How to get ready for Hong Kong's next wave of virtual asset licensingHow to get ready for Hong Kong's next wave of virtual asset licensing

In December 2025 and May 2026, the Financial Services and the Treasury Bureau (FSTB) and the Securities and Futures Commission (SFC) published consultation conclusions on legislative proposals to regulate virtual asset (VA) dealing, custody, advisory and management services in Hong Kong. Even though the bill implementing them has not yet reached the Legislative Council, the proposals are detailed enough to act on. For compliance teams at banks, payment firms and cryptoasset businesses operating in or into Hong Kong, the conclusions show where a four-license expansion of the city's VA perimeter is heading, and where firms most often get their planning wrong:

• Assuming an existing Type 1, Type 4, Type 9 or virtual asset trading platform (VATP) license already covers the new VA activity
• Treating the "no grandfathering" position as an all-or-nothing cliff edge, rather than a prompt to engage the SFC early
• Building remediation plans around specific capital figures that could still move before the bill is finalized
• Leaving governance ownership of the licensing program undefined until the bill lands

For compliance officers, the consultation conclusions set out Hong Kong's direction. The findings need to be translated into repeatable, auditable steps across the risk management lifecycle, the same five-stage model most compliance functions already run for AML/CFT and operational risk. Governance assigns ownership and accountability for the program. Identification maps where VA exposure actually sits across the business. Assessment sizes the gap between current capability and what will be required. Monitoring keeps that picture current as both the firm and the regulatory position evolve. Reporting gives senior management and the board the visibility to act on all of the above. Run as a connected system, this is where a compliance program moves from reacting to a bill that has not landed yet to building readiness that will hold up once it does.

Why the scrutiny on VA dealing, custody, advisory and management

Hong Kong's VA perimeter has been expanding since 2023. VATPs have needed an SFC license since 2023 and fiat-referenced stablecoin issuers have needed a Hong Kong Monetary Authority (HKMA) license since the Stablecoins Ordinance took effect in 2025. The FSTB and SFC opened consultation on VA dealing and custodian licensing in June 2025, closing on August 29, 2025, after 101 submissions on dealing and 93 on custody.

Each of the four proposed licenses mirrors an existing Securities and Futures Ordinance (SFO) pillar (dealing mirrors Type 1, advisory mirrors Type 4, management mirrors Type 9) but will sit as its own license under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO), the same statute underpinning the VATP regime. None of the four is bundled into an existing SFO, AMLO or VATP license, and regulators have been explicit there will be no deeming or grandfathering arrangement. Firms without an application in motion when the regime commences may need to pause VA-related operations entirely, which is exactly the kind of business disruption a structured readiness program is built to avoid.

1. Risk governance: deciding who owns this before anything else

Firms with no single owner for a licensing program tend to lose momentum once the initial burst of attention around a consultation deadline fades. Governance has to come first, not as a step to circle back to once the technical work is done, but as the foundation the other four stages sit on.

Practical steps for compliance officers:

• Assign a named senior owner, typically the MLRO, head of compliance or chief operating officer (COO), with explicit accountability for the program, and stand up a small steering group spanning compliance, product, legal, technology and finance.
• Embed VA dealing, custody, advisory and management risk explicitly into the firm's existing risk appetite statement, so none of the four activities sits as an unaddressed gap.
• Start drafting the policies that will need to exist on day one of licensing, including custody, VA-specific AML/CFT and marketing and promotion policies, as remediation work now rather than something to pick up later.

2. Risk identification: mapping where VA activity actually sits

Risk mapping is a familiar exercise for any firm that has already mapped an SFO-regulated perimeter. The same discipline just needs applying to virtual assets specifically. Dealing and custody map closely onto what VATPs already do on-platform today. Advisory and management are not unregulated activities right now, either: Firms already provide VA advice under existing Type 1 or Type 4 licenses, and already manage VA-exposed portfolios under existing Type 9 licenses, with SFC-imposed Virtual Asset Fund Manager terms applying once VA exposure crosses a de minimis threshold. 

What is new for both is a standalone license path for firms with no existing SFO base in these activities, plus the removal of that de minimis threshold for management. Any discretionary portfolio management involving any amount of VAs now requires appropriate licensing.

