Based on the SFC regulatory framework, this article provides an in-depth breakdown of key application points and compliance practices.

Introduction

As Hong Kong strives to become a global hub for virtual assets, applying for Type 1, 4, and 9 licenses and upgrading for virtual asset (VA) activities has become the preferred compliance choice for many crypto funds and digital asset management companies. This "Type 1 + 4 + 9" license combination comprehensively covers the core business loop of "product structuring, investment analysis, and market distribution," and is regarded as the "gold standard" configuration for VA asset management companies. This article provides an in-depth breakdown of key application points and compliance practices based on the SFC regulatory framework.

 

Regulatory Framework: License Functions and VA Business Boundaries

Under the SFC's regulatory system, licenses involving virtual asset activities are mainly divided into two categories: first, the Type 1 + 7 licenses centered on exchanges (VATP, Virtual Asset Trading Platform), which have extremely high thresholds and significant application difficulties; second, the Type 1, 4, and 9 licenses centered on asset management. This article focuses on the latter.

1. The Business Substance of the "Type 1 + 4 + 9" Combination

2. Key Compliance Strategies: Business Linkages and Exemption Pathways

In structural design, the reasonable use of exemption rules can effectively reduce compliance costs.

  • Incidental Exemption

Applicable Scenario: Institutions already holding a Type 9 license.

Core Logic: If research and analysis conducted for the purpose of managing assets (Type 4 license activity) is deemed a necessary step in asset management and is not charged separately to clients (with revenue collectively classified as management fees or performance fees), there is no need to separately apply for a Type 4 license.

  • Intra-Group Exemption

Applicable Scenario: Wholly-owned subsidiaries or group treasury management.

Core Logic: If the services are provided to wholly-owned affiliated companies (100% equity relationship) and the funds belong entirely to the group itself (strictly prohibiting the inclusion of external funds), it is considered internal administrative management and does not require a license.

  • Family Office Structure

Single Family Office: Typically utilizes the "intra-group exemption," being wholly owned by the family and not serving third parties, thus usually requiring no license.

Multi-Family Office: As long as the services are provided to more than one family, it is regarded as commercialized asset management and must hold a Type 9 license (and may require Type 1 or 4 licenses depending on the circumstances).

 

Application Practice: Entity, Capital, and Personnel Requirements

1. Corporate Entity and Premises

Entity Structure: The applicant must be a limited company incorporated in Hong Kong or a non-Hong Kong company registered in Hong Kong. The SFC will conduct a penetrating review of the shareholding structure down to the ultimate beneficial owners (UBOs). If offshore structures such as BVI or Cayman Islands are involved, the source of funds must be prominently disclosed.

Office Premises: There must be fixed office premises with independent, enclosed, and secure office space to meet the requirements for confidentiality of client information and security of trading systems.

2. Financial Resources Requirements (FRR)

3. Personnel

  • Responsible Officers (ROs)

ROs are senior management personnel of the licensed corporation and bear primary legal responsibility for the company's compliant operations.

Regulatory Indicators:

  • Quantity and Residency Rights:Each type of license must be equipped with at least two ROs, at least one of whom must be an Executive Director resident in Hong Kong.
  • VA Competency Requirements:For virtual asset businesses, the SFC requires ROs not only to possess traditional financial management experience but also to have relevant industry experience, which typically includes: having managed crypto funds, having worked at licensed virtual asset exchanges, or possessing a strong technical background in blockchain technology/cybersecurity.

In practice, personnel allocation—especially the recruitment and approval of ROs—is one of the biggest pain points and difficulties in the VA license application process. Currently, the SFC's interviews for ROs in VA businesses are extremely rigorous, conducting penetrating inquiries into technical details (such as custody risk control and handling stablecoin de-pegging events). If an RO performs poorly in the interview and is deemed "incompetent," it will directly cause the license application to stall.

  • Licensed Representatives (LRs)

Any person representing the company in providing regulated services to the public must apply to become a Licensed Representative. Conducting business without a license constitutes a criminal offense.

 

SFC License Application Process and Timeline

The application cycle typically takes 8–16 months (including the preparation period) and can be divided into four stages:

Guidelines for "VA Uplift" Upgrades for Existing Institutions

For institutions already holding traditional Type 1, 4, or 9 licenses, if they plan to engage in VA business (particularly where VA accounts for ≥10%), they must apply to the SFC to expand their scope of business (Uplift, license upgrade/business expansion).

1. Core Gap Analysis for Upgrades

  • Personnel Upgrade

Add at least one RO with VA experience, or demonstrate that existing ROs have undergone systematic training (though this is difficult to gain SFC acceptance).

  • Custody Upgrade

Contract with an SFC-licensed VATP (such as OSL or HashKey) or a qualified custodian. It is necessary to submit this new custody arrangement agreement to the SFC to demonstrate that asset segregation has been achieved.

  • Capital Management Upgrade

Note that crypto assets may face high haircuts when calculating liquid capital, which may require supplementing fiat capital to meet liquidity red lines.

  • Risk Control and Compliance Manuals

Update risk control, compliance, and anti-money laundering systems to adapt to the characteristics of VA business.

2. Upgrade Process

Step 1: Self-Assessment and Preparation

  • Conduct a Gap Analysis
  • Recruit new ROs or consultants
  • Select a VA custodian

Step 2: Submit Application

  • Submit relevant materials through the WINGS platform.

Step 3: Regulatory Inquiries

Step 4: Approval

The SFC issues a formal letter approving the business change, accompanied by new license Terms & Conditions.

3. Upgrade Timeline

Upgrading a Type 1 license may take one to three months, while upgrading a Type 9 license may take five to six months or even longer, depending on the number of SFC inquiries and the complexity of the business.

 

Common Pitfalls Leading to Application Failure

Based on practical experience, the main reasons for application delays or rejections include:

  • Obstacles to RO Performance of Duties:Resignation of an RO during the application period, lack of visa, or being deemed "incompetent" by the SFC.
  • Difficulties in Bank Account Opening:Even if an Approval in Principle (AIP) is obtained, failure to open a bank account to inject capital will prevent the license from being finalized.
  • False Disclosure:Concealing criminal records or history of regulatory sanctions, which, once discovered, will lead to serious consequences.

It should be noted that:Unlike the common model in mainland China of "pre-approval + penetrating item-by-item review of materials," the SFC relies more on "self-disclosure + commitment system" during the declaration stage. This means applicants are required to disclose information truthfully and completely, without needing to attach a full set of supporting documents for every statement. However, if later determined to involve "false disclosure/misleading statements/material omissions," etc., the applicant may face multiple penalties including criminal, civil, and regulatory actions, with extremely severe legal consequences.

  • Incorrect Business Positioning:Choosing the wrong license type (e.g., actually conducting Type 4 license business but choosing to apply for a Type 9 license).

 

Conclusion

The SFC's regulatory logic for virtual asset business in Hong Kong has moved from a "sandbox" approach to a "framework-based" approach. Whether for new establishments or upgrades of existing entities, the core lies in demonstrating compliance capabilities in three dimensions: personnel competency, asset custody security, and anti-money laundering risk control. It is recommended that applicants conduct a thorough Gap Analysis before launching and reserve sufficient capital and time costs.