Hong Kong’s Financial Services and the Treasury Bureau (FSTB) and Securities and Futures Commission (SFC) published consultation conclusions on December 24, 2025 for two new licensing regimes — one for virtual asset (VA) dealing and one for VA custodian services — with the underlying legislation now slated for the Legislative Council in 2026 and a parallel consultation on VA advisory and management licensing closing January 23, 2026. The package places Hong Kong’s framework alongside the Singapore Monetary Authority’s (MAS) Digital Payment Token (DPT) regime, the Dubai Virtual Assets Regulatory Authority (VARA), and the United States Securities and Exchange Commission (SEC) post-Staff Accounting Bulletin (SAB) 121 custody framework as the four jurisdictional reference points the Asia-and-Gulf crypto hub competition is now fought over.

The Hong Kong consultation, run jointly by the FSTB and the SFC, ran for two months and drew more than 190 responses, with the resulting conclusions framing both regimes as additions to the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) rather than fresh primary statutes (FSTB / SFC joint statement, December 24, 2025). The new VA dealing licence will mirror the licensing expectations applied to securities intermediaries under the existing SFC framework, while the custodian licence focuses on private-key control and unilateral authority to transfer client assets (Gibson Dunn client alert, January 2026). This longform walks through what each regime actually covers, how the four jurisdictions diverge, the enforcement context that the new rules will inherit, and the operational footprint that licensed firms now need to be planning for.

Key Facts:

• Consultation conclusions issued December 24, 2025 by FSTB and SFC, covering VA dealing and VA custodian licensing — FSTB / SFC joint statement
• Legislation expected in the Legislative Council in 2026 — FSTB / SFC, December 2025
• Parallel consultation on VA advisory and management licensing closes January 23, 2026 — Slaughter and May client note, December 2025
• Hong Kong stablecoin licensing under the Stablecoins Ordinance came into force August 1, 2025; first licences issued under that regime in March 2026 — Davis Polk client update, HKMA
• 190+ consultation responses received over two months — FSTB / SFC, December 2025
• Custodian licensing turns on private-key safeguarding and unilateral asset-transfer authority — Gibson Dunn client alert, January 2026
• Multi-Party Computation (MPC) providers exempt where clients can independently access VAs without provider co-operation — Gibson Dunn client alert, January 2026

Methodology and sources

This analysis uses primary regulator documents from Hong Kong, Singapore, the UAE, and the United States as the source layer: the FSTB / SFC consultation conclusions of December 24, 2025; the Stablecoins Ordinance commencement notice of August 1, 2025; the MAS Notice PSN02 on Single-Currency Stablecoin (SCS) regulation; the VARA Custody Services Rulebook (current version 2.0); and the SEC’s January 2025 rescission of SAB 121 plus the May 2025 staff statement that followed. Secondary legal analysis is drawn from named client alerts at Davis Polk, Slaughter and May, Sidley Austin, and Gibson Dunn dated December 2025 through January 2026. The time window for the cross-jurisdictional comparison is January 2025 to May 2026. Caveat: the Hong Kong bill text itself is not yet public; this analysis tracks the consultation conclusions, which are binding in policy direction but may differ at the bill-drafting stage.

What the new Hong Kong rules actually say

The Hong Kong VA dealing regime is structured as a new licence under the AMLO rather than under the Securities and Futures Ordinance (SFO). A VA dealer is any entity carrying on a business of dealing in virtual assets in or from Hong Kong — but the consultation conclusions narrowed the definition relative to the consultation proposal by excluding derivative or structured products that reference VAs. That carve-out matters: a Hong Kong-incorporated arranger of an exchange-traded note linked to a VA basket is not, on the face of the conclusions, automatically caught by the new dealing regime, while a firm that buys and sells the underlying VA spot is. The dealer rules align with licensing expectations for SFC securities intermediaries — fit-and-proper tests for responsible officers, capital adequacy thresholds, an annual compliance return, and FATF Travel Rule compliance for outbound transfers. Only HKMA-licensed stablecoin issuers are clearly exempt; the other categories of potential exemption remain “under consideration” per the FSTB / SFC text.