Practical steps for compliance officers:

• Map every current or planned revenue line, including over-the-counter (OTC) desks, execution services, discretionary VA mandates and VA-related advice, against the proposed definitions of VA dealing, advisory and management to identify which license, if any, each line requires.
• For asset managers specifically, check portfolios for any VA allocation, however small. The consultation conclusions confirm there will be no de minimis threshold, so even a modest VA exposure within an otherwise conventional mandate triggers a licensing requirement.
• Identify every point at which the firm holds, or has access to, private keys, and review current marketing of VA-related services to Hong Kong persons. Each is an independent gateway into licensing scope: key access can trigger the VA custodian license and marketing to the Hong Kong public can trigger the VA dealing license or its marketing prohibition, regardless of what the firm's main licensed activity is.
• Where the firm already holds a related SFO license and is providing some VA services today, confirm whether that activity is currently operating under a "VA top-up" condition on the existing license, an interim arrangement that will need to convert into a standalone application once the new regime commences.

3. Risk assessment: sizing the gap before you close it

This is the stage where readiness stops being a checklist and becomes a quantified plan. The number that matters most is the size of the gap between where the firm stands today and where it needs to be for each of the four activities it intends to pursue, not any single capital figure from the consultation conclusions, since those could still move before the bill is finalized.

Practical steps for compliance officers:

• Convene product, finance, legal and compliance together to size the gap for each activity: the capital position, the AML/CFT control changes needed, staff competence against the SFC's fit-and-proper bar, and any vendor or custody dependency.
• Attach a dollar cost and a time-to-close to every gap identified, so the board gets an actionable remediation plan, not a narrative.
• Flag any self-custody arrangement under consideration, particularly for asset managers holding early-stage or bespoke tokens, given the capital and licensing burden it triggers.
• Separately review for potential conflict of interests: incentives where a firm advises on or manages both traditional and VA assets for the same client. VA fee structures often differ from traditional ones, and with no de minimis threshold for VA management, the firm's own licensing exposure can start to influence allocation advice alongside client suitability.

4. Risk monitoring: building surveillance that survives the transition

Gap-closure is not a one-off exercise. Once shortfalls are identified and a remediation plan is underway, firms need monitoring arrangements that will still be fit for purpose once a license is granted.

Practical steps for compliance officers:

• Build or adapt transaction monitoring to operate at the wallet level, not just on transaction-value rules carried over from fiat systems: wallet clustering and attribution, multi-hop exposure scoring, cross-chain and bridge tracing, and wallet-level sanctions and darknet-market screening. Calibrate the risk rules and thresholds to the risk appetite statement set in the governance stage, so monitoring enforces a limit the firm deliberately chose.
• Establish a regulatory horizon-scanning process tracking SFC and FSTB announcements and the bill's progress through the Legislative Council, so changes to thresholds or scope are picked up as they happen.
• Periodically re-test custody and key-management controls, particularly where a third-party custodian is involved.
• Track pre-application engagement status with the SFC or HKMA as a monitored item in its own right. An expedited approval process is available to entities already assessed by the SFC or HKMA for a related activity, but letting that engagement lapse forfeits the benefit of it.

5. Risk reporting: making readiness visible to the board

Senior management and the board need visibility of licensing readiness in the same way they expect visibility of any other material compliance exposure, built now, well before a formal license condition requires it.

Practical steps for compliance officers:

• Build a management information pack tracking capital position, gap-closure progress and pre-application status, refreshed on a fixed cycle.
• Establish a board or senior-management reporting cadence for licensing readiness specifically, distinct from routine AML/CFT reporting, given there is no grandfathering cushion to fall back on.
• Prepare templates now for the disclosure and notification obligations licensees will face, such as wallet addresses and business scope, and define escalation triggers for capital or control breaches that route through the same framework as other regulatory risk.

The bottom line

Hong Kong's consultation conclusions set out, in granular detail, what a four-license expansion of the VA perimeter will require, even though the bill itself is still to come. Firms that treat the current window as preparation time, rather than waiting time, will be the ones positioned to apply promptly once the regime commences, and the ones least exposed to the operational disruption regulators have already warned about. 

One point is already confirmed rather than still open, and is worth building into that preparation now: VA managers do not need a separate dealing license for trading that is solely incidental to managing their own funds, confirmed in the May 2026 advisory and management conclusions. The use of virtual assets as payment for goods or services is not yet in that category. It remains one of the dealing exemptions still under consideration, not a settled position. Everything else, including the precise scope of "actively marketing" and several exemptions still under consideration, is a reason to build a compliance program around principles rather than a finished rulebook.

At Elliptic, we work closely with regulators, financial institutions and digital asset firms across Hong Kong and the wider APAC region. If your team is preparing for the next phase of Hong Kong's VA licensing regime, talk to our team today.