This comprehensive guide covers everything from private key custody and cold/hot wallet control to compliant operations, addressing search needs for Hong Kong VA Custody licenses, Hong Kong virtual asset custody licenses, Hong Kong crypto custody licenses, and more.
Minimum Paid-up Capital - ✓ Confirmed
Minimum Quick Capital - ✓ Confirmed
License application fee/annual fee - ◐ Proposed
Number of inquiries answered - ✓ Confirmed
01 / 11
Market Background and Motivation for Supervision
Currently, the regulation of virtual asset custody licenses in Hong Kong is fragmented across multiple frameworks. SFC-licensed VATPs must hold client VAs through their associated entities, which are subject to Part X of the VATP Guidelines and must comply with AML/CFT requirements and asset protection obligations, including strict controls on client VA segregation and private key management. SFC-licensed or registered intermediaries must entrust client VAs to SFC-licensed VATPs, banks, or subsidiaries of locally registered banks for custody.
Given the proposed implementation of a new licensing regime for virtual asset trading service providers, and the increasing number of virtual asset-related services and products (especially spot virtual asset exchange-traded funds recognized by the Securities and Futures Commission), regulators expect a significant increase in demand for virtual asset custody services.
— Summary of Consultation with the Financial Stability and Securities and Exchange Commission/Securities and Exchange Commission
While the aforementioned framework covers some custody scenarios, a large number of independent VA custody service providers (such as institutions providing custody services for OTC dealers, fund managers, and corporate clients) are currently unregulated. During a 2024 consultation on the licensing regime for VA OTC trading, the FSTB found that VA custody is often an integral part of many VA OTC activities, and these services are currently unregulated. With the increase in SFC-approved spot VA ETFs and other products, the demand for compliant custody services will increase significantly.
Hong Kong's introduction of a VA Custody licensing regime is part of a global trend in virtual asset regulation. The EU's MiCA framework, Singapore's revised PSA, and Japan's Payment Services Act have all established or are in the process of establishing independent VA custody regulatory frameworks. Hong Kong's move aims to align with international standards and solidify its position as a global virtual asset hub.
June 2023
VATP licensing system officially implemented
June 2024
FSTB provides consultation on VA OTC trading licenses.
June 27, 2025
FSTB/SFC jointly released a consultation document on VA Custody
August 29, 2025
Consultation period ends (93 responses received)
December 24, 2025
Release Consultation Summary
2026
The bill is expected to be submitted to the Legislative Council.
Number of consultation responses
93份
Coverage of license types
VA Custody + VA Dealing + VA Advisory + VA Management
Amendment of laws
AMLO (Cap. 615)
regulatory agency
SFC (Main) + HKMA (Bank/SVF)
02 / 11
License Definition and Core Concepts
— AMLO Amendments (Proposed)
The consultation summary made significant revisions to the original definition. The original consultation document proposed a definition encompassing two levels: (i) custodianship of VA on behalf of clients; and (ii) custodianship of instruments capable of transferring VA on behalf of clients. The final confirmed definition retains only level (ii), focusing on entities that hold private keys or similar instruments (such as smart cards, authentication credentials for accessing private keys). This revision is based on a risk-based approach, aiming to ensure that the licensing regime targets the "core risk area" in VA custody—the entity holding the private keys—rather than administrative upper-level trustees or fund managers.
The consultation summary provides important guidance on whether MPC (Multi-Party Computing) service providers need a license. The SFC will evaluate each case individually, with the core criterion being "whether the individual can unilaterally transfer the customer's VA (Value Attribution)."
MPC provider customers can transfer VA themselves, and customers have the ability to independently rebuild the complete private key or restore access to VA without the support of MPC provider.
Customers cannot unilaterally transfer VA (e.g., the MPC service provider does not provide a recovery toolkit).
