Hong Kong FSTB and SFC consult on regulatory regimes for virtual asset dealers and custodians

1. Introduction and background to the consultation

The consultation papers on virtual asset (VA) dealers and custodians demonstrate the Hong Kong Government’s continued efforts to establish Hong Kong as a premier global VA hub, and represent a significant enlargement and enhancement to Hong Kong’s VA-specific laws and regulations, which currently only cover VA exchanges and stablecoin issuers. It is expected that the new regime can improve diversity in compliant service offerings, investor choice and market competitiveness.

The legislative initiative towards regulating over-the-counter trading of VA was first put forward by the Financial Services and Treasury Bureau (FSTB) in a two-month consultation period conducted in early 2024. At the time, it was proposed that any person who conducts a business of providing services of spot trade of any VA in Hong Kong will be required to be licensed by the Commissioner of Customs and Excise.

Regulations for VA custodians and dealers were again proposed in the Securities and Futures Commission’s (SFC) ASPIRE roadmap (February 19, 2025) and the Government’s policy statement 2.0 on the development of digital assets in Hong Kong (June 26, 2025), now to be regulated by the SFC in order to streamline oversight and minimize potential regulatory arbitrage across different VA licensing frameworks.

2. Current regulatory regime for VA dealing and custodian activities

Standalone VA dealing activities are not currently regulated in Hong Kong, unless:

• The relevant activities constitute operating a “VA Exchange” as defined in Schedule 3B of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) (AMLO). Notably, the definition of VA Exchange includes only exchanges where client assets come into its direct or indirect possession. Non-custodian exchanges fall outside of the ambit of the AMLO.
• The relevant VA constitutes “securities” under the Securities and Futures Ordinance (SFO) and the relevant activity falls within the definition of a “regulated activity” under the SFO, in which case licenses under the SFO will have to be obtained (typically a Type 1 licensing for dealing in securities).
• The VA “dealer” is an SFC-licensed entity (either because the VA it deals in constitute securities, or because it deals in other traditional securities), in which case it should follow additional terms and conditions issued by the SFC in offering such VA dealing services (commonly referred to as a “VA top-up”).

Standalone VA custodians are also not regulated, except that given most VA custodians hold VA on trust for their clients, VA custodians obtain a Trust or Company Service Provider (TCSP) license with the Companies Registry.

For banks providing VA custody services to their clients, the HKMA has published guidance on its expectations, prescribing additional standards including governance frameworks, segregation of client VA from house assets, measures to safeguard custodied VA, principles on outsourcing, client disclosures and record keeping requirements. These standards are only applicable to banks providing VA custody services and not to non-bank VA custodians.

SFC-licensed entities are only allowed to custody client VA at licensed VATPs or banks.

3. VA dealing – Proposed scope

The consultation paper proposes that any person who, by way of business, makes or offers to make an agreement with another person, or induces another person to enter into an agreement:

1. to acquire, dispose of, subscribe for or underwrite VA; or
2. for the purpose of securing a profit from the yield of, or fluctuations in the value of, VA must obtain a license from the SFC.

The proposed scope for VA dealing activities is broad. Although its wording is similar to that used for Type 1 regulated activities (dealing in securities) for securities, the consultation paper is clear that it does not only cover activities traditionally regarded as falling within the ambit of Type 1 regulated activities. It would appear that the intention is to create a broad regulatory regime covering various types of VA-related activities that would be subject to different licenses under the traditional securities framework.

For example, the definition of VA dealing captures the following VA activities:

• Spot trading and conversions;
• Brokerage and block trading activities;
• Financial advisory and asset management activities;
• Borrowing and lending, margin trading and staking;
• VA OTC exchange shops; and
• Non-custodial exchanges.

Peer-to-peer trading of VA (i.e., with no intermediary involved) is not within the licensing scope, although platforms facilitating peer-to-peer trading will need to be assessed on a case-by-case basis whether they have engaged in the business of providing VA dealing services, taking into account for example their remuneration model.

4. VA dealing – Key regulatory requirements

First, VA dealers are expected to follow similar licensing requirements as those for SFC-licensed VATPs. For retail investors specifically, licensees should ensure that tokens offered would include only tokens of high liquidity and stablecoins issued by HKMA-licensed issuers. A separate set of regulatory requirements for other services (e.g. advisory, asset management, staking, borrowing/lending, margin trading) will be formulated in due course.

