Self-custodial wallet / non-custodial software in Hong Kong
Publisher of software where users hold their own private keys. The publisher never holds, controls, or has access to user funds.
Self-custodial wallet is permitted in Hong Kong with no licensing burden.
Verdict Details
- Permitted
- yes
- Local entity required
- No
- Licensing burden
- None
- Last updated
- 2026-07-13
Key Restrictions
- Must not hold, control, or have access to user private keys or funds — otherwise custody classification and VATP licensing would trigger.
- Software publisher must not offer any custodial, exchange, or wallet management services alongside the software, to avoid crossing into VASP activity.
Key Risks
- Regulatory boundary risk: if software is bundled with any custodial or transaction-relay service (e.g. integrated swap feature routed through the publisher's infrastructure), SFC could reclassify the operator as a VATP.
- Consumer-protection liability: HK common law could impose duties on software publishers if users suffer losses due to software defects, without clear statutory safe harbour.
- Future regulatory expansion: SFC has signalled broader regulation of OTC desks and could extend the VATP definition to cover wallet software or non-custodial providers.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
SFC — VATP licensing (AMLO Part 5B), Type 1/7 for security tokens, enforcement
AMLO Part 5B (Cap 615, amended 2023) (2023) — Mandatory VATP licensing — effective June 1, 2023. All platforms, retail + institutional.
VASP: VATP license from SFC mandatory since June 2023. HKD 5M (~$640K USD) minimum paid-up capital. SFC Type 1 (HKD 3M) / Type 7 (HKD 5M) for security tokens. 98% cold storage requirement (one of strictest globally). Retail trading allowed only for approved tokens. 12-18 month application timeline. OSL and HashKey were first licensees.
CUSTODY: Included under VATP license. Client assets on trust, segregated. Insurance required against cyber risks/theft. Robust private key management.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Yes — publishing non-custodial/self-custodial wallet software does not trigger VATP licensing or AML obligations in Hong Kong, because the VATP regime (AMLO Part 5B) applies only to operators who control or hold client assets, which a pure software publisher does not.
Questions this verdict aims to answer
- Does software publishing trigger VASP / MSB classification?
- Do AML obligations attach when no custody exists?
- What disclosure or consumer-protection rules apply?