, which can extend over several months.

Can an overseas company apply for a Hong Kong VASP licence?

No, only a Hong Kong-incorporated company with a permanent place of business in Hong Kong can apply. The company must demonstrate substantial presence and control within the jurisdiction, including local management and operational infrastructure.

What are the key AML requirements for VASP licence holders?

Licensees must comply with the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) and the SFC’s AML guidelines. This includes customer due diligence, transaction monitoring, record-keeping, and reporting suspicious transactions to the Joint Financial Intelligence Unit. Regular independent audits of the AML programme are also expected.

Is a VASP licence required for peer-to-peer trading platforms?

If the platform facilitates the exchange of virtual assets for fiat currency or other virtual assets and operates in or from Hong Kong, it likely falls within the regulatory scope. The SFC assesses each case based on the nature of the activities and the degree of control exercised over the trading process.