The VA custodian regime is the more operationally consequential leg. A VA custodian is any entity that safeguards private keys for clients or has unilateral authority to transfer client VAs. Crucially, the conclusions adopt a flexibility that the original proposal did not: a Multi-Party Computation (MPC) provider can avoid licensing where clients can independently access their VAs without the provider’s co-operation. That is a notable departure from a Hardware Security Module (HSM)-only requirement and aligns Hong Kong with the institutional crypto-custody architecture used by firms covered in our reporting on Zodia Custody’s Canton Coin integration. The custodian regime imposes an absolute segregation requirement — client VAs cannot be commingled with proprietary assets, even temporarily — and requires the maintenance of a transaction record sufficient for the SFC to reconstruct any movement.

The VA dealing-and-custodian regime is layered on top of the existing Hong Kong stablecoin licensing regime that came into force August 1, 2025 under the Stablecoins Ordinance, and which has already produced the first cohort of HKMA-licensed issuers in March 2026, as detailed in our reporting on Hong Kong’s first stablecoin licences. The SFC’s broader market-infrastructure push is set out in its 2025 capital markets work program, summarised in our coverage of the SFC tokenisation and cross-border report.

How four jurisdictions compare

Jurisdiction / Regulator	Effective date	Scope	Key requirement	Penalty / sanction
Hong Kong (FSTB / SFC under AMLO)	Bill expected in LegCo in 2026; AML/CTF Ordinance amendments	VA dealers and custodians (incl. MPC where provider has unilateral authority)	Fit-and-proper, capital adequacy, FATF Travel Rule, absolute segregation	Up to HK$5 million fine + 7 years’ imprisonment (AMLO offence range)
Singapore (MAS) — Payment Services Act / DPT	PS Act in force; DPT amendments effective stages from April 2024	DPT service providers (dealing, custody, transfer)	Capital, segregation, AML/CFT, technology-risk-management (TRM) notices	Civil penalties + criminal exposure under PS Act s.99
UAE Dubai (VARA) — Custody Services Rulebook	Custody Rulebook v2.0 in force 2024 — VARA	VASPs offering custody in or from the Emirate (excl. DIFC)	Cold/hot wallet ratio, segregation, prudential capital, insurance	Administrative fines + licence suspension/withdrawal
United States (SEC) — post-SAB 121 staff statement	SAB 121 rescinded January 23, 2025; staff statement May 2025	Custody by SEC-regulated broker-dealers and banks holding crypto for clients	Special Purpose Broker-Dealer (SPBD) framework; bank custody under OCC Interpretive Letters 1170/1183	Civil money penalties + cease-and-desist orders

Sources: FSTB / SFC joint statement (December 24, 2025); MAS Notice PSN02; VARA Custody Services Rulebook; SEC Staff Statement (May 2025) and SAB 121 rescission notice. Last updated: May 25, 2026.

The four regimes diverge most sharply on three axes. First, the statutory anchor: Hong Kong runs its dealer-and-custodian regime under the AMLO, while Singapore’s DPT regime sits inside the Payment Services Act (PSA), the UAE’s VARA framework is a standalone emirate-level regulator created under Dubai Law No. 4 of 2022, and the United States layers SEC and Office of the Comptroller of the Currency (OCC) guidance on top of pre-existing banking and broker-dealer statutes. Second, the segregation standard: Hong Kong’s absolute segregation rule is stricter than the MAS framework (which permits commingled omnibus accounts with reconciliation) and stricter than what the SEC SPBD framework currently requires of broker-dealer wallets. Third, the treatment of MPC custody: Hong Kong’s exemption for non-controlling MPC providers is a clear win for the institutional architecture covered in our reporting on BitGo’s MAS-regulated APAC launch — Singapore, the UAE, and the SEC have all required formal licensing or interpretive comfort for the same configuration, increasing the cost-of-licence relative to Hong Kong’s approach. The UAE’s VARA custody rulebook, separately covered in our piece on Crypto.com’s VARA derivatives licence, is the most prescriptive of the four on wallet hot/cold ratios and insurance.

