An authoritative application guide based on SFC official guidelines and Aiying's practical experience: Upgrading Hong Kong Type 4 and Type 9 VA licenses? SFC Type 4 and Type 9 VA upgrade?
Market Access
Safeguards
Policy development
Innovation support
Supervision and Execution
Hong Kong's securities regulatory framework provides the legal basis for VA business upgrades. This process is formally known as applying to the SFC to vary or expand the business scope of an existing license.
Standardize the anti-money laundering and counter-terrorist financing requirements for VA business, including special requirements such as the Travel Rule and on-chain transaction monitoring.
"Terms and Conditions Applicable to Licensed Corporations or Registered Institutions Managing Portfolios Investing in Virtual Assets", the core operating principles of the upgraded license.
• VA business upgrade review for license plates 4 and 9
• Issuance and supervision of VATP licenses
• VA fund recognition and oversight
• Investor protection and market integrity maintenance
• VA Business Guidelines for the Banking Industry
• Custody Services Regulation
• Payment system supervision
• Jointly issued supervisory circular with SFC
Ensure that VA business and traditional financial business are subject to the same regulatory standards at the same risk level
Ensure that investors' rights and interests are fully protected
Maintain a fair and transparent market environment
Preventing systemic financial risks
Supporting the innovative development of financial technology
| Licence type | Business scope | Regulatory focus | Capital requirements | Upgrade trigger point |
|---|---|---|---|---|
| No. 4 license + VA securities consulting upgrade | Securities consulting (including VA-related securities) | Quality of investment advice and client suitability | HK$100,000+ | STO, VA ETF investment advisory services |
| No. Type 9 licence + VA Asset Management Upgrade | Asset management (including VA investment) | Portfolio management, custody arrangements | HK$3,000,000+ | 10% GAV threshold and clear investment goals |
| VATP trading platform license | VA trading platform operation | Platform security and market supervision | HK$5,000,000+ | Independent application (dual license) |
What is the "VA Business Upgrade" for No. 4/No. Type 9 licences?
Apply to the SFC to change or expand the business scope of the existing license
Securities and Futures Ordinance (SFO)
Joint Circular and Guidance Issued by the SFC and HKMA
Specific terms and conditions attached to the licence, such as VAFM T&Cs
Important Reminder: When a licensed entity successfully "upgrades," its license will be subject to specific terms and conditions, such as compliance with VAFM T&Cs. These terms and conditions define the legal boundaries and operational guidelines for its VA business. Therefore, the entire process is a prudent expansion within the existing regulatory framework, rather than starting from scratch.
The fund prospectus or investment authorization (Investment Mandate) clearly states that investing in virtual assets is one of its main investment objectives.
The fund or portfolio plans to invest 10% or more of its gross asset value (Gross Asset Value) in virtual assets.
If the VA holdings exceed 10% passively due solely to market fluctuations and the manager is taking reasonable steps to reduce them below the threshold as soon as possible, an exemption may be granted. However, if this situation is expected to continue, it must still be reported to the SFC.
Providing advice to clients on buying, selling, or holding security tokens representing equity, debt, or other economic interests.
Providing investment advice on virtual asset spot ETFs approved in Hong Kong, such as Bitcoin and Ethereum ETFs.
Provide advice on certain platform coins or governance tokens that may be identified by the SFC as having characteristics of a “collective investment scheme (CIS)”.
A key compliance risk is misclassification. If a licensed person mistakenly provides advice to a VA that should be considered a "securities VA" as a non-securities VA, they will face serious compliance risks.
A comprehensive self-assessment checklist before starting your application
Before formally submitting an application to the SFC, a significant investment of time and money, it's crucial to conduct a thorough and prudent internal gap analysis. This not only significantly increases the chances of a successful application but also helps institutions identify potential operational risks. The SFC explicitly states that the onus is on applicants to demonstrate they are "fit and proper."
• Confirm that the company currently holds a valid SFC Type 4 or/and Type 9 license
• No significant, unresolved violations in the past
• Any pending regulatory review could pose a hurdle to upgrading the application
• The applicant must be a limited company registered in Hong Kong
• The company must have a fixed, real physical office address in Hong Kong
• The SFC will focus on the company’s “substantive business” in Hong Kong
No. 9 card upgrade
At least one RO has no less than three years of directly related VA management experience
No. 4 card upgrade
RO needs to demonstrate a deep understanding of VA products and relevant investment analysis experience
Recognizing the talent shortage in the market, SFC has articulated a “pragmatic approach” in its official FAQ.