Second, the FSTB and SFC are considering allowing licensees providing VA dealing services to acquire or dispose of VA for clients via non-SFC-licensed VATPs that are subject to regulation in other jurisdictions, provided sufficient investor protection safeguards are in place.

These additional safeguards include for example conducting additional counterparty-related or AML-related due diligence, reducing clients’ exposure to counterparty risks via back-to-back transactions, sufficient risk disclosures to investors and safekeeping client VAs acquired elsewhere with VA custodians licensed by or registered with the SFC in Hong Kong.

If implemented, this would represent a significant expansion of the current regime, where SFC-licensed intermediaries acquiring VA on behalf of their clients must do so through omnibus accounts established at an SFC-licensed VATP and execute transactions only through the SFC-licensed VATP.

Third, licensed VA dealers will be required to hold client VA with licensed VA custodians in Hong Kong (see below).

5. VA dealing – Other regulatory requirements

Licensed VA dealers are also expected to fulfil the following proposed requirements:

• Adequate financial resources: Minimum paid-up share capital of HK$5 million, minimum required liquid capital of up to HK$3 million and excess liquid capital equivalent to at least 12 months of operating expenses, unless the licensee is an HKMA-authorized bank.
• Disclosure and notification: Information on the licensees’ wallet addresses used, scope and nature of the business and types of services provided must be disclosed and kept up to date.
• Other investor protection safeguards to be provided: Ensuring clients’ suitability by conducting VA knowledge assessments, risk assessments and risk profiling, setting client exposure limits and providing adequate training.

The SFC plans on conducting a separate consultation exercise covering (i) fitness and properness, (ii) ability and experience, (iii) AML/CFT controls and (iv) conduct and risk management of the VA dealing licensees.

6. VA custodian services – Proposed scope

The proposed VA custodian services licensing regime defines VA custodian services as the safekeeping of:

1. VA on behalf of clients; or
2. instruments enabling transfer of VA on behalf of clients, such as private keys, along with authentication credentials and smartcards.

Standalone VA custodians will be required to obtain licenses. Entities that are currently allowed by the HKMA or the SFC to provide VA custody services without additional licenses will also be required to obtain the new license:

• Associated entities of SFC-licensed VATPs responsible for storing assets of clients of the VATP (who currently only have TCSP licenses);
• Banks, subsidiaries of locally incorporated banks and stored value facilities that provide VA custodian services; and
• Licensed fund managers that provide self-custody to the funds under their management which invest in VA.

It is proposed that the following persons are not required to be licensed:

• A person who custodies his own VA;
• SFC or HKMA-regulated entities where the safekeeping of client VA is wholly incidental to the principal business of providing the VA service or carrying on of the licensed regulated activities;
• Stablecoin issuers licensed by the HKMA who custody the stablecoins they issue;
• Bank security vaults and security companies storing encrypted / de-activated back-up of private keys; and
• Technical service providers that support the provision of the VA custodian service but do not safekeep the private keys (or similar instruments) themselves, such as the service of providing communication or information technology networks.

7. VA custodian services – Permitted activities

The FSTB and SFC expect the scope of permitted activities for VA custodians to include:

1. safekeeping, deposit and withdrawal services for client VA; and
2. completing of settlement instructions of licensed intermediaries in relation to their VA services.

There are no proposed restrictions on the types of VA that a licensed VA custodian can accept.

Conversion or spot trading activities of VA would be considered VA dealing activities and would require a separate license under that regime.

8. VA custodian services – Other regulatory requirements

Licensees are also expected to fulfil the following proposed requirements:

• Compliance with regulatory requirements: Compliance with robust regulatory requirements in private key management, cybersecurity and business continuity planning; custody requirements currently imposed on SFC-licensed VATPs and Schedule 2 of the AMLO.
• Adequate financial resources: Minimum paid-up share capital of HK$10 million, minimum required liquid capital of up to HK$3 million, unless the licensee is an Authorised Institution.
• Proper knowledge and experience: Sufficient corporate governance structure is required to perform the required activities. Staff members who perform more than a clerical role in a business function directly relating to the VA custodian’s discharge of its regulatory obligations should seek to be licensed or be engaged as relevant individuals.
• Disclosure and notification: Information on the licensees’ wallet addresses used, scope and nature of the business and types of services provided must be disclosed and kept up to date.

9. Transitional periods

The licensing regimes for VA dealing and custodian service providers are expected to become fully effective on the commencement date of the relevant statutory provisions (i.e., there will be no transitional period).

The consultation period will end on August 29, 2025. It is currently unclear when the regime will come into force.