“The proposed establishment of licensing regimes for VA dealing and custodian service providers marks a significant step in enhancing our legal framework for digital assets.”

— Christopher Hui, Secretary for Financial Services and the Treasury, Hong Kong SAR Government (FSTB / SFC joint statement, December 24, 2025)

Enforcement context

The new Hong Kong regimes inherit two enforcement reference points. The first is the SFC’s own enforcement record under the existing VA Trading Platform (VATP) licensing regime, which has issued public reprimands and licence-restriction notices since the OSL and HashKey licensings were granted in late 2023. The most directly relevant recent action was the SFC’s January 2024 statement on unregulated VA-related platform operators, which signalled that licensing perimeters would be enforced at the marketing-and-solicitation level as well as at the operational level. The second reference point is the JPEX collapse of September 2023 — the unlicensed Hong Kong platform whose insolvency triggered roughly HK$1.7 billion in client losses and which provided the political case for the dealing-and-custodian regime now being legislated. JPEX is referenced in the consultation conclusions as the precipitating risk that the dealer-and-custodian package is designed to address.

Cross-jurisdictionally, the enforcement comparison is sharpest with Singapore, where MAS issued prohibition orders against multiple crypto-related entities in 2024–2025 under the existing PSA, and with the United States, where the SEC’s enforcement under SAB 121 (before its rescission) had functionally barred SEC-registered broker-dealers and banks from holding crypto on-balance-sheet for clients. The SAB 121 rescission did not create a custody licence — it removed a balance-sheet disincentive — which is the structural difference Hong Kong’s new custodian regime is now positioning against.

What this means for dealers, custodians, and compliance teams

For VA dealers operating in or from Hong Kong, the operational footprint is sizeable. Responsible officers will need to clear the SFC fit-and-proper standard, the firm will need an SFC-approved Manager-in-Charge structure, and the AML/KYC architecture must support FATF Travel Rule compliance for outbound transfers to both VASP and non-VASP wallets. Capital adequacy and an annual compliance return are required. The hard commencement date with no transition relief — flagged by Gibson Dunn as a notable departure from the SFC’s prior practice — means firms currently operating in an unlicensed grey zone will face an enforcement perimeter from day one, with only expedited licensing relief available for certain entities. Firms should be planning a six-to-nine month licensing-readiness program now rather than waiting for the bill text.

For VA custodians, the absolute segregation rule is the single most consequential operational requirement. Existing institutional custodians using omnibus-account architectures common in the United States and parts of Europe will need to re-engineer their wallet-and-key architecture for Hong Kong client books before they can take on regulated mandates. The MPC exemption is operationally useful but turns on a precise factual test — whether the client can independently access their VAs without the provider’s co-operation — and is likely to be a frequent point of legal contention in licence applications.

For fund managers and family offices using third-party custodians, the practical effect is that custody counterparty diligence in Hong Kong now requires confirming the custodian’s specific licence status under the new regime, not just under the existing AMLO or VATP regime. For legal and compliance teams, the absence of a published bill text means the next three-to-six months are the right window to engage with the SFC’s licensing division on bespoke fact patterns — particularly around derivative-and-structured-product carve-outs, MPC configurations, and the treatment of cross-border custody mandates where the underlying client is non-Hong-Kong.

“The significant progress in our VA regulatory framework ensures Hong Kong remains at the global forefront of digital asset market developments by fostering a trusted, competitive and sustainable ecosystem.”

