With the 2026 OTC license legislation countdown underway, the compliance path is becoming clear. As an international financial center, Hong Kong reaffirmed its commitment to becoming a global innovation hub for digital assets through the "Declaration on Digital Asset Development Policy 2.0." The "VA upgrade" of crypto asset trading platforms and the Hong Kong Securities and Futures Commission's traditional licenses is more like the first step in a comprehensive crypto asset regulatory system. Entering 2026, with the advancement of consultations on two important "regulatory vacuums"—Virtual Asset (VA) Dealing and VA Custody—the Financial Services and the Treasury Bureau (FSTB) and the Securities and Futures Commission (SFC) have clarified their legislative direction, aiming to introduce two dedicated licensing regimes through amendments to the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO). This formalizes the "upgrade" regime of SFC licenses 1, 4, and 9, which have been in place for some time, signifying that the professionalization and formalization of crypto asset regulation in Hong Kong is about to be fully completed. As of now, the relevant consultation conclusions were released on December 24, 2025, and further public consultations (regarding "providing advice on crypto assets" and "crypto asset management") are nearing completion (ending January 23, 2026). This article will summarize the regulatory progress, analyze the content and core changes of existing important documents, and provide a general overview for those intending to apply for a license. The evolution of Hong Kong VA regulation can be traced back to 2018, when the SFC issued its first VA regulatory approach statement, establishing the principle framework of "same business, same risk, same rules." Although this statement did not directly target OTC and custody, it laid the foundation for subsequent developments. In 2019, the SFC released a position paper on VA trading platform regulation, introducing a voluntary opt-in framework, requiring platforms to comply with investor protection, asset segregation, and anti-money laundering (AML/CFT) requirements. At this time, custody was considered an ancillary service of VATP, while OTC remained on the fringes of regulation. In 2022, the AMLO revision introduced the definition of Crypto Asset Service Provider (VASP), bringing trading and custody under the AML scope, but dedicated licenses were still lacking. On June 1, 2023, the AMLO VASP system officially came into effect, mandating the launch of VATP licenses. VATPs must manage client assets through wholly-owned subsidiaries (98% cold storage, 2% hot storage) and comply with strict asset segregation, insurance, and auditing requirements. This signifies the maturation of centralized trading regulation, but gaps remain in OTC and independent custody, highlighting the potential for accumulated market risks. In March 2024, the FSTB and SFC launched a consultation on OTC VA trading. At the beginning of 2025, on February 19, the SFC released the "ASPI-Re" roadmap, explicitly supporting the introduction of dedicated OTC licenses to ensure equality with VATPs; while also exploring flexible custody technologies (such as dynamic storage ratios).This roadmap set a goal of completing legislative preparations by the end of 2025. A key turning point occurred on June 27, 2025—the FSTB and SFC jointly released a consultation document on legislative proposals for VA trading (including OTC) and custody services. The consultation period ended on August 29, collecting over 190 responses covering industry, investor, and regulatory opinions. On November 3, the SFC issued a circular expanding VATP products and services, allowing VATP-affiliated custody of non-trading VAs (such as stablecoins and tokenized securities), and relaxing the 12-month track record requirement. This move already showed a clear transitional character, allowing for a more diverse range of custody forms. On December 24, 2025, the FSTB and SFC released their consultation conclusions on the legislative proposals for VA trading and custody, while simultaneously launching further consultations on VA opinion provision and management services (until January 23, 2026). With the further consultations nearing completion in 2026, the AMLO amendment bill is expected to be introduced into the Legislative Council for consideration in the first half of the year, with the effective date depending on the progress of the review. A clear regulatory approach is emerging: custody and trading are moving from the sidelines of regulation to the forefront. On the one hand, the learning and exploration phase is over; regulators are determined to completely reshape Hong Kong's VA ecosystem, rather than just offering piecemeal solutions. On the other hand, this reflects the industry's sentiment—for service providers hoping to establish a long-term presence in Hong Kong, compliance costs are preferable to bearing the uncertainty of operating in a gray area. Among the existing core regulatory documents, the legislative proposal consultation of June 27, 2025, and its consultation conclusion of December 24, 2025, are the most representative: the former proposes a separate legislative framework for AMLO licensing regulation, while the latter further refines it based on industry feedback. VA Transactions 1. Definition: Highly aligned with License 1 (Dealing in Securities) under the Securities and Futures Ordinance (SFO). Specifically, anyone engaging in the following activities in a business manner will need to apply for a license under the AMLO framework: entering into or offering to enter into agreements with others to buy, sell, subscribe for, or underwrite virtual assets; inducing others to enter into such agreements. The definition actually covers a wide range of trading activities, from simple transactions such as VA-fiat/VA-VA conversions to more complex brokerage services, block trades, margin trading, and staking. However, derivatives, structured products, and tokenized securities fall under the traditional jurisdiction of the SFO license and are not included in the newly added VA regulatory types. 2. Compliance Requirements: VA trading service providers must comply with strict AML requirements, including customer due diligence (CDD) and record keeping. 3. Custody: VA licensed service providers are required to initially place clients' VA in an SFC-regulated custodian institution to reduce the risks of bankruptcy, fraud, and cyberattacks. 4. Minimum Financial Requirements: A minimum of HKD 5 million in equity capital plus HKD 3 million in liquid capital.5. Exempted Activities: These include insider trading, buying and selling of proprietary assets, paying for goods and services with VA, transactions necessary solely under VA management, and stablecoin issuance (already regulated by the HKMA). 