Hong Kong

SFC — VATP licensing (AMLO Part 5B), Type 1/7 for security tokens, enforcement

HKMA — Stablecoin regulation (Stablecoins Ordinance expected 2025-2026), banking, Fintech Supervisory Sandbox

FSTB — Financial services policy, legislative proposals for virtual assets

JFIU — Joint Financial Intelligence Unit — suspicious transaction reports

The SFC Public Register of licensees (https://www.sfc.hk/en/Regulatory-functions/Intermediaries/Licensing/Register-of-licensed-persons-and-registered-institutions) allows searching all SFC-licensed entities, including VATPs by name or CE number, under SFO/AMLO since 1 June 2023.

A separate "deemed-to-be-licensed" applicant list exists, but these are not licensed.

Data as of latest SFC updates (e.g., April 2026 for related registers); check the live registry for real-time changes.

Financial Audits: Detailed review of financial statements (e.g., for listed companies under HKEX rules).

Forensic Audits: Investigating fraud, embezzlement, or irregularities (common in corporate disputes or regulatory probes).

Compliance Audits: Ensuring adherence to HK laws (e.g., Companies Ordinance, AML regulations, tax laws).

Operational Audits: Assessing efficiency, risk management, or governance frameworks.

Companies Ordinance (Cap. 622): Mandates annual audits for most companies.

HKEX Listing Rules: Stricter requirements for listed firms (e.g., independent audits, disclosure of financial controls).

Anti-Money Laundering (AML) Ordinance: Audits may check compliance with financial crime prevention.

IFRS/ISA Standards: Auditors must follow International Financial Reporting Standards (IFRS) and International Standards on Auditing (ISA).

Big 4 Firms: Deloitte, PwC, EY, KPMG (handle large corporate audits).

Mid-Tier & Local Firms: BDO, Grant Thornton, Mazars, or HK-based firms like Messrs. Lau & Partners.

Forensic Specialists: Firms like FTI Consulting or Kroll for fraud investigations.

SFC assesses "financial status or solvency," "financial integrity," and disciplines for misconduct including fines, but no explicit protocol for fraud/missing funds suspicions.

SFC conducts licensing scrutiny, on-site inspections, and public disciplines; no joint SFC-HKEX investigations specified.

M&A Due Diligence: Buyers audit targets for hidden liabilities.

Tax Disputes: IRD challenges aggressive tax planning.

Corporate Governance Failures: Weak internal controls (e.g., Enron-style collapses).

Complex Corporate Structures: Many HK companies operate via offshore entities (e.g., BVI, Cayman Islands).

Data Privacy Laws: PDPO (Personal Data Privacy Ordinance) limits access to employee records.

Cultural Factors: Reluctance to disclose sensitive info (common in family-owned firms).

Cross-Border Issues: Auditing subsidiaries in mainland China or Macau adds complexity.

Maintain Clean Records: Ensure all transactions are documented (e.g., under HK’s Books of Account Ordinance).

Strengthen Internal Controls: Segregation of duties, approval hierarchies.

Engage Experts Early: Hire forensic accountants or legal counsel if fraud is suspected.

Cooperate with Regulators: Delaying an SFC/ICAC audit can lead to penalties.

ESG Audits: Growing focus on environmental, social, and governance disclosures (e.g., HKEX’s ESG reporting requirements).

Crypto Audits: Firms like HashKey or OSL now require audits for digital asset compliance.

AI & Data Analytics: Auditors use tools like ACL Analytics or CaseWare IDEA to detect anomalies.

Whistleblower Protections: HK’s Whistleblower Protection Ordinance (2023) encourages reporting misconduct.

HKICPA (Hong Kong Institute of CPAs): www.hkicpa.org.hk (sets audit standards).

SFC Guidelines: www.sfc.hk (regulatory audit expectations).

ICAC Reports: www.icac.org.hk (case studies on corruption).

IRD Audit Manual: www.ird.gov.hk (tax audit procedures).

The exact URL of the official publ

Regulator: Securities and Futures Commission (SFC) and Hong Kong Monetary Authority (HKMA).

Targeted Entities: Unlicensed VATPs and existing stablecoin issuers not applying for licenses by deadlines.

Violation Types: Operating without a license, AML/CTF failures, suspicious activities, token due diligence lapses, inadequate retail investor protections.

Timeline: Transitional period ended January 2024; unlicensed VATPs must cease by November 2025 (with wind-down starting earlier for non-compliant stablecoin issuers).

Penalties/Outcomes: SFC can impose fines up to HKD 10 million or three times profit gained/loss avoided for misconduct; non-compliant entities face license rejection, mandatory cessation, and potential disciplinary sanctions. As of August 2025, HKMA received 77 stablecoin applications; rejected issuers must stop issuance within one month unless extended.

Capital: Minimum paid-up share capital of HKD 5 million (approx. USD 640,000), held in a local bank account and untouched until licensing; ongoing liquid capital requirements apply.

AML/KYC: Robust systems for AML/CTF, including transaction monitoring, risk assessments, KYC on all clients, and appointment of a compliance officer; only SFC-approved high-liquidity tokens can be listed.

Local Presence: Company must be incorporated/registered in Hong Kong (or as overseas entity with Companies Registry); physical office required (virtual office in financial zone may suffice); at least one director/secretary in Hong Kong.

Fit and Proper: Directors, responsible officers, and beneficial owners must pass SFC "fit and proper" test (no financial crime convictions, bankruptcy, etc.).

Other: Serve only professional investors initially; annual audits, reports, and fees required post-licensing.

Register company in Hong Kong and establish local office/bank account.

Prepare documents: business plan, AML/KYC policies, proof of capital, director/shareholder details, compliance test declarations.

Submit application to SFC with fees; SFC conducts due diligence on structure, finances, and personnel.

SFC review (rigorous, 3-6+ months typically); may issue conditional/in-principle approval.

Receive license; ongoing compliance and reporting mandatory.

SFC Guidelines for VATPs: https://www.sfc.hk/-/media/EN/assets/components/codes/files-current/web/guidelines/Guidelines-for-Virtual-Asset-Trading-Platform-Operators/Guidelines-for-Virtual-Asset-Trading-Platform-Operators.pdf