The Sumsuber

Best practices for KYC/AML

How to
4 min read

Everything You Need to Know About Hong Kong’s New Crypto Exchange Licensing Regime [Updated November 2021]

Hong Kong has recently announced a new regulatory licensing regime for the crypto sector. What do you need to do to stay compliant? Let’s clear things up.

On May 21st, 2021, the Hong Kong Financial Services and the Treasury Bureau (FSTB) issued their consultation conclusions on the introduction of a new regulatory framework for virtual asset service providers (VASP).

Under the proposed rules, Hong Kong will introduce a new licensing regime for crypto businesses. Accordingly, crypto firms operating in Hong Kong should understand the new regulatory landscape and how their compliance obligations may change.

The highlights

  1. The current regulatory framework
  2. New licensing regime
  3. Who is affected
  4. How to get licensed
  5. Regulatory requirements for licensed businesses
  6. Sanctions
  7. Timing and next steps

The current regulatory framework

The Securities and Futures Commission (SFC) introduced the current regulatory framework in 2019. This document outlined the risks associated with virtual assets and introduced a licensing regime for certain types of virtual assets falling under Hong Kong’s Securities and Futures Ordinance. This includes stocks, bonds, futures contracts, and funds (and services related to these products).

According to the SFC Framework, Hong Kong now only regulates businesses that deal with virtual currencies that are “securities” or “futures contracts”. As a result, platforms that trade in non-security virtual assets—such as Bitcoin—fall outside the regulatory scope.

To address the limitations of the 2019 Regulatory Framework, Hong Kong authorities recently proposed a new licensing regime for all VASPs.

New licensing regime

In November 2020, the Hong Kong Financial Services and the Treasury Bureau (FSTB) began a consultation period on a proposed regulatory framework for crypto businesses. The consultation period ran until 31st January 2021 and led to the approval of the proposed framework.

The new regulations require all VASPs in Hong Kong to obtain an SFC license. Those who are not licensed will be prohibited from actively marketing to the local public. To get the license, businesses must pass the SFC’s fit-and-proper test and comply with many regulatory requirements (which we explain below).

Who is affected

The new regulation affects “any person seeking to engage in the business of operating a virtual asset exchange in Hong Kong”. In other words, it covers anyone who is involved in the following business activities:

  • The selling or buying of cryptocurrencies;
  • Transferring and exchanging cryptocurrencies;
  • The storage or management of virtual assets as a part of a company’s business.

Crypto trading platforms that enable trading in financial products (securities and futures contracts) don’t fall under the new licensing regime since they’re already regulated under the SFO.

Note that the new licensing regime extends to all crypto exchanges registered in Hong Kong under the Companies Ordinance (Cap. 622). These include exchanges based outside HK that actively market to Hong Kong’s citizens.

How to get licensed

Under the proposed regime, crypto businesses must obtain a license from the SFC, Hong Kong’s securities and futures regulator. Here are three main requirements for getting the license.

  • Be incorporated in Hong Kong;
  • Pass a ‘fit and proper’ test that involves criminal background checks, AML/CFT performance history, and financial standing;
  • Appoint at least 2 officers who will be personally responsible for overseeing compliance.

This means that crypto businesses must critically review their existing policies, procedures, and internal controls in order to get the license.

Get some rest while Sumsub takes care of your compliance obligations. Talk to our team today.

Regulatory requirements for licensed businesses

Under the new regulation, crypto businesses can only provide their services to certain types of customers and must follow a wide range of regulatory requirements. Now, crypto businesses must:

  • Introduce AML/CTF measures, including customer due diligence and record-keeping;
  • Follow requirements for managing financial resources, including financial reporting, prevention of market manipulation, etc.;
  • Comply with requirements designed to protect market integrity and investor interests (these will be set out in future SFC guidelines);
  • Provide services only to professional investors, i.e. high net worth and institutional investors (this means that crypto businesses can’t offer services to retail investors);
  • Impose strict criteria when choosing virtual assets to be traded.

Violating these rules bears serious consequences for businesses. Let’s go over the exact sanctions.


If businesses operate without a license or otherwise violate AML rules, they can be fined as much as $5,000,000 in fines, while senior management can face imprisonment for up to seven years. Here’s a breakdown of the exact sanctions businesses can face:

Conducting business without a license: a fine of $5,000,000 and imprisonment for up to seven years. In case of a continuing offense, an additional fine of $100,000 for each day the offense continues;

Provision of false, deceptive, or misleading statements about a business’s compliance status when filing a license application: a fine of $1,000,000 and imprisonment for up to two years;

Non-compliance with AML/CTF requirements: a fine of $1,000,000 and imprisonment for up to two years;

Fraudulent or reckless misrepresentation to induce another person to acquire or dispose of virtual currencies: a fine of $1,000,000 and imprisonment for up to two years.

The SFC will be given broad powers to supervise AML/CTF and regulatory compliance by licensed VASPs. This will include powers to impose sanctions.

Timing and next steps

It’s expected that the new licensing regime for VASPs will be introduced in the 2021-22 legislative sessions, which runs from October 2021 until the summer recess in July 2022.

When to start preparing: Since the requirements are already approved, businesses should start preparing now. Although there will be a 180-day transition period, businesses should use this time wisely, as it may take time and resources to design and implement new requirements.

What to do: We recommend starting by reviewing your existing AML/CTF policies and controls to identify potential gaps with the requirements. Then, introduce the missing elements and stay updated on future SFC guidelines.

We’ll continue to track all the changes and will update this article on an ongoing basis. Stay tuned so you don’t miss any important news.

Complying with new requirements can be much easier with our complete AML/KYC solution.

See Sumsub in action