SFC — VATP licensing (AMLO Part 5B), Type 1/7 for security tokens, enforcement

HKMA — Stablecoin regulation (Stablecoins Ordinance expected 2025-2026), banking, Fintech Supervisory Sandbox

FSTB — Financial services policy, legislative proposals for virtual assets

JFIU — Joint Financial Intelligence Unit — suspicious transaction reports

The SFC Public Register of licensees (https://www.sfc.hk/en/Regulatory-functions/Intermediaries/Licensing/Register-of-licensed-persons-and-registered-institutions) allows searching all SFC-licensed entities, including VATPs by name or CE number, under SFO/AMLO since 1 June 2023.[4]

A separate "deemed-to-be-licensed" applicant list exists, but these are **not licensed**.[1]

Data as of latest SFC updates (e.g., April 2026 for related registers); check the live registry for real-time changes.[1][4]

**Financial Audits**: Detailed review of financial statements (e.g., for listed companies under HKEX rules).

**Forensic Audits**: Investigating fraud, embezzlement, or irregularities (common in corporate disputes or regulatory probes).

**Compliance Audits**: Ensuring adherence to **HK laws** (e.g., Companies Ordinance, AML regulations, tax laws).

**Operational Audits**: Assessing efficiency, risk management, or governance frameworks.

**Companies Ordinance (Cap. 622)**: Mandates annual audits for most companies.

**HKEX Listing Rules**: Stricter requirements for listed firms (e.g., independent audits, disclosure of financial controls).

**Anti-Money Laundering (AML) Ordinance**: Audits may check compliance with financial crime prevention.

**IFRS/ISA Standards**: Auditors must follow International Financial Reporting Standards (IFRS) and International Standards on Auditing (ISA).

**Big 4 Firms**: Deloitte, PwC, EY, KPMG (handle large corporate audits).

**Mid-Tier & Local Firms**: BDO, Grant Thornton, Mazars, or HK-based firms like **Messrs. Lau & Partners**.

**Forensic Specialists**: Firms like **FTI Consulting** or **Kroll** for fraud investigations.

SFC assesses "financial status or solvency," "financial integrity," and disciplines for misconduct including fines, but no explicit protocol for fraud/missing funds suspicions.

SFC conducts licensing scrutiny, on-site inspections, and public disciplines; no joint SFC-HKEX investigations specified.

**M&A Due Diligence**: Buyers audit targets for hidden liabilities.

**Tax Disputes**: IRD challenges aggressive tax planning.

**Corporate Governance Failures**: Weak internal controls (e.g., Enron-style collapses).

**Complex Corporate Structures**: Many HK companies operate via offshore entities (e.g., BVI, Cayman Islands).

**Data Privacy Laws**: PDPO (Personal Data Privacy Ordinance) limits access to employee records.

**Cultural Factors**: Reluctance to disclose sensitive info (common in family-owned firms).

**Cross-Border Issues**: Auditing subsidiaries in mainland China or Macau adds complexity.

**Maintain Clean Records**: Ensure all transactions are documented (e.g., under HK’s **Books of Account Ordinance**).

**Strengthen Internal Controls**: Segregation of duties, approval hierarchies.

**Engage Experts Early**: Hire forensic accountants or legal counsel if fraud is suspected.

**Cooperate with Regulators**: Delaying an SFC/ICAC audit can lead to penalties.

**ESG Audits**: Growing focus on environmental, social, and governance disclosures (e.g., HKEX’s ESG reporting requirements).

**Crypto Audits**: Firms like **HashKey** or **OSL** now require audits for digital asset compliance.

**AI & Data Analytics**: Auditors use tools like **ACL Analytics** or **CaseWare IDEA** to detect anomalies.

**Whistleblower Protections**: HK’s **Whistleblower Protection Ordinance** (2023) encourages reporting misconduct.

**HKICPA (Hong Kong Institute of CPAs)**: www.hkicpa.org.hk (sets audit standards).

**SFC Guidelines**: www.sfc.hk (regulatory audit expectations).

**ICAC Reports**: www.icac.org.hk (case studies on corruption).

**IRD Audit Manual**: www.ird.gov.hk (tax audit procedures).

The exact URL of the official publ

**Regulator**: Securities and Futures Commission (SFC) and Hong Kong Monetary Authority (HKMA).

**Targeted Entities**: Unlicensed VATPs and existing stablecoin issuers not applying for licenses by deadlines.

**Violation Types**: Operating without a license, AML/CTF failures, suspicious activities, token due diligence lapses, inadequate retail investor protections.

**Timeline**: Transitional period ended January 2024; unlicensed VATPs must cease by November 2025 (with wind-down starting earlier for non-compliant stablecoin issuers).[2][5]

**Penalties/Outcomes**: SFC can impose fines up to HKD 10 million or three times profit gained/loss avoided for misconduct; non-compliant entities face license rejection, mandatory cessation, and potential disciplinary sanctions. As of August 2025, HKMA received 77 stablecoin applications; rejected issuers must stop issuance within one month unless extended.[2]

**Capital**: Minimum paid-up share capital of **HKD 5 million** (approx. USD 640,000), held in a local bank account and untouched until licensing; ongoing liquid capital requirements apply.[1][4]

**AML/KYC**: Robust systems for AML/CTF, including transaction monitoring, risk assessments, KYC on all clients, and appointment of a compliance officer; only SFC-approved high-liquidity tokens can be listed.[1][2][3]

**Local Presence**: Company must be incorporated/registered in Hong Kong (or as overseas entity with Companies Registry); physical office required (virtual office in financial zone may suffice); at least one director/secretary in Hong Kong.[1][2][4]

**Fit and Proper**: Directors, responsible officers, and beneficial owners must pass SFC "fit and proper" test (no financial crime convictions, bankruptcy, etc.).[1][3][5]

Other: Serve only professional investors initially; annual audits, reports, and fees required post-licensing.[4]

Register company in Hong Kong and establish local office/bank account.[1][3]

Prepare documents: business plan, AML/KYC policies, proof of capital, director/shareholder details, compliance test declarations.[3][5]

Submit application to SFC with fees; SFC conducts due diligence on structure, finances, and personnel.[1][2]

SFC review (rigorous, 3-6+ months typically); may issue conditional/in-principle approval.[1][3]

Receive license; ongoing compliance and reporting mandatory.[4]

SFC Guidelines for VATPs: https://www.sfc.hk/-/media/EN/assets/components/codes/files-current/web/guidelines/Guidelines-for-Virtual-Asset-Trading-Platform-Operators/Guidelines-for-Virtual-Asset-Trading-Platform-Operators.pdf