Industry Impact: This guidance indicates that the SFC will allow the industry to use MPC solutions, which is an important and welcome development. Meanwhile, MPC providers offering direct-hosted Wallets-as-a-Service or embedded wallet solutions may not require a VA Custody license.
| Attributes | Details | Certainty |
|---|---|---|
| License Name | VA Custodian Service Provider License | Confirmed |
| Regulatory laws | AMLO (Cap. 615) Revision | Confirmed |
| Major regulatory agencies | SFC (Securities and Futures Commission) | Confirmed |
| Banking regulators | HKMA (Hong Kong Monetary Authority, frontline regulator of banks and SVF) | Confirmed |
| Core Definition | Store tools that enable the transfer of Virtual Assets (Va) (such as private keys). | Confirmed |
| Technological neutrality | No specific technical solution is required (MPC, HSM, etc. are all acceptable). | Confirmed |
| Licence validity period | Pending legislative confirmation | To be confirmed |
| Expected legislative time | The bill will be submitted to the Legislative Council in 2026. | Confirmed |
03 / 11
Applicable subjects and exemptions
| Exemption type | Details | Certainty |
|---|---|---|
| Group internal management | This applies only to entities that host VA (regardless of whether or not they are charged) for the group company. | Confirmed |
| Stablecoin issuers | HKMA-licensed stablecoin issuers (Stablecoin Ordinance Cap. 656) only hold custody of their own issued stablecoins. | Confirmed |
| Legal/Accounting Professionals | Legal and accounting professionals entrusted with safekeeping private key backups or appointed by the court to manage VA assets. | Confirmed |
| Custody | For SFC/HKMA regulated entities, VA custody is entirely an adjunct to their core business and they do not hold customer private keys. | Confirmed |
| Tokenized Securities Custody | Custodians that only hold tokenized securities (securities and futures contracts are not included in the VA definition under AMLO). | Confirmed |
| New tokens are self-custodied. | Fund managers are exempt from limited self-custody of newly issued tokens (with an upper limit). | Proposed |
SFC-regulated VA hosting service providers can utilize overseas group resources and infrastructure without requiring separate licenses from overseas group members. However, the following conditions must be met:
It is worth noting that the SFC has indicated its willingness to issue licenses to offshore entities. This is a significant departure from the SFC's traditional practice under the SFO, which only licenses entities providing regulated activities in Hong Kong.
04 / 11
Scope of Hosting and Licensed Activities
The core business of a VA Custody license is to safeguard tools that enable clients to transfer virtual assets, primarily private keys and similar tools (such as smart cards, authentication credentials for accessing private keys, etc.). The definition adopts a technology-neutral principle and does not restrict specific technical solutions.
Providing collateralized lending services is permitted, but robust safeguards must be implemented in accordance with the SFC's collateralization guidelines issued in April 2025.
Custody services for tokenized securities can be provided additionally.
SFC does not restrict the types of VAs that licensed VA custodians can custody, but the following conditions must be met:
The SFC will develop regulatory requirements for VA custodian service providers based on Part X of the VATP guidelines, taking into account the ratio and requirements for cold and hot wallet storage, insurance or other indemnification arrangements, private key management controls, independent audits and assessments, business continuity and disaster recovery plans.
Reference: The current VATP regime requires 98% of customer VA to be stored in cold wallets. SFC is expected to adopt a similar but more flexible dynamic approach for VA custodians.
05 / 11
Application Requirement
Minimum paid-up share capital of HK$1,000 million + quick capital of HK$3 million
Claim
Amount of money
Explain
Minimum Paid-up Capital
HK$1,000 million
Alignment with SFO Type 13 Regulated Activities Standards
Minimum quick capital
HK$3 million
Continue to maintain demand
Bank Exemption
not applicable
Banks are subject to existing capital requirements of the HKMA.
SFC discretion
It depends on the situation
SFC reserves the right to impose additional financial resource requirements based on the size and complexity of the business.
The applicant, the actual shareholder, and the executive officer must all pass the evaluation.
In accordance with the requirements for VATP under AMLO, the following personnel must undergo appropriate candidate evaluation:
When evaluating suitable candidates, the SFC will consider:
Core hosting staff must obtain personal licenses.
All individuals performing "core custodial functions" within the custodial chain must obtain an individual license.
Character
Explain
Senior Management
Senior executive responsible for overseeing and managing VA managed services
Private key contact
Personnel with direct access to the private key or authorized to initiate/approve VA transfers
Multiple signature participants
Personnel involved in multi-signature or threshold signature schemes
system administrator
Personnel authorized to access, store, or restore the private key system
Personnel who do not require a personal license: those who perform clerical roles (such as document filing, data entry and other routine tasks) and personnel in internal functional departments (such as human resources, finance and accounting, legal compliance).