6. No transition period or "deemed licensed" arrangement. 7. Fast Track: The SFC will provide expedited approval and assistance to VATPs already licensed by the SFC and institutions holding an SFC Upgrade No. 1 license. VA Custody 1. Definition: Covers "custodians who hold any instrument that can be used to transfer virtual assets for any person" (from item (ii) of the definition in the initial consultation document). The SFC states that the purpose of this definition is to be technology-neutral, emphasizing risk management based on business substance rather than form: the need for licensing is not determined by decentralized technology or the specific service offered. 2. Core Considerations: Private Key Management – If an entity holds a private key or similar tool and has the ability to unilaterally transfer it, a license is required. MPC providers do not require a license if clients can independently reconstruct the private key and unilaterally transfer the VA. Conversely, if the transfer requires additional support (such as coordination in MPC multi-signature scenarios), it may fall under regulatory scrutiny. Similarly, staking services involving a custodial model, where the custodian has the ability to unilaterally transfer the VA, require a license; non-custodial wallets or purely delegated scenarios are exempt. 3. Exemptions: Internal group custody (regardless of whether it is charged); private key backup holdings by legal or accounting professionals and court-designated scenarios; licensed stablecoin issuers only holding their own stablecoins; PE/VC fund managers self-custodying their investment tokens, etc. Trusts/fund managers that only delegate custody, and multi-party computation (MPC) services without transfer capabilities are excluded. 4. Individual Licensing: This is the most noteworthy point. Senior executives, direct accessors to private keys, participants in signing programs, and those with access to private keys must be approved as ROs or equivalent licensed roles and meet relevant requirements, essentially equivalent to "individual licensing." 5. Minimum Financial Requirements: At least HK$10 million in share capital + HK$3 million in liquid capital. 6. No transition period or "deemed licensed" arrangement. 7. Fast track. Combining the above two aspects of the new licensing framework, the core change in the consultation opinion and its conclusions compared to the previous framework lies in the introduction of independent licenses. Previously, OTC transactions involving securities VA might require an SFO Type 1 license; custody relied on a TCSP license or VATP, leading to regulatory fragmentation. Meanwhile, VA upgrades for traditional SFC Type 1, 4, and 9 licenses all required holding and maintaining traditional licensed businesses simultaneously, which was undoubtedly a heavy burden for startups exploring Web3. The new framework adopts an AMLO-specific license, covering a wider range of business models (such as P2P and decentralized services) and emphasizing technological flexibility.The changes are also reflected in the absence of a transition period, but the expedited procedures for existing licensees minimize the impact of market disruptions. Simultaneously, regulation shifts towards "prevention," enhancing overall compliance through measures such as minimum capital thresholds and prohibitions on proactive marketing to the Hong Kong public. These adjustments, stemming from market feedback, balance rigor and flexibility, avoiding the rigidity of the early VATP system. Overall, these documents signify the expansion of Hong Kong VA regulation from a VATP-centric approach to a full-chain approach, focusing on filling gaps, standardizing practices, and paving the way for institutional entry. The FSTB and SFC will finalize the AMLO amendment draft based on these findings. Further consultations will focus on VA opinions and management licenses, with feedback expected to be integrated into a complete proposal by January 23rd. The bill is expected to be introduced to the Legislative Council for review in the first half of the year. Given the efficient Hong Kong legislative process (typically several months of review), the bill may be passed by mid-year, with an effective date potentially in the second half of 2026, barring major controversies. Mankiw suggests that for the familiar medium-to-large-sized money exchange shops, maintaining an SFC upgrade license is costly, and their actual services don't require other permissions—essentially a waste of resources. This reflects a general consensus among respondents during the legislative consultation that expanding regulation is necessary, viewing it as a "natural" step towards Hong Kong's digital asset ecosystem. The alignment with the existing SFO framework, the strengthening of the principle of technology neutrality, and the institutionally friendly design (attracting banks and traditional financial institutions) will further revitalize the local market. Simultaneously, Hong Kong plans to formally localize the CARF framework in 2027, further strengthening cross-border AML cooperation. Overall, the successful implementation of this legislation could elevate Hong Kong's status as a VA center to a new level. The previous approach of speculating on regulation in the margins was irresponsible; rather than viewing the regulation as detailed in certain aspects, it should be seen as a suggestion for the division of labor in the Hong Kong VA market. For companies intending to apply for VA OTC or custody licenses, early preparation is crucial: First, clarify and define the proposed business model to define license compliance requirements, avoiding later adjustments and facilitating pre-application discussions with the SFC. Existing licensees can utilize the expedited process to simplify the review. Second, strengthen the internal compliance system. Meet the minimum financial requirements and ensure the AML/CFT mechanism is robust. Custody applicants need to prioritize investment in technological infrastructure; OTC applicants should plan for cooperation with SFC-regulated custody services and initially avoid self-operated custody. Finally, monitor legislative developments, participate in industry association feedback, and train the team in advance. While compliance increases costs, it will bring opportunities for institutional funding inflows.If you're already considering this issue before the legislation is implemented, congratulations! You're very likely already on the platform, with a train about to depart from Hong Kong bound for the next crypto boom. Whether your ticket to this train is rightfully yours is something you might want to discuss with us after reading this article. [Mankiw Blockchain Legal Services]