RO with only VA experience
Their experience may be considered relevant to traditional securities business, but conditions may be imposed on their licenses.
RO with only traditional financial experience
May be subject to a "non-sole" requirement and must work under the supervision of an experienced RO
Disassembly of the entire process from preparation to approval
2-4 months
• Establishment of a special task force
• Gap analysis
• Writing application documents
• Search for external auditors
1-2 weeks
• WINGS system submission
• Pay application fee of HK$4,740
• Obtain a case number
• Assign case director
3-6 months
• Respond to inquiries (1-3 rounds)
• Interview/site review
• Supplementary information
• Ongoing communication
1-2 months
• Approval in Principle (AIP)
• Meet licensing requirements
• Officially licensed
• Fulfilling ongoing responsibilities
| File category | file name | Core content points | Aiying Suggestions |
|---|---|---|---|
| Application Form | Business Scope Change Application Form | Accurately fill in the company's basic information, existing license details, and the VA business scope to be added | Must be signed by a person authorized by the board resolution |
| Personnel | RO/MIC Update Questionnaire and Resume | A detailed description of the VA-related experience, management responsibilities, and professional training of each RO and key MIC | Attach copies of HKSI test transcripts, CVAP and other training certificates |
| Business and Compliance | VA Business Plan | Business model, target customers, investment strategy, fee structure, risk management framework | Must be clear, pragmatic, and demonstrate a deep understanding of the business and risks |
| Technology and Security | Cybersecurity Policy and Assessment Report | Private key management system, multi-signature mechanism, access control strategy, disaster recovery plan | It is strongly recommended to attach a penetration test report issued by an independent third party |
| Finance | Capital adequacy ratio calculation table | Demonstrate compliance with liquid capital requirements based on the calculation methods of the FRR and VATP guidelines | Must be signed and confirmed by RO and financial director |
SFC license change application fee
HK$4,740
Legal and compliance advisory fees
HK$150,000-400,000+
External audit/assessment fees
HK$100,000-300,000+
Note: Actual costs may vary significantly depending on factors such as the complexity of the project, the applicant's preparation, the qualifications of the consulting firm, and its fee structure.
Internal preparation and document writing
2-4 months
SFC audit and inquiry
3-6 months
Meeting AIP conditions and final licensing
1-2 months
Note: The 15-week processing time promised by SFC only includes SFC's internal processing time and does not include the time for the applicant to respond to inquiries.
Provide strategic and actionable solutions to the most core pain points
In my experience, the SFC is most concerned with how a company manages risk, not its profit forecasts. The core of your business plan is to demonstrate to regulators your ability to implement a risk management and compliance framework for your VA business.
Key reminder: A business plan should be like a rigorous "operation manual," not a "fundraising roadshow PPT."
Asset custody is a top priority for the SFC, especially after the collapse of several exchanges around the world. The SFC has very clear preferences in this regard:
The ideal custodian should be an affiliated custodial entity of an SFC-licensed VATP, or a trust company regulated in a reputable jurisdiction (such as the United States) that specializes in digital asset custody. This maximizes asset segregation and professional management, and offers the highest regulatory approval, but also carries higher costs.
Some technology companies offer custody solutions based on technologies like MPC (Multi-Party Computation). While these aren't independent legal entities, they technically enable sharded private key management. The SFC maintains an open but cautious approach to these solutions, rigorously reviewing their technical security, audit reports, and insurance coverage. While these solutions offer relatively low costs, they require more rigorous scrutiny.
Unless the applicant can demonstrate technical security capabilities, internal control systems, and corporate governance comparable to those of top-tier financial institutions, and pass the most rigorous independent third-party audits (such as SOC 2 Type II), it will be extremely difficult for the SFC to approve this proposal. For most asset management companies, this path is extremely difficult and costly, requiring technical security capabilities at the level of top-tier financial institutions.
Mandatory requirements: Regardless of the option chosen, it must meet two mandatory requirements: 98% of assets must be deposited into a cold wallet and adequate insurance coverage must be provided.
This depends on the nature of the fund and the type of investors. The SFC adopts a tiered and prudent approach to this:
Currently, the SFC only allows funds open to retail investors to invest in highly liquid, large-cap tokens, primarily those included in at least two recognized independent indices. Currently, this is effectively limited to Bitcoin (BTC) and Ethereum (ETH).
Conclusion: It is virtually impossible to get approved for retail funds that invest in NFTs or directly participate in complex DeFi protocols at this stage.
The SFC provides greater flexibility for funds open only to professional investors (PIs). In theory, they can invest in NFTs or participate in DeFi strategies, but this requires case-by-case consultation with the SFC.