Appropriate governance structure and qualified personnel
Private key management, network security, business continuity
Anti-money laundering and counter-terrorism financing requirements
06 / 11
application process
The following entities are eligible for an expedited review process:
The new licensing system will take full effect on the date the relevant regulations come into effect, without any deeming arrangement. This means that existing VA hosting service providers must obtain a license before the regulations take effect, or they will be committing a criminal offense. The government and SFC will consider an appropriate effective date to allow market participants time to adjust their business models.
07 / 11
Costs and Capital Requirements
| Expense items | Amount of money | Explain | Certainty |
|---|---|---|---|
| Company license application fee | ≥ HK$129,730 | Refer to SFO Type 3 Regulated Activities Standards | Proposed |
| Company annual fee | ≥ HK$129,730 | Ibid. | Proposed |
| Personal license application fee | To be confirmed | It is expected to be based on the Type 3 standard (LR: HK$2,420 / RO: HK$2,950). | To be confirmed |
| Individual annual fee | To be confirmed | It is expected to be based on the Type 3 standard (LR: HK$2,420 / RO: HK$5,370). | To be confirmed |
SFC explicitly stated that the VA custody license involves additional technical elements (private key management, cold and hot wallets, network security, etc.) and is more complex than a typical SFO license. Therefore, it adopts the "user pays" principle, and the license fee is no less than the Type 3 standard (HK$129,730), rather than the Type K14 standard (HK$74) referenced by VA Dealing.
| Claim | VA Cus tody | VA Dea ling | VHTP | Type 13 (SFO) |
|---|---|---|---|---|
| Minimum Paid-up Capital | HK$1,000 million | HK$500 million | HK$500 million | HK$1,000 million |
| Minimum quick capital | HK$3 million | HK$3 million | HK$500 million (variable quick funds) | HK$3 million |
| Certainty | Confirmed | Confirmed | Confirmed | Confirmed |
| Item | Explain | Amount of money |
|---|---|---|
| License fee (first year) | Application fee + first year's annual fee | ≥ HK$260,000 |
| Capital Lock-up | Fully paid-up share capital (cannot be freely used). | HK$1,000 million+ |
| Quick funds maintain | Continuity requirements | HK$3 million+ |
| External assessment fees | External assessment (estimation) of systems and controls | HK$50 million – 200 million |
| Technical infrastructure | Cold and hot wallets, HSM/MPC, security systems, etc. (estimated) | HK$200 million – 1,000 million |
| Compliance Team | MLRO, compliance officer, security engineer, etc. (estimated) | HK$200 million – 500 million per year |
| insurance cost | Depending on the final requirements of the SFC | To be confirmed |
08 / 11
Continuing compliance obligations
| Violations | Maximum penalty | Certainty |
|---|---|---|
| Operating without a license, claiming to be licensed, or actively promoting VA hosting services | A fine of HK$1 million plus two years imprisonment | Confirmed |
| Advertising VA hosting services for unlicensed individuals | A fine of HK$50,000 plus 6 months imprisonment | Confirmed |
| Failure to comply with statutory AML/CFT requirements | A fine of HK$1 million plus two years imprisonment | Confirmed |
| Engaging in fraud or deception in transactions involving VA | A fine of HK$1 million plus two years imprisonment | Confirmed |
| Making fraudulent or reckless misrepresentations to induce others to engage in VA transactions | A fine of HK$1 million plus two years imprisonment | Confirmed |
| Misconduct or the issue of suitable candidates | Suspension/revocation of license, reprimand, fine (not exceeding HK$1,000 million) | Confirmed |
As the frontline regulator of banks and SVFs, the HKMA has the authority to oversee their VA custody business and can enter their premises for routine inspections and investigations.
09 / 11
Licensing Strategy
Currently unregulated independent third-party VA hosting service providers
An affiliated entity of SFC-licensed VATP currently provides VA escrow services.
Overseas groups seeking to provide VA (Visa) hosting services in Hong Kong
Licensed/registered fund managers who self-custody fund VA private keys
A VA Custody license can be combined with VA Dealing, VATP, and other licenses. Entities holding multiple licenses can provide one-stop services, creating a competitive advantage. The SFC will clarify the specific requirements for multi-license holders in its subsidiary regulations.
