Crypto ATM / kiosk operator in Hong Kong
Physical kiosks that exchange cash for crypto (and sometimes vice versa). High-cash AML risk profile.
Crypto ATM is conditionally permitted in Hong Kong with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- VATP licensees must comply with AMLO Part 5B AML/CTF requirements including customer due diligence (CDD), record-keeping, and suspicious transaction reporting to JFIU.
- Cash transaction reporting: HKD 120,000 or above (or equivalent in foreign currency) triggers a cash transaction report (CTR) under the Organized and Serious Crimes Ordinance (OSCO) — this directly applies to a cash-intensive ATM/kiosk model.
- Suspicious Transaction Reports (STRs) must be filed with JFIU when there are reasonable grounds to suspect proceeds of crime or terrorist financing.
- Enhanced Due Diligence (EDD) required for high-risk situations including cash-intensive business models, non-face-to-face transactions, and PEPs.
- Ongoing monitoring obligations apply to all transactions through the kiosk, including source-of-funds scrutiny on cash deposits above prescribed thresholds.
Key Restrictions
- Must obtain VATP license from SFC — this covers the exchange/transmission element of kiosk operations (cash-to-crypto conversion).
- Minimum paid-up capital of HKD 5M (~USD 640K) required.
- 98% of customer crypto assets must be held in cold storage — one of the strictest cold-storage requirements globally.
- Only SFC-approved tokens may be offered for retail trading via kiosks.
- Client assets must be held on trust and segregated; insurance against cyber risks/theft required.
- 12–18 month estimated application timeline for VATP license.
- Kiosks constitute 'ATMs' or 'automated trading platforms' — likely fall under the SFC's VATP regime as they provide crypto trading services to the public.
- OTC desk operations (if bundled) are currently unregulated but SFC has signaled future regulation.
Key Risks
- Cash-intensive kiosk model attracts heightened AML scrutiny from both SFC and HK Police/JFIU.
- Regulatory ambiguity: No specific 'kiosk' or 'crypto ATM' license category exists — operators must self-classify under the VATP framework, creating interpretive risk.
- Strict 98% cold-storage rule may create operational complexity for a kiosk model that requires hot-wallet liquidity for cash-out transactions.
- Potential for regulatory action if kiosks are deemed to be unlicensed automated trading venues or money transmitters outside the VATP scope.
- Only a short list of SFC-approved retail tokens — limits token selection available at kiosks.
- Kiosk location-based licensing/registration requirements with local authorities (e.g., Hong Kong Police for money-changer licenses) may overlap or conflict with VATP regime.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
AMLO (Cap. 615) Part 5B, inserted by the AMLO (Amendment) Ordinance 2022 (Ord. No. 15 of 2022, gazetted 16 December 2022), introduced mandatory SFC licensing of centralised virtual asset trading platforms from 1 June 2023; licensed platforms may serve both professional and retail investors, subject to SFC token-admission and investor-protection requirements.
A VATP licence from the SFC under AMLO Part 5B has been mandatory since 1 June 2023. The SFC VATP Guidelines require paid-up share capital of at least HK$5,000,000 and liquid capital of at least the higher of HK$3,000,000 and the Financial Resources Rules basic amount (paras 6.2-6.3), storage of 98% of client virtual assets in cold storage (para 10.6(c)), and large-cap index tests for retail-tradable tokens (para 7.8). The SFC list shows OSL Exchange (licensed 15/12/2020) and HashKey Exchange (09/11/2022) as the earliest licensed platforms; 13 were licensed on 12 Oct 2026.
Under the SFC Guidelines for Virtual Asset Trading Platform Operators (June 2023), a licensed platform operator must hold client assets on trust through a wholly owned Associated Entity (para 10.1), store 98% of client virtual assets in cold storage (para 10.6(c)), and keep an SFC-approved compensation arrangement covering 50% of client VAs in cold storage and 100% in hot and other storage (para 10.22). A separate licensing regime for VA custodians outside trading platforms is a proposal (FSTB/SFC conclusions of 24 Dec 2025), not yet law.
SFC — licenses VA trading platforms under AMLO Part 5B (13 licensed as of 12 October 2026) and SFO Types 1/7 for security tokens; supervision and enforcement
JFIU — Joint Financial Intelligence Unit — suspicious transaction reports
Anti-Money Laundering (AML) Ordinance: Audits may check compliance with financial crime prevention.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — Crypto ATM/kiosk operators in Hong Kong require a VATP license from the SFC (HKD 5M capital, 98% cold storage, 12-18 month timeline) and must comply with full AMLO Part 5B AML obligations including cash transaction reporting, but no specific kiosk/ATM license category exists, creating regulatory classification risk.
Questions this verdict aims to answer
- What money-transmitter / kiosk-specific license is required?
- What cash-transaction reporting thresholds apply?
- What enhanced-KYC obligations attach to cash-in / cash-out?