Written by: Xiao Sa Legal Team
Recently, the new regulations on virtual assets jointly issued by the Hong Kong Securities and Futures Commission (SFC) and the Financial Services and the Treasury Bureau (FSTB) have attracted widespread attention in the industry. The most significant change is that the previous practice of primarily regulating trading platforms is now being extended to the entire business chain— from over-the-counter trading and investment advice to asset management, all are being incorporated into a unified licensing system.
Many people's first reaction to this is , "This means another layer of approval." However, a closer reading of the documents reveals that the regulators' intention is not to create obstacles, but rather to establish a clear, stable, and predictable set of rules. This system is both an improvement on the previous VATP system and a signal of certainty to institutional funds and long-term capital.
In other words, Hong Kong is not shrinking, but paving the way for a larger influx of compliant capital. For institutions that genuinely want to develop here long-term, the current concern is not "whether or not to obtain a license," but rather how to make the best use of these rules .
1. How do I obtain an OTC license? What are the requirements?
In the past, over-the-counter (OTC) trading of virtual assets has long been in a regulatory gray area. Many institutions believed that as long as they did not operate exchanges directly to the public, they did not need to apply for a license. However, this perception was completely overturned at the end of 2025—the Hong Kong Securities and Futures Commission and the Financial Services and the Treasury jointly announced the formal launch of the legislative process for a licensing system for OTC virtual asset dealers.
The new regulations explicitly state that any entity providing large-scale exchange services between fiat currency and virtual assets to customers in a business setting, regardless of profitability or whether it claims to be a "technology platform" or "matching intermediary," constitutes a regulated activity and must apply for a license. This signifies that the OTC business has officially moved from an era of "self-regulation and exploration" to one of "legally licensed" operations .
(a) Who needs a license? Which entities are covered by the regulation?
The core criterion for regulation is not subjective intent or revenue model, but whether the relevant activities are conducted "in a business form." Accordingly, the following types of institutions will be included in the licensing scope:
1. Professional OTC Market Maker : Providing buy and sell quotes for large amounts of mainstream assets such as Bitcoin and Ethereum to institutional clients, family offices, or high-net-worth individuals;
2. OTC division of the trading platform: Even if the main platform already holds a Virtual Asset Trading Platform (VATP) license, if its block trading or fiat currency channel operates as an independent business line, it still needs to apply for an OTC license separately;
3. Fintech companies that provide fiat currency deposit and withdrawal services: If they essentially provide two-way exchange services between virtual assets and fiat currency, and possess continuous and commercial characteristics;
4. Cross-border payment or foreign exchange service providers: If virtual assets are used as an intermediary to complete cross-border fund transfers, licensing requirements may also be triggered.
It is worth noting that even non-profit or ancillary services, if they are repetitive and organized, may be considered regulated activities. For example, if a private equity fund regularly provides BTC/USD exchange services to its limited partners (LPs) as an added-value service, it may be considered to be engaging in OTC business, even if it does not charge separately.
(ii) Licensing threshold: It's not just about "submitting materials," but also about building a systematic compliance capability.
The proposed OTC license will be designed with reference to the traditional Type 1 (securities trading) license framework, but will introduce higher and more specific compliance requirements to address the unique risks of virtual assets.
1. Capital Adequacy: Applicants must maintain a minimum paid-up capital (expected to be no less than HK$5 million) and have sufficient liquidity reserves to cope with market fluctuations and counterparty defaults;
2. Anti-money laundering and KYC system: A customer due diligence process that complies with FATF international standards must be established, and enhanced review should be implemented for large transactions (such as a single transaction exceeding HKD 800,000);
3. Transaction monitoring and reporting mechanism: All transactions must be traceable and auditable, and suspicious activities must be reported to the SFC as required by regulations;
4. Security of Funds Settlement: Cash settlement is strictly prohibited. Licensed OTC transactions must be settled in fiat currency through regulated banking channels; if physical settlement is absolutely necessary, it must be conducted in a designated vault or an approved secure location.
5. Technical risk control capabilities: The use of smart contracts, on-chain staking, or third-party custody mechanisms is encouraged to reduce the risk of human error. This requirement is a direct response to the offline OTC security risks exposed by the "hundred-million-yuan cash robbery case" in December 2025.
(iii) "Unintentional violation" is not a reason for exemption: the room for exemption has basically disappeared.
A crucial detail in the new regulations is that whether an activity constitutes a regulated activity depends on whether the behavior itself is a "business activity," rather than whether there is an intention to engage in financial business or whether one profits from it.
Similar logic applies to other virtual asset businesses. For example, if a research institution regularly sends market reports containing specific token buy recommendations to its paid subscribers, it may be considered to be engaging in Type 4 regulated activity (providing advice on virtual assets) as long as the service is part of its regular business, even if it does not charge a separate "investment advisory fee".
Similarly, even if a family office's portfolio for its clients contains only 3% Bitcoin, it can no longer rely on the previous ambiguity of "exemption for small holdings." The new regulations explicitly eliminate such percentage exemptions, sending a clear signal: risk does not disappear due to small size, and responsibility is not absolved by "unintentional violations." No platform or institution can evade compliance obligations on the grounds that "we didn't intend to do financial business."
Second, while the custody requirements appear to be tightening, they actually open up channels for institutional funds.
It is worth noting that the new regulations explicitly state that there will be no "deemed licensed" arrangement for existing service providers. This means that regardless of whether you currently have users or have been operating for many years, if you have not completed a formal application when the regulations take effect, you must cease your business operations.
This contrasts sharply with the "grandfathering" practices in some markets. Hong Kong has chosen a more rigorous but fairer path: all participants start on a level playing field and apply according to the same set of standards.
For institutions, this means they can no longer wait for "policy clarity before taking action." There are less than three weeks left until the consultation deadline (January 23, 2026), after which the legislative process will begin. Teams already engaged in related work are advised to do three things immediately:
1. Identify which aspects of the existing business may trigger licensing requirements;
2. Confirm with the SFC or legal counsel whether the exemption applies;
3. Initiate the pre-application process, including capital preparation, custody arrangements, and risk control document preparation.
Starting earlier reduces the risk of business interruption.
Third, there is no "transitional period bonus," only the "advantage of early preparation."
Another point of contention is that client assets must be held in custody by an SFC-approved custodian. Some practitioners worry that this will limit operational flexibility, especially for teams accustomed to self-custody or multi-signature solutions.
However, from another perspective, this requirement precisely addresses institutional investors' biggest concern—asset security. One of the core obstacles preventing pension funds, sovereign wealth funds , and large asset management companies from entering the virtual asset sector on a large scale is the lack of custody solutions that meet regulatory standards.
Hong Kong's mandate for licensed platforms to use compliant custody sends a signal to global capital: here, client assets and platform assets are strictly separated, with independent audits, regulatory oversight, and accountability mechanisms. This institutional arrangement is more effective than technological "decentralization" in allaying the concerns of traditional funds.
In conclusion
The Sa Jie team believes that the virtual asset industry has gone through a process of boom and bust over the past few years. Now, the market no longer chases "fast" and "new," but values "stability" and "credibility" more.
Hong Kong's recent regulatory upgrade is precisely in line with this trend. It doesn't negate innovation, but rather incorporates it into the regulatory framework. For practitioners, the real opportunity lies not in exploiting loopholes or skirting the rules, but in who can be the first to translate compliance capabilities into service advantages—such as demonstrating a complete custody chain, a clear suitability assessment process, and verifiable transaction records to clients. These details will become core criteria for institutions choosing partners in the future.
Compliance is not the end, but the starting point for participating in the next round of competition.
