Crypto ATM / kiosk operator in Hong Kong
Physical kiosks that exchange cash for crypto (and sometimes vice versa). High-cash AML risk profile.
Crypto ATM is conditionally permitted in Hong Kong with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- VATP licensees must comply with AMLO Part 5B AML/CTF requirements including customer due diligence (CDD), record-keeping, and suspicious transaction reporting to JFIU.
- Cash transaction reporting: HKD 120,000 or above (or equivalent in foreign currency) triggers a cash transaction report (CTR) under the Organized and Serious Crimes Ordinance (OSCO) — this directly applies to a cash-intensive ATM/kiosk model.
- Suspicious Transaction Reports (STRs) must be filed with JFIU when there are reasonable grounds to suspect proceeds of crime or terrorist financing.
- Enhanced Due Diligence (EDD) required for high-risk situations including cash-intensive business models, non-face-to-face transactions, and PEPs.
- Ongoing monitoring obligations apply to all transactions through the kiosk, including source-of-funds scrutiny on cash deposits above prescribed thresholds.
Key Restrictions
- Must obtain VATP license from SFC — this covers the exchange/transmission element of kiosk operations (cash-to-crypto conversion).
- Minimum paid-up capital of HKD 5M (~USD 640K) required.
- 98% of customer crypto assets must be held in cold storage — one of the strictest cold-storage requirements globally.
- Only SFC-approved tokens may be offered for retail trading via kiosks.
- Client assets must be held on trust and segregated; insurance against cyber risks/theft required.
- 12–18 month estimated application timeline for VATP license.
- Kiosks constitute 'ATMs' or 'automated trading platforms' — likely fall under the SFC's VATP regime as they provide crypto trading services to the public.
- OTC desk operations (if bundled) are currently unregulated but SFC has signaled future regulation.
Key Risks
- Cash-intensive kiosk model attracts heightened AML scrutiny from both SFC and HK Police/JFIU.
- Regulatory ambiguity: No specific 'kiosk' or 'crypto ATM' license category exists — operators must self-classify under the VATP framework, creating interpretive risk.
- Strict 98% cold-storage rule may create operational complexity for a kiosk model that requires hot-wallet liquidity for cash-out transactions.
- Potential for regulatory action if kiosks are deemed to be unlicensed automated trading venues or money transmitters outside the VATP scope.
- Only a short list of SFC-approved retail tokens — limits token selection available at kiosks.
- Kiosk location-based licensing/registration requirements with local authorities (e.g., Hong Kong Police for money-changer licenses) may overlap or conflict with VATP regime.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
AMLO Part 5B (Cap 615, amended 2023) (2023) — Mandatory VATP licensing — effective June 1, 2023. All platforms, retail + institutional.
VASP: VATP license from SFC mandatory since June 2023. HKD 5M (~$640K USD) minimum paid-up capital. SFC Type 1 (HKD 3M) / Type 7 (HKD 5M) for security tokens. 98% cold storage requirement (one of strictest globally). Retail trading allowed only for approved tokens. 12-18 month application timeline. OSL and HashKey were first licensees.
CUSTODY: Included under VATP license. Client assets on trust, segregated. Insurance required against cyber risks/theft. Robust private key management.
SFC — VATP licensing (AMLO Part 5B), Type 1/7 for security tokens, enforcement
JFIU — Joint Financial Intelligence Unit — suspicious transaction reports
Anti-Money Laundering (AML) Ordinance: Audits may check compliance with financial crime prevention.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — Crypto ATM/kiosk operators in Hong Kong require a VATP license from the SFC (HKD 5M capital, 98% cold storage, 12-18 month timeline) and must comply with full AMLO Part 5B AML obligations including cash transaction reporting, but no specific kiosk/ATM license category exists, creating regulatory classification risk.
Questions this verdict aims to answer
- What money-transmitter / kiosk-specific license is required?
- What cash-transaction reporting thresholds apply?
- What enhanced-KYC obligations attach to cash-in / cash-out?