— Julia Leung, Chief Executive Officer, Securities and Futures Commission, Hong Kong SAR (FSTB / SFC joint statement, December 24, 2025)

What’s next — the forward view

Three timelines now matter. First, the bill itself: the FSTB has indicated 2026 introduction to the Legislative Council, with the operative text expected to confirm whether the consultation conclusions translate one-for-one or whether the “under consideration” exemption categories crystallise as exemptions or fall away. Second, the parallel VA advisory and management consultation closes January 23, 2026; the SFC’s conclusions on that consultation will determine whether Hong Kong adopts a unified advisory-and-management framework or carves the two licences apart. Third, the EU MiCA full-effect date of December 30, 2024 has now had 17 months of operational data; ESMA’s first set of MiCA enforcement actions in 2026 will set the comparative pressure on the Hong Kong regime, given the regulatory-arbitrage flows between MiCA-passport jurisdictions and Asia hubs that we tracked in our analysis of the GENIUS Act versus MiCA stablecoin regime split. The political backdrop in Hong Kong is supportive — the government has been explicit about positioning the city as the Asia crypto hub against Singapore — but the bill text and the licensing-grant cadence will be what decides whether the regime translates the political support into operational reality.

FAQ

When does the Hong Kong VA dealer and custodian regime take effect?

The FSTB and SFC plan to introduce legislation to the Legislative Council in 2026, with the operative text adding new licences under the AMLO. The consultation conclusions were published on December 24, 2025, and a parallel VA advisory and management consultation closed January 23, 2026. The bill text itself is not yet public; commencement dates and any transitional arrangements will be set out in the bill.

What is the difference between the new VA dealer licence and the existing VATP regime?

The existing VA Trading Platform (VATP) regime under the SFO covers exchange-style platforms. The new VA dealer licence under the AMLO covers dealers — entities carrying on a business of buying and selling VAs in or from Hong Kong outside the platform context. The two regimes are complementary; a firm may need both licences depending on its activities. The dealer definition excludes derivative and structured products referencing VAs.

How does the Hong Kong custodian regime compare to MAS Singapore?

Hong Kong imposes absolute segregation — client VAs cannot be commingled with proprietary assets at any point. MAS Singapore allows omnibus-account architectures with daily reconciliation under the Payment Services Act. Hong Kong’s exemption for non-controlling MPC providers is more permissive than Singapore’s framework. Both regimes require capital adequacy, AML/CFT, and technology-risk controls; the operational difference for institutional custodians is significant.

Will MPC custody providers need a Hong Kong licence?

Only where the MPC provider has unilateral authority to transfer client assets. The consultation conclusions explicitly carve out MPC arrangements in which clients can independently access their VAs without the provider’s co-operation. The boundary is factual rather than purely contractual, and licensing applicants should expect the SFC to scrutinise the actual key-management architecture against the carve-out language.

Does the new regime cover stablecoin issuers?

HKMA-licensed stablecoin issuers under the Stablecoins Ordinance (in force August 1, 2025) are explicitly exempt from the new dealer regime. The first cohort of HKMA stablecoin licences was granted in March 2026 from 36 applicants. Stablecoin custody by a third party still falls within the new custodian regime where the custodian satisfies the safeguarding-or-unilateral-transfer test.

What is the enforcement risk for firms operating without a licence?

The dealer-and-custodian regime sits under the AMLO, which carries up to HK$5 million in fines and seven years’ imprisonment for unlicensed activity offences. There is no transition relief in the consultation conclusions; the SFC will enforce the perimeter from the commencement date. Expedited licensing relief is available for certain entities but not as a general transition mechanism. The JPEX collapse of September 2023 is the precipitating risk case the new regime is designed to prevent.

How does the Hong Kong package fit with global cross-border policy?

FATF Travel Rule compliance is mandatory for outbound transfers, aligning Hong Kong with the global Recommendation 15 framework. The dealer-and-custodian regime is consistent with the IOSCO 2023 crypto and digital asset policy report and with the FSB’s global cross-border crypto framework. Bilateral cooperation arrangements with MAS, VARA, and the SEC are likely to follow once the bill is enacted.

This article is informational analysis only and does not constitute legal, regulatory, tax, or investment advice. Regulatory frameworks change frequently and interpretation depends on facts and circumstances; primary documents and official regulator guidance always supersede summaries. Firms should consult qualified legal counsel and their relevant supervisory authority before taking any action based on the analysis above.