Farewell to the "Regulatory Vacuum": A Complete Analysis of Hong Kong VA OTC and Custody Regulatory Framework

Author: Huang Wenjing, Yan Xuesong

Introduction

As an international financial center, Hong Kong reaffirms its commitment to becoming a global innovation hub in digital assets through the “Digital Asset Development Policy Declaration 2.0.” The upgrade of crypto asset trading platforms and the Hong Kong Securities and Futures Commission’s (SFC) traditional licenses “VA upgrade” are just the first steps toward a comprehensive regulatory system for digital assets.

By 2026, with ongoing consultations on two key “regulatory vacuum areas”—Virtual Asset (VA) Dealing and VA Custody—Hong Kong’s Financial Services and the Treasury Bureau (FSTB) and the Securities and Futures Commission (SFC) have clarified legislative directions. They aim to introduce two dedicated licensing regimes through amendments to the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO). This formalizes the upgrade of existing SFC licenses 1, 4, and 9, signaling that a professional and formalized crypto asset regulatory framework will soon be fully established in Hong Kong.

As of now, the consultation conclusions were published on December 24, 2025, with further public consultations on “Providing Opinions on Crypto Assets” and “Crypto Asset Management” nearing completion (deadline January 23, 2026). This article summarizes the regulatory development ideas, analyzes key documents and core changes, and offers general guidance for license applicants.

Timeline Overview

Hong Kong’s VA regulation evolution dates back to 2018, when the SFC issued its first VA regulatory approach statement, establishing the principle of “Same Business, Same Risks, Same Rules.” While not directly targeting OTC and custody services, this set the tone for subsequent developments.

2019

The SFC released a position paper on VA trading platform regulation, introducing a voluntary opt-in framework requiring platforms to comply with investor protection, asset segregation, and AML/CFT requirements. At this stage, custody was viewed as an ancillary service to VA trading platforms, while OTC remained on the regulatory fringe.

2022

Amendments to the AMLO introduced the definition of Virtual Asset Service Providers (VASP), bringing trading and custody into AML scope but still lacking dedicated licenses. On June 1, 2023, the VASP regime officially took effect, launching mandatory VA trading platform (VATP) licensing. VATPs must custody client assets through wholly owned subsidiaries (98% cold storage, 2% hot storage) and adhere to strict asset segregation, insurance, and audit standards. This marked a mature phase of centralized trading regulation, but gaps remain for OTC and independent custody, with increasing market risk accumulation.

March 2024

FSTB and SFC launched consultations on OTC VA trading. Early 2025, the SFC published the “A-S-P-I-Re” roadmap on February 19, supporting the introduction of OTC-specific licenses on equal footing with VATPs, and exploring flexible custody technologies (e.g., dynamic storage ratios). The goal is to complete legislative preparations by the end of 2025.

Key Turning Point: June 27, 2025

FSTB and SFC jointly released legislative consultation papers on VA trading (including OTC) and custody services. The consultation period ended on August 29, gathering over 190 responses from industry, investors, and regulators. On November 3, the SFC issued a circular expanding VATP products and services, allowing VATPs to custody non-trading VAs (such as stablecoins and tokenized securities), relaxing the 12-month track record requirement. This marked a clear transition, enabling diversified custody models.

December 24, 2025

FSTB and SFC published conclusions on VA trading and custody legislative proposals, and launched further consultations on VA opinion provision and management services (until January 23, 2026).

2026

As further consultations conclude, amendments to the AMLO are expected to be introduced to the Legislative Council in the first half of the year, with the effective date depending on legislative progress. From this, we can broadly understand the regulatory direction: custody and trading are moving from peripheral considerations to focal points. The era of learning and exploration is ending; regulators are determined to reshape Hong Kong’s VA ecosystem comprehensively, not just patching parts. Industry voices also favor compliance costs over operating in gray areas.

Document Analysis and Legislative Trends

The key question is: which existing core regulatory documents have been implemented, which will continue to evolve, and are there new regulatory requirements?

Focusing on the 2025 legislative consultation process, the most representative are the June 27 proposal and the December 24 conclusions. The former proposed a standalone legislative framework for AMLO licensing, while the latter refined it based on industry feedback.

VA Trading

1. Definition: Closely aligned with Schedule 1 (Securities Trading) under the Securities and Futures Ordinance (SFO). Specifically, anyone engaging in the following activities as a business must apply for a license under the AMLO framework:

• Entering into or offering to enter into agreements to buy, sell, subscribe, or underwrite virtual assets

• Inducing others to enter into such agreements

This broadly covers a wide range of trading activities, including VA-fiat/VA-VA conversions, as well as more complex brokerage, block trades, margin trading, staking, etc. Derivatives, structured products, and tokenized securities remain under traditional SFO licensing and are not newly regulated under VA-specific licenses.

2. Compliance Requirements: VA trading service providers must adhere to strict AML requirements, including customer due diligence (CDD) and record-keeping.

