← Regulations / Hong Kong / Operating Models / Custodial SaaS

Custodial wallet / SaaS in Hong Kong

Hosted wallet provider that holds keys on behalf of end users, often white-labeled to businesses (custody as a service).

Conditional AI-Generated · Unreviewed

Custodial SaaS is conditionally permitted in Hong Kong with a local entity, subject to AML obligations and high licensing burden.

Verdict Details

Permitted
conditional
Local entity required
Yes
Licensing burden
High
Last updated
2026-07-13

AML Obligations

  • VATP licensees must comply with AMLO Part 5B (Cap 615) — mandatory AML/CTF policies, CDD/EDD, and record-keeping.
  • Suspicious transaction reports must be filed with the JFIU (Joint Financial Intelligence Unit).
  • Ongoing transaction monitoring and risk-based AML compliance program required under SFC supervision.
  • White-label clients that themselves act as VASPs vis-à-vis end users may have independent AML obligations under AMLO; the SaaS operator must contractually allocate and verify compliance.

Key Restrictions

  • Custodial wallet SaaS requires a VATP license from the SFC (AMLO Part 5B) — this covers all platforms serving the HK public, including hosted wallet/custody services.
  • Minimum paid-up capital of HKD 5M (~$640K USD) for VATP license; additional HKD 5M if also operating Type 7 (automated trading) for security tokens, or HKD 3M for Type 1.
  • 98% of client assets must be held in cold storage — one of the strictest cold-storage requirements globally.
  • Client assets must be held on trust and segregated from the operator's own assets.
  • Insurance must be held against cyber risks and theft.
  • The license application timeline is 12–18 months; no unlicensed operation permitted during application period.
  • Only approved tokens may be offered to retail investors.

Key Risks

  • The SFC VATP licensing regime was only fully effective from June 2023 — precedent on enforcement action specific to custodial wallet SaaS is limited.
  • Operators offering SaaS to white-label clients face ambiguity over whether the client (as a VASP) must separately license for their own end-user facing activities.
  • The 'deemed-to-be-licensed' applicant list includes firms not yet licensed — operating while on this list carries risk and is not the same as being licensed.
  • Custody-specific capital requirements under the VATP regime may not fully account for the multi-tenant, multi-jurisdictional nature of SaaS custody services.
  • Compliance audits under Companies Ordinance (Cap. 622) and HKEX rules (if listed) add recurring cost and scrutiny.
  • Forensic audit risk if fraud or embezzlement is suspected — SFC can assess financial status and integrity.

Evidence

This verdict synthesizes the following facts. Each fact links to its primary source(s).

licensing 30% confidence

SFC — VATP licensing (AMLO Part 5B), Type 1/7 for security tokens, enforcement

[primary] SFC
licensing 20% confidence

AMLO Part 5B (Cap 615, amended 2023) (2023) — Mandatory VATP licensing — effective June 1, 2023. All platforms, retail + institutional.

licensing 20% confidence

Securities and Futures Ordinance (SFO) (2003) — Type 1/Type 7 licensing for security token dealing and automated trading

licensing 20% confidence

VASP: VATP license from SFC mandatory since June 2023. HKD 5M (~$640K USD) minimum paid-up capital. SFC Type 1 (HKD 3M) / Type 7 (HKD 5M) for security tokens. 98% cold storage requirement (one of strictest globally). Retail trading allowed only for approved tokens. 12-18 month application timeline. OSL and HashKey were first licensees.

licensing 20% confidence

CUSTODY: Included under VATP license. Client assets on trust, segregated. Insurance required against cyber risks/theft. Robust private key management.

licensing 30% confidence

JFIU — Joint Financial Intelligence Unit — suspicious transaction reports

[primary] JFIU
licensing 40% confidence

HKMA — Stablecoin regulation (Stablecoins Ordinance expected 2025-2026), banking, Fintech Supervisory Sandbox

[primary] HKMA
licensing 95% confidence

The SFC Public Register of licensees (https://www.sfc.hk/en/Regulatory-functions/Intermediaries/Licensing/Register-of-licensed-persons-and-registered-institutions) allows searching all SFC-licensed entities, including VATPs by name or CE number, under SFO/AMLO since 1 June 2023.

[secondary] sfc.hk — Lists Of Virtual Asset Trading Platforms [secondary] sfc.hk — Register Of Licensed Persons And Registered Institutions [secondary] sfc.hk — Register Of Licensed Persons And Registered Institutions
licensing 95% confidence

A separate "deemed-to-be-licensed" applicant list exists, but these are not licensed.

[secondary] sfc.hk — Lists Of Virtual Asset Trading Platforms
licensing 95% confidence

Companies Ordinance (Cap. 622): Mandates annual audits for most companies.

[secondary] hkicpa.org.hk [secondary] sfc.hk [secondary] icac.org.hk
licensing 80% confidence

SFC assesses "financial status or solvency," "financial integrity," and disciplines for misconduct including fines, but no explicit protocol for fraud/missing funds suspicions.

[secondary] hkicpa.org.hk [secondary] sfc.hk [secondary] icac.org.hk

Verdict Attribution

Source:
AI-Generated · Unreviewed
AI synthesized:
2026-07-13 (deepseek-chat)
Last updated:
2026-07-13
Confidence:
medium

This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.

Conditional — custodial wallet SaaS (white-label custody) is permitted in Hong Kong only under an SFC VATP license (AMLO Part 5B), requiring HKD 5M capital, 98% cold storage, client asset segregation, and cyber insurance, with a 12–18 month licensing timeline.

Questions this verdict aims to answer

  • What custody license / qualified-custodian status applies?
  • What segregation, insurance, and proof-of-reserves rules apply?
  • What AML obligations attach to the SaaS vs the white-label client?