Conditions that must be proven:
• The team has deep expertise and management experience in these specific areas
• A very robust risk management framework has been established specifically to address these new risks
Aiying suggests that in the initial application stage, a wise strategy is to start with mainstream, highly liquid tokens. Once the license is approved and a good regulatory track record is established, you can gradually communicate with the SFC to expand to more complex asset classes.
The SFC has a zero-tolerance policy towards "nominal ROs." Proving the RO's substantive involvement is key to ongoing compliance and a key focus of license reviews.
The core red line: The RO must be an "insider" of the VA business, not just a name on compliance documents. This is one of the core red lines of SFC regulation.
Create a record of decisions
Evidence of the RO's involvement in key VA business decisions must be retained. Examples include: investment committee meeting minutes (with the RO's signature), email records approving new VA investments or new custodians, and attendance records at venture capital meetings.
Ensure RO is informed
ROs must be able to clearly and accurately explain to the SFC the company's VA business strategy, risk management details, compliance procedures, and the latest market trends. If an RO is completely clueless about the business during an SFC interview or on-site inspection, it will be considered a serious red flag.
Clear division of responsibilities
In the company's organizational chart and job description, clearly define the RO's specific supervisory and management responsibilities in VA business and ensure that he or she has the corresponding authority.
Regular internal reporting
Establish a formal internal reporting mechanism to ensure that business and operations teams regularly report to the RO on the status of VA business, risk events and compliance status.
Aiying (License.aiying.cc) specializes in global traditional finance and Web3-related license application and acquisition consulting services. With teams primarily located in Hong Kong, the UAE, and Europe, and strong relationships with local regulators, Aiying has successfully secured applications and smooth operations for leading and mid-tier crypto and traditional institutions. Team members are qualified in Hong Kong, Europe (Ireland), the UK, the UAE, and other jurisdictions, with a global network ensuring 24/7 professional support. Headquartered in Asia, the team brings together experts in operations, marketing, law, regulatory compliance, and accounting, adhering to clients' business objectives to provide comprehensive and in-depth strategies and solutions.
Based on SFC official guidelines and Aiying's practical experience, we provide the most authoritative application guidance.
Detailed self-checklist and document preparation guide to ensure the completeness and accuracy of application materials
100+ successful case experience summary, avoid common pitfalls and improve success rate
Integrate international best practices to ensure the forward-looking and adaptable compliance system
To maximize your success rate, Aiying conducts an internal mock review of your application materials before formal submission. Our expert team acts as a regulator, scrutinizing each document from the most rigorous perspective to identify logical loopholes, data inconsistencies, and compliance gaps in advance.
This mechanism allows us to ensure that the materials submitted to regulators are highly professional, complete, and impeccable, thereby minimizing regulatory inquiry rounds, significantly shortening approval times, and reducing the license rejection rate by 67%.
In-depth analysis of the key points and latest developments in VA1 license application
The following is a list of financial institutions that have obtained virtual asset business licenses, as publicly disclosed by the Securities and Futures Commission (SFC) of Hong Kong, showing the actual development status of the Hong Kong VA market.
| Institution type | Organization name | status |
|---|---|---|
| asset management company | HashKey Capital Limited | Licensed |
| asset management company | BC Technology Group | Licensed |
| asset management company | Venture Smart Asia Limited | Licensed |
| asset management company | Amber Group (HK) Limited | Licensed |
| Traditional financial institutions | Bosera Asset Management | Licensed |
| Traditional financial institutions | China Asset Management | Licensed |
| Traditional financial institutions | Harvest Global Investments | Licensed |
| Traditional financial institutions | Other applicant institutions | Under review |
| Institution type | Organization name | status |
|---|---|---|
| asset management company | HashKey Capital Limited | Licensed |
| asset management company | BC Technology Group | Licensed |
| asset management company | Venture Smart Asia Limited | Licensed |
| asset management company | Amber Group (HK) Limited | Licensed |
| Traditional financial institutions | Bosera Asset Management | Licensed |
| Traditional financial institutions | China Asset Management | Licensed |
| Traditional financial institutions | Harvest Global Investments | Licensed |
| Traditional financial institutions | Other applicant institutions | Under review |
No. Type 9 licence + VA agency
No. 4 license plate + VA agency
Applicant Institutions
Assets under management
The number of licensed institutions has grown rapidly in the past two years, indicating the market's activeness.
Covering various types such as traditional financial institutions, financial technology companies, etc.
The supervision framework is becoming increasingly perfect, providing guarantees for more institutions to enter