3. Custody: Mandatory for licensed VA service providers to custody client VAs via SFC-regulated custodians initially, reducing risks of insolvency, fraud, and cyberattacks.

4. Minimum Financial Requirements: At least HKD 5 million in share capital plus HKD 3 million in working capital.

5. Exempt Activities: Internal trading, proprietary asset trading, VA payments for goods/services, and certain VA management activities (including stablecoin issuance already regulated by the HKMA).

6. No Transitional or “Deemed License” Arrangements.

7. Fast Track: Licensed VATPs and those holding SFC upgrade licenses (e.g., Schedule 1) will receive expedited approval assistance.

VA Custody

1. Definition: Covers “custodians holding tools for virtual asset transfer for any person” (from initial consultation). SFC emphasizes a technology-neutral approach, focusing on business substance and risk management rather than technology or service form: licensing depends on actual risk, not decentralization tech.

2. Core Consideration: Private key management

• If an entity holds private keys or similar tools with unilateral transfer capability, licensing is required.

• MPC providers where clients can independently reconstruct private keys and transfer VAs do not need licenses.

• If transfer requires additional support (e.g., multi-signature MPC scenarios), licensing may be necessary.

• Custodial staking services where the custodian has unilateral transfer rights require licensing; non-custodial wallets or delegated scenarios are exempt.

3. Exemptions:

• Internal group custody (charged or not)

• Legal or accounting professionals holding private key backups or court-ordered custody

• Licensed stablecoin issuers only holding their own stablecoins

• PE/VC fund managers self-custodying investment tokens

Excluded are trust/fund managers with delegated custody and multi-party computation (MPC) services without transfer capability.

4. Personal Licensing: A notable point—senior executives, private key access personnel, signing scheme participants, and key contact persons must obtain individual licenses (RO or equivalent), effectively a “personal license.”

5. Minimum Financial Requirements: At least HKD 100 million in share capital plus HKD 3 million in working capital.

6. No Transitional or “Deemed License” Arrangements.

7. Fast Track

The new licensing regimes for custody and trading differ from previous frameworks. The consultation and conclusions introduce the concept of standalone licenses. Previously, OTC VA involving securities might require a Schedule 1 license; custody relied on trust or VATP subsidiaries, leading to fragmented regulation.

Existing SFC licenses 1, 4, and 9 for VA upgrades required holding traditional licenses, which posed a heavy burden for startups exploring Web3. The new AMLO-specific licenses cover broader business models (e.g., P2P, decentralized services) and emphasize technological flexibility.

The absence of transitional arrangements, combined with expedited procedures for existing licensees, minimizes market disruption. The shift toward “pre-emptive regulation”—through minimum capital requirements and restrictions on marketing to the Hong Kong public—raises overall compliance standards.

These adjustments reflect market feedback, balancing rigor and flexibility, avoiding the rigidity of early VATP regimes. Overall, these documents mark a transition of Hong Kong VA regulation from a VATP-centric approach to full-chain coverage, filling gaps, standardizing, and paving the way for institutional entry.

FSTB and SFC will finalize the AMLO amendments based on these conclusions. Further consultations focus on VA opinions and management licenses, with feedback to be integrated into a comprehensive proposal after January 23. The legislation is expected to be introduced in the first half of the year, with passage possibly by mid-year if no major disputes arise, and effective from late 2026.

Mankiw’s Advice

For well-known mid-to-large exchange shops, maintaining an upgraded SFC license is costly and offers limited practical benefits—wasting resources. Most respondents see expanding regulation as a natural step for Hong Kong’s digital asset ecosystem.

Strengthening the connection with the existing SFO framework, reinforcing the technology-neutral principle, and designing for industry friendliness (to attract banks and traditional finance) will further energize the local scene. Meanwhile, Hong Kong plans to localize the CARF framework in 2027, enhancing cross-border AML cooperation. Overall, smooth legislative implementation could elevate Hong Kong’s VA status to a new level. The previous cautious, piecemeal approach was irresponsible; better to see regulation as a strategic division of labor in the market rather than overly detailed rules that risk stifling innovation.

For companies planning to apply for OTC or custody licenses, early preparation is crucial.

First, clarify your business model to determine licensing needs, avoiding later adjustments and facilitating pre-application discussions with SFC. Existing licensees can leverage fast-track channels to streamline approval.

Second, strengthen internal compliance systems. Meet minimum financial requirements, ensure AML/CFT mechanisms are robust. Custody applicants should invest in technical infrastructure; OTC applicants should plan cooperation with SFC-regulated custodians, initially avoiding self-custody.

Third, monitor legislative developments, participate in industry associations’ feedback, and train your team in advance. While compliance costs increase, opportunities for capital inflow will grow.

If you’re already considering these issues before legislation is enacted, congratulations—you’re likely already on the platform, with the train heading from Hong Kong toward the next crypto spring. Whether the ticket is yours or not, after reading this, you might want to chat with us.