Given the absence of a transitional arrangement, initiating the pre-application process as early as possible is crucial. The first entities to obtain licenses will gain a first-mover advantage in the market, particularly in managed services for institutional clients and SFC-approved products.
SFC adopts a technology-neutral principle and does not restrict specific solutions such as MPC or HSM. However, regardless of the technology used, it must meet the security and control requirements of SFC. Investing in the technical infrastructure in advance is recommended.
The total cost of a VA Custody license (capital + license fee + technology + compliance team) could reach HK$2,000 million to HK$5,000 million. Financial planning in advance is recommended to ensure sufficient funding.
010 / 11
alternative plan
Outsource VA hosting to a licensed VA Custody service provider.
✕ Disadvantages
➜ Suitable for
Fund managers, OTC dealers, and small and medium-sized institutions
VA custody services provided through banks or subsidiaries of locally registered banks
✕ Disadvantages
➜ Suitable for
Institutional investors, SFC-approved funds, large enterprises
Using a non-custodial wallet, the customer keeps their private key safe.
✕ Disadvantages
➜ Suitable for
Individual users, DeFi participants
Exemption is available only for entities that manage VA for the group company.
✕ Disadvantages
➜ Suitable for
Large financial groups and multinational corporations
11 / 11
FAQ
Applications are not yet being accepted formally. The government and the SFC plan to submit the bill to the Legislative Council in 2026. Once the bill is passed and comes into effect, the SFC will begin accepting applications. Entities intending to apply are advised to initiate the pre-application process now (contact fintech@sfc.hk) so that a formal application can be submitted as soon as possible when the regulations come into effect.
Yes. The VA Custody license is a new type of license, separate from the VATP license. Existing VATP-affiliated entities need to obtain a separate VA Custody license under the new regime. The good news is that these entities can enjoy an expedited approval process, as the SFC has already assessed them.
Not necessarily. The SFC will evaluate each case individually. The core criterion is whether the MPC provider can unilaterally transfer the customer's VA. If the customer can transfer the VA independently and is capable of independently rebuilding the complete private key or restoring access to the VA without the MPC provider's support, then the MPC provider does not need a license.
Yes. The SFC has indicated its willingness to issue licenses to offshore entities, a significant departure from its traditional practices under the SFO. However, offshore entities will still need to meet all applicable regulatory requirements, including suitability assessments and financial resource requirements.
The SFC considers VA's custody business to be of a higher risk level because it involves the direct custody of clients' private keys. VA Custody's capital requirement (HK$1,000 million in fully paid-up capital) aligns with the SFO Type 13 regulated activity standard, while VA Dealing aligns with the Type 1 standard (HK$500 million in fully paid-up capital). This reflects the SFC's higher security standards for custody businesses.
No. The new licensing system will take full effect on the date the relevant regulations come into effect, without any deeming arrangement. This means that existing VA hosting service providers must obtain a license before the regulations take effect, otherwise they will be committing a criminal offense (maximum fine of HK$500 million + 7 years imprisonment).
Yes. The SFC has confirmed that licensed VA custodians are permitted to offer collateralized lending services, provided they implement robust safeguards consistent with the SFC's collateralized lending guidelines issued in April 2025. This means that VA custodians can offer collateralized lending services to their clients.
Aiying provides comprehensive VA Custody license application services, including: pre-application strategy consultation, compliance framework establishment, technical architecture assessment, AML/CFT policy development, application material preparation, communication and coordination with the SFC, and ongoing compliance support. Our team has extensive experience in Hong Kong's virtual asset regulation and can help you complete your license application efficiently and compliantly.
Based on SFC official guidelines and Aiying's practical experience, we provide the most authoritative application guidance.
Detailed self-checklist and document preparation guide to ensure the completeness and accuracy of application materials
100+ successful case experience summary, avoid common pitfalls and improve success rate
Integrate international best practices to ensure the forward-looking and adaptable compliance system
To maximize your success rate, Aiying conducts an internal mock review of your application materials before formal submission. Our expert team acts as a regulator, scrutinizing each document from the most rigorous perspective to identify logical loopholes, data inconsistencies, and compliance gaps in advance.
This mechanism allows us to ensure that the materials submitted to regulators are highly professional, complete, and impeccable, thereby minimizing regulatory inquiry rounds, significantly shortening approval times, and reducing the license rejection rate by 67%.
