Interpretation of Hong Kong's Virtual Asset Regulatory New Rules: OTC License Arrives!

Article by: Xiao Sa Legal Team

Recently, the new virtual asset regulatory rules jointly issued by the Securities and Futures Commission (SFC) of Hong Kong and the Financial Services and the Treasury Bureau (FSTB) have attracted widespread attention in the industry. The most core change is: the previous approach mainly regulating trading platforms is expanding to the entire business chain—from over-the-counter (OTC) trading, investment advice, to asset management—all integrated into a unified licensing system.

Many people’s first reaction is “another approval process,” but a close reading of the document reveals that the regulators’ intention is not to create hurdles but to establish a clear, stable, and predictable rule system. This framework not only improves upon the previous VATP system but also provides institutional funding and long-term capital with a certainty signal.

In other words, Hong Kong is not contracting but paving the way for larger-scale compliant capital entry. For institutions genuinely aiming for long-term development here, the current focus should not be on whether to hold a license but on how to make good use of this set of rules.

1. How to obtain an OTC license? How high are the thresholds?

In the past, OTC trading of virtual assets long remained in a regulatory gray area. Many institutions believed that as long as they did not operate exchanges directly targeting the public, there was no need to apply for a license. However, this understanding was thoroughly broken by the end of 2025—when the SFC and FSTB jointly announced the formal initiation of legislation for licensing virtual asset OTC traders.

The new rules explicitly state: any entity providing large-scale fiat and virtual asset exchange services to clients as a business, whether profitable or not, whether claiming to be a “technology platform” or “matching intermediary,” constitutes a regulated activity and must apply for a license. This means OTC business has officially moved from “self-regulation exploration” to “statutory licensing” era.

(1) Who needs a license? Which entities are covered by regulation?

The core criterion for regulation is not subjective intent or revenue model but whether the activity is conducted “as a business.” Accordingly, the following types of institutions will be included in the licensing scope:

1. Professional OTC market makers: providing bid and ask quotes for mainstream assets like Bitcoin, Ethereum, etc., to institutional clients, family offices, or high-net-worth individuals;

2. OTC departments of trading platforms: even if the main platform already holds a VATP license, if its bulk trading or fiat channels operate as an independent business line, it still needs to apply for an OTC license separately;

3. Fintech companies providing fiat on/off-ramp services: if they essentially offer dual-way exchange services between virtual assets and fiat currency with ongoing and commercial characteristics;

4. Cross-border payment or remittance service providers: if they use virtual assets as an intermediary to complete cross-border fund transfers, they may also trigger licensing requirements.

It is worth noting that even non-profit or auxiliary services, as long as they are repetitive and organized, may be deemed regulated activities. For example, a private equity fund that regularly provides BTC/USD exchange services to its limited partners (LPs) as an added value, even if not charging separately, could be considered engaged in OTC business.

(2) Licensing thresholds: not just “submitting materials,” but building systematic compliance capabilities

The proposed OTC license will be modeled after the traditional Type 1 (securities trading) license framework but will impose higher and more specific compliance requirements due to the particular risks of virtual assets:

1. Capital adequacy: applicants must maintain a minimum paid-up capital (expected not less than HKD 5 million) and have liquidity reserves to cope with market fluctuations and counterparty defaults;

2. AML and KYC systems: must establish customer due diligence processes compliant with FATF international standards and conduct enhanced scrutiny for large transactions (e.g., single transactions exceeding HKD 800,000);

3. Transaction monitoring and reporting mechanisms: all transactions must be traceable and auditable, with suspicious activities reported to the SFC as required;

4. Funds settlement security: cash settlement is strictly prohibited. Licensed OTCs must complete fiat settlement through regulated banks; if physical delivery is necessary, it must be done in designated safes or approved secure locations;

5. Technical risk control capabilities: encouraged to adopt smart contracts, on-chain collateralization, or third-party custody mechanisms to reduce human operational risks—this requirement directly responds to the offline OTC security risks exposed by the December 2025 “hundred million cash robbery case.”

(3) “Unintentional violations” are not a reason for exemption: exemption space is essentially eliminated

A critical detail in the new rules is that whether an activity constitutes a regulated activity depends on whether it is “conducted as a business,” not whether it is done intentionally or for profit.

This logic also applies to other virtual asset activities. For example, if a research institution regularly sends market weekly reports containing specific token buy recommendations to paid subscribers, even if it does not charge an “investment advisory fee,” as long as this service is part of its routine business, it could be deemed engaged in a Type 4 regulated activity (providing virtual asset advice).

Similarly, even if a family office’s investment portfolio contains only 3% Bitcoin, it can no longer rely on the previous vague exemption for “small holdings.” The new rules explicitly eliminate such proportional exemptions, sending a clear signal: risk does not disappear because of small scale, and responsibilities are not exempted because of “unintentional violations.” No platform or institution can avoid compliance obligations by claiming “we didn’t intend to do finance.”

2. Custody requirements seem to tighten but actually open institutional funding channels

It is noteworthy that the new rules explicitly state that there will be no “grandfathering” arrangements for existing service providers. This means that regardless of whether you currently have users or have been operating for years, if you do not complete formal application when the regulation takes effect, you must cease related activities.

This contrasts sharply with some markets’ “grandfathering” approach. Hong Kong has chosen a stricter but fairer path: all participants start on the same footing and apply under the same standards.

For institutions, this means you can no longer wait for “policy clarity” to act. With less than three weeks remaining until the consultation deadline (January 23, 2026), after which the legislative process begins, it is recommended that teams already engaged in related activities immediately do three things:

1. Identify which parts of your current business might trigger licensing requirements;

2. Confirm with SFC or legal advisors whether exemptions apply;

3. Initiate pre-application processes, including capital preparation, custody onboarding, and risk control documentation.

Starting early reduces the risk of business interruption.

3. No “transitional period benefits,” only “early preparation advantages”

Another controversial point is that client assets must be held by a custody provider approved by the SFC. Some practitioners worry this will limit operational flexibility, especially for teams used to self-custody or multi-signature schemes.

However, from another perspective, this requirement directly addresses the biggest concern of institutional investors—asset security. The reason pension funds, sovereign wealth funds, and large asset management firms have been slow to enter the virtual asset space is partly due to the lack of custody solutions that meet regulatory standards.

Hong Kong’s mandatory use of licensed custody providers sends a signal to global capital: here, client assets are strictly segregated from platform assets, with independent audits, regulatory supervision, and accountability mechanisms. This institutional arrangement is more reassuring than technical “decentralization” and can dispel traditional capital concerns.

In conclusion

Sa姐 team believes that over the past few years, the virtual asset industry has experienced a process from frenzy to correction. Today, the market no longer pursues “speed” and “novelty,” but values “stability” and “trustworthiness.”

Hong Kong’s regulatory upgrade aligns with this trend. It does not deny innovation but incorporates it into a regulatory framework. For practitioners, the real opportunity lies not in exploiting loopholes or skirting regulations but in being the first to turn compliance capabilities into service advantages—such as demonstrating a complete custody chain, clear suitability assessment processes, and verifiable transaction records. These details will become the core criteria for institutions when choosing partners in the future.

Compliance is not the end but the starting point for participating in the next round of competition.