Custodial wallet / SaaS in Hong Kong
Hosted wallet provider that holds keys on behalf of end users, often white-labeled to businesses (custody as a service).
Custodial SaaS is conditionally permitted in Hong Kong with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- VATP licensees must comply with AMLO Part 5B (Cap 615) — mandatory AML/CTF policies, CDD/EDD, and record-keeping.
- Suspicious transaction reports must be filed with the JFIU (Joint Financial Intelligence Unit).
- Ongoing transaction monitoring and risk-based AML compliance program required under SFC supervision.
- White-label clients that themselves act as VASPs vis-à-vis end users may have independent AML obligations under AMLO; the SaaS operator must contractually allocate and verify compliance.
Key Restrictions
- Custodial wallet SaaS requires a VATP license from the SFC (AMLO Part 5B) — this covers all platforms serving the HK public, including hosted wallet/custody services.
- Minimum paid-up capital of HKD 5M (~$640K USD) for VATP license; additional HKD 5M if also operating Type 7 (automated trading) for security tokens, or HKD 3M for Type 1.
- 98% of client assets must be held in cold storage — one of the strictest cold-storage requirements globally.
- Client assets must be held on trust and segregated from the operator's own assets.
- Insurance must be held against cyber risks and theft.
- The license application timeline is 12–18 months; no unlicensed operation permitted during application period.
- Only approved tokens may be offered to retail investors.
Key Risks
- The SFC VATP licensing regime was only fully effective from June 2023 — precedent on enforcement action specific to custodial wallet SaaS is limited.
- Operators offering SaaS to white-label clients face ambiguity over whether the client (as a VASP) must separately license for their own end-user facing activities.
- The 'deemed-to-be-licensed' applicant list includes firms not yet licensed — operating while on this list carries risk and is not the same as being licensed.
- Custody-specific capital requirements under the VATP regime may not fully account for the multi-tenant, multi-jurisdictional nature of SaaS custody services.
- Compliance audits under Companies Ordinance (Cap. 622) and HKEX rules (if listed) add recurring cost and scrutiny.
- Forensic audit risk if fraud or embezzlement is suspected — SFC can assess financial status and integrity.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
SFC — licenses VA trading platforms under AMLO Part 5B (13 licensed as of 12 October 2026) and SFO Types 1/7 for security tokens; supervision and enforcement
AMLO (Cap. 615) Part 5B, inserted by the AMLO (Amendment) Ordinance 2022 (Ord. No. 15 of 2022, gazetted 16 December 2022), introduced mandatory SFC licensing of centralised virtual asset trading platforms from 1 June 2023; licensed platforms may serve both professional and retail investors, subject to SFC token-admission and investor-protection requirements.
Securities and Futures Ordinance (Cap. 571), in force since 1 April 2003: a virtual asset trading platform offering trading in security tokens needs SFC licences for Type 1 (dealing in securities) and Type 7 (providing automated trading services) regulated activities.
A VATP licence from the SFC under AMLO Part 5B has been mandatory since 1 June 2023. The SFC VATP Guidelines require paid-up share capital of at least HK$5,000,000 and liquid capital of at least the higher of HK$3,000,000 and the Financial Resources Rules basic amount (paras 6.2-6.3), storage of 98% of client virtual assets in cold storage (para 10.6(c)), and large-cap index tests for retail-tradable tokens (para 7.8). The SFC list shows OSL Exchange (licensed 15/12/2020) and HashKey Exchange (09/11/2022) as the earliest licensed platforms; 13 were licensed on 12 Oct 2026.
Under the SFC Guidelines for Virtual Asset Trading Platform Operators (June 2023), a licensed platform operator must hold client assets on trust through a wholly owned Associated Entity (para 10.1), store 98% of client virtual assets in cold storage (para 10.6(c)), and keep an SFC-approved compensation arrangement covering 50% of client VAs in cold storage and 100% in hot and other storage (para 10.22). A separate licensing regime for VA custodians outside trading platforms is a proposal (FSTB/SFC conclusions of 24 Dec 2025), not yet law.
JFIU — Joint Financial Intelligence Unit — suspicious transaction reports
HKMA — licenses fiat-referenced stablecoin issuers under the Stablecoins Ordinance (Cap. 656, in effect 1 August 2025; first two licences 10 April 2026), supervises banks, runs the Fintech Supervisory Sandbox
The SFC's public register of licensed persons and registered institutions lists all SFO licensees and registered institutions since 1 April 2003 and all AMLO licensees (licensed individuals and licensed providers) since the VASP regime commenced on 1 June 2023, searchable by name or CE number.
The SFC's List of virtual asset trading platform applicants (last updated 12 Oct 2026) includes applicants deemed to be licensed from 1 June 2024 under Schedule 3G to the AMLO (Cap. 615); the SFC states that deemed-to-be-licensed applicants are NOT formally licensed. On 12 Oct 2026 the list named 5 applicants, 2 of them deemed (Foris DAX HK / Crypto.com and Whalefin Markets / WhaleFin).
Companies Ordinance (Cap. 622): Mandates annual audits for most companies.
SFC assesses "financial status or solvency," "financial integrity," and disciplines for misconduct including fines, but no explicit protocol for fraud/missing funds suspicions.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — custodial wallet SaaS (white-label custody) is permitted in Hong Kong only under an SFC VATP license (AMLO Part 5B), requiring HKD 5M capital, 98% cold storage, client asset segregation, and cyber insurance, with a 12–18 month licensing timeline.
Questions this verdict aims to answer
- What custody license / qualified-custodian status applies?
- What segregation, insurance, and proof-of-reserves rules apply?
- What AML obligations attach to the SaaS vs the white-label client?