Remote VASP serving residents in Hong Kong
Foreign-incorporated entity that offers exchange, custody, or transfer services to residents of a jurisdiction without establishing a local entity or office.
Remote VASP is conditionally permitted in Hong Kong with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- VATP licensee must comply with AMLO (Part 5B, Cap 615, amended 2023) AML/CTF obligations including CDD, record-keeping, and suspicious transaction reporting to JFIU
- Travel Rule applies with threshold of HKD 8,000 — VASPs must transmit originator and beneficiary information for qualifying transfers
- SFC supervises AML compliance for licensed VATPs; HKMA provides FATF-related updates on AML/CTF standards
- Ongoing obligation to report suspicious transactions to the Joint Financial Intelligence Unit (JFIU)
- Minimum paid-up capital of HKD 5M (~$640K USD) serves as a financial soundness requirement that underpins AML compliance capacity
Key Restrictions
- Remote (non-local) VASPs serving HK residents without a local entity and SFC VATP license are operating unlawfully — VATP license is mandatory since June 1, 2023 for all platforms serving the Hong Kong public
- Must be incorporated/registered in Hong Kong to obtain a VATP license (local entity required)
- 98% cold storage requirement applies to licensed VASPs — one of the strictest globally
- Retail trading is permitted but only for approved tokens; operators cannot offer unapproved virtual assets to retail investors
- Insurance coverage against cyber risks and theft is required
- Client assets must be held on trust and segregated
Key Risks
- High enforcement risk for unlicensed remote operators — SFC has enforcement powers under AMLO Part 5B and SFO and has publicly signalled enforcement against unlicensed platforms
- Binance.com was placed on SFC's Alert List in previous years, demonstrating precedent for enforcement action against non-compliant remote VASPs
- No grandfathering or deemed-licensed status — the 'deemed-to-be-licensed' applicant list exists for pending applicants but does not confer licensed status
- Operators could face criminal liability and fines under AMLO Part 5B for operating without a license
- Banking access is restricted — HKMA has directed banks to serve licensed firms, making compliance difficult for unlicensed operators
- 12-18 month VATP application timeline creates prolonged exposure period
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
SFC — licenses VA trading platforms under AMLO Part 5B (13 licensed as of 12 October 2026) and SFO Types 1/7 for security tokens; supervision and enforcement
AMLO (Cap. 615) Part 5B, inserted by the AMLO (Amendment) Ordinance 2022 (Ord. No. 15 of 2022, gazetted 16 December 2022), introduced mandatory SFC licensing of centralised virtual asset trading platforms from 1 June 2023; licensed platforms may serve both professional and retail investors, subject to SFC token-admission and investor-protection requirements.
A VATP licence from the SFC under AMLO Part 5B has been mandatory since 1 June 2023. The SFC VATP Guidelines require paid-up share capital of at least HK$5,000,000 and liquid capital of at least the higher of HK$3,000,000 and the Financial Resources Rules basic amount (paras 6.2-6.3), storage of 98% of client virtual assets in cold storage (para 10.6(c)), and large-cap index tests for retail-tradable tokens (para 7.8). The SFC list shows OSL Exchange (licensed 15/12/2020) and HashKey Exchange (09/11/2022) as the earliest licensed platforms; 13 were licensed on 12 Oct 2026.
An SFC licence under AMLO Part 5B has been required since 1 June 2023 for any centralised virtual asset exchange carrying on business in Hong Kong or actively marketing to Hong Kong investors. OTC virtual asset dealing has no dedicated licensing regime yet: the FSTB and SFC concluded their VA dealer and custodian consultation on 24 Dec 2025 and target a bill in 2026.
Hong Kong's travel rule for SFC-licensed VASPs applies from 1 June 2023 under AMLO Sch. 2 s.13A; transfers of HK$8,000 or more need fuller originator data and verification, and smaller transfers still need names and account numbers (SFC AML/CFT Guideline paras 12.11.5–12.11.6).
The HKMA FATF travel‑rule updates linked on https://www.hkma.gov.hk/eng/key-functions/banking/anti-money-laundering-and-counter-financing-of-terrorism/fatf-related-statments-update/ no longer reflect the most recent Hong Kong SAR China regulatory stance as of November 2023.
JFIU — Joint Financial Intelligence Unit — suspicious transaction reports
Under the SFC Guidelines for Virtual Asset Trading Platform Operators (June 2023), a licensed platform operator must hold client assets on trust through a wholly owned Associated Entity (para 10.1), store 98% of client virtual assets in cold storage (para 10.6(c)), and keep an SFC-approved compensation arrangement covering 50% of client VAs in cold storage and 100% in hot and other storage (para 10.22). A separate licensing regime for VA custodians outside trading platforms is a proposal (FSTB/SFC conclusions of 24 Dec 2025), not yet law.
The SFC's List of virtual asset trading platform applicants (last updated 12 Oct 2026) includes applicants deemed to be licensed from 1 June 2024 under Schedule 3G to the AMLO (Cap. 615); the SFC states that deemed-to-be-licensed applicants are NOT formally licensed. On 12 Oct 2026 the list named 5 applicants, 2 of them deemed (Foris DAX HK / Crypto.com and Whalefin Markets / WhaleFin).
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a non-resident VASP may only serve Hong Kong residents from abroad if it establishes a local entity, obtains an SFC VATP license (high burden, HKD 5M capital, 12-18 months), and complies with AMLO obligations including a HKD 8,000 Travel Rule; unlicensed remote operation carries serious enforcement risk.
Questions this verdict aims to answer
- May a non-resident provider serve residents from abroad?
- Does cross-border service trigger licensing, registration, or AML obligations?
- What enforcement risk exists for unlicensed remote operators?