Remote VASP serving residents in Hong Kong
Foreign-incorporated entity that offers exchange, custody, or transfer services to residents of a jurisdiction without establishing a local entity or office.
Remote VASP is conditionally permitted in Hong Kong with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- VATP licensee must comply with AMLO (Part 5B, Cap 615, amended 2023) AML/CTF obligations including CDD, record-keeping, and suspicious transaction reporting to JFIU
- Travel Rule applies with threshold of HKD 8,000 — VASPs must transmit originator and beneficiary information for qualifying transfers
- SFC supervises AML compliance for licensed VATPs; HKMA provides FATF-related updates on AML/CTF standards
- Ongoing obligation to report suspicious transactions to the Joint Financial Intelligence Unit (JFIU)
- Minimum paid-up capital of HKD 5M (~$640K USD) serves as a financial soundness requirement that underpins AML compliance capacity
Key Restrictions
- Remote (non-local) VASPs serving HK residents without a local entity and SFC VATP license are operating unlawfully — VATP license is mandatory since June 1, 2023 for all platforms serving the Hong Kong public
- Must be incorporated/registered in Hong Kong to obtain a VATP license (local entity required)
- 98% cold storage requirement applies to licensed VASPs — one of the strictest globally
- Retail trading is permitted but only for approved tokens; operators cannot offer unapproved virtual assets to retail investors
- Insurance coverage against cyber risks and theft is required
- Client assets must be held on trust and segregated
Key Risks
- High enforcement risk for unlicensed remote operators — SFC has enforcement powers under AMLO Part 5B and SFO and has publicly signalled enforcement against unlicensed platforms
- Binance.com was placed on SFC's Alert List in previous years, demonstrating precedent for enforcement action against non-compliant remote VASPs
- No grandfathering or deemed-licensed status — the 'deemed-to-be-licensed' applicant list exists for pending applicants but does not confer licensed status
- Operators could face criminal liability and fines under AMLO Part 5B for operating without a license
- Banking access is restricted — HKMA has directed banks to serve licensed firms, making compliance difficult for unlicensed operators
- 12-18 month VATP application timeline creates prolonged exposure period
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
SFC — VATP licensing (AMLO Part 5B), Type 1/7 for security tokens, enforcement
AMLO Part 5B (Cap 615, amended 2023) (2023) — Mandatory VATP licensing — effective June 1, 2023. All platforms, retail + institutional.
VASP: VATP license from SFC mandatory since June 2023. HKD 5M (~$640K USD) minimum paid-up capital. SFC Type 1 (HKD 3M) / Type 7 (HKD 5M) for security tokens. 98% cold storage requirement (one of strictest globally). Retail trading allowed only for approved tokens. 12-18 month application timeline. OSL and HashKey were first licensees.
EXCHANGE: VATP license required for all centralized exchanges serving HK public. OTC desks currently unregulated but SFC signaling future regulation. Banks (HSBC, StanChart) directed by HKMA to bank licensed firms.
Travel Rule adopted — threshold: HKD 8,000
HKMA FATF updates: https://www.hkma.gov.hk/eng/key-functions/banking/anti-money-laundering-and-counter-financing-of-terrorism/fatf-related-statments-update/
JFIU — Joint Financial Intelligence Unit — suspicious transaction reports
CUSTODY: Included under VATP license. Client assets on trust, segregated. Insurance required against cyber risks/theft. Robust private key management.
A separate "deemed-to-be-licensed" applicant list exists, but these are not licensed.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a non-resident VASP may only serve Hong Kong residents from abroad if it establishes a local entity, obtains an SFC VATP license (high burden, HKD 5M capital, 12-18 months), and complies with AMLO obligations including a HKD 8,000 Travel Rule; unlicensed remote operation carries serious enforcement risk.
Questions this verdict aims to answer
- May a non-resident provider serve residents from abroad?
- Does cross-border service trigger licensing, registration, or AML obligations?
- What enforcement risk exists for unlicensed remote operators?