Bifu Research | 2026

Abstract

With the end of the "non-contravention period" in June 2024 and the subsequent regulatory washout, the Hong Kong Virtual Asset Trading Platform (VATP) market has bid farewell to the early "Wild West era" and entered a highly mature stage of "licensed oligarchy." As of early 2026, the market landscape has shifted from a "traffic game" to a "credit game" centered on licensing and capital.

This report provides an in-depth review of the market evolution following the implementation of Hong Kong's VATP regime, analyzes the security logic behind the "compliance costs in the tens of millions," and focuses on how the Omnibus account model linking brokers and exchanges is reshaping traffic distribution paths. Bifu believes that compliance is not just an entry pass to the market, but the highest moat for asset security. Under this new order, only by establishing a financial-grade risk control foundation can institutions win the long-term trust of institutional and core investors across cycles.

I. Market Overview: Reshaping the Landscape after Regulatory Cleansing

1.From "War of a Hundred Exchanges" to "Survivor Game"

Looking back at the regulatory process from 2023 to 2025, the Hong Kong market underwent a brutal yet necessary "supply-side reform." Through extremely rigorous licensing standards, the SFC (Securities and Futures Commission) caused a large number of platforms that could not bear compliance costs or meet anti-money laundering (AML) requirements to voluntarily withdraw their applications or be ordered to shut down.

As of January 2026, the list of licensed VATPs in Hong Kong has been settled. The market did not see the "blossoming of a hundred flowers" as previously expected, but rather formed an oligopolistic landscape dominated by a few head institutions such as OSL, HashKey, and HKVAX.

• The Exiters: Including some globally renowned major exchanges that chose to abandon the Hong Kong retail market because they could not adapt to independent asset segregation and audit requirements.
• The Survivors: The remaining platforms all possess deep traditional financial backgrounds or strong local capital support.

2.Ascension of Competition Dimensions

Under the new market order, the competitive logic of exchanges has fundamentally reversed: the focus of competition has shifted from the past "listing speed and leverage multiples" to "custody security, insurance coverage, and the smoothness of fiat channels." For institutional investors, a license is not only proof of compliance but also a credit endorsement for asset security.

II. Regulatory Analysis: Panoramic Licensing Ecosystem

Virtual asset regulation in Hong Kong is not a single-dimensional management of exchanges, but a rigorous system of "dual licensing" and a "full license ecosystem." This covers not only exchanges (VATPs) but also brokers, fund managers, and investment advisors, jointly constructing a financial-grade market foundation.

1.Institutional Origins: Evolution from "Mandatory Licensing" to "Full Ecosystem Regulation"

Reviewing the evolution of Hong Kong's regulatory logic, we have witnessed a complete process from point breakthroughs to systematic coverage.

• On June 1, 2023, the Anti-Money Laundering and Counter-Terrorist Financing (Amendment) Ordinance (AMLO) officially came into effect, marking the transition of the Hong Kong virtual asset market from the early "voluntary licensing" to the "comprehensive mandatory regulation" era. This framework aims to fill the legal vacuum where the SFC could previously only regulate "security tokens," mandating that all centralized platforms operating in Hong Kong accept look-through regulation.
• As the market developed, the regulatory framework was further refined. On December 24, 2025, the Financial Services and the Treasury Bureau ("FSTB") and the Securities and Futures Commission ("SFC"), after absorbing industry feedback, released the Consultation Conclusions on the proposed new licensing regime under the AMLO framework. This document not only summarized the preliminary regulatory thinking but also clarified that regulation would extend from a single trading platform to the entire service ecosystem.
• According to the Consultation Conclusions, three new specific licenses for virtual asset-related services will be established under AMLO, covering three major categories of services: virtual asset trading, providing advice on virtual assets, and virtual asset management.
• The profound meaning of this change lies in "benchmarking and integration." The newly established AMLO licenses will form a complete mirror relationship with the existing Type 1 (Dealing in securities), Type 4 (Advising on securities), and Type 9 (Asset management) regulated activity licenses under the Securities and Futures Ordinance (SFO). Notably, the newly established virtual asset trading license will cover a broader business scope and business models than the existing upgraded Type 1 license.
• To reduce compliance costs, regulators specifically introduced a "fast track": traditional financial institutions that already hold upgraded Type 1, Type 4, or Type 9 licenses can quickly obtain the corresponding new AMLO licenses through this procedure. This mechanism greatly opens up the compliance channel for traditional financial institutions to enter the Web3 field.

2.Top-Level Design: Precise Mapping of Licenses and Businesses

Based on the above institutional evolution, the SFC has drawn clear business red lines. Simply put, engaging in different virtual asset businesses requires holding the corresponding specific licenses. The regulatory requirements are straightforward:

• Operating an Exchange: This is the business with the highest threshold. Operators must simultaneously hold Type 1 (Dealing in securities) and Type 7 (Providing automated trading services) licenses, and concurrently hold a VASP license under AMLO, to provide matching trading services.
• Asset Management: For crypto funds, if virtual assets account for more than 10% of the investment portfolio, the manager must hold a Type 9 (Asset management) license.
• Investment Advice: For research institutions or analysts, if they provide research reports or buy/sell recommendations on virtual assets, they must hold a Type 4 (Advising on securities) license.

This "business-is-license" look-through regulation ensures that whether operating a platform, issuing a fund, or giving advice, all are within the range of financial regulation.

3.Core Qualifications: The Compliance Combo of Type 1 and Type 7 Licenses

In the above system, the license combination held by exchanges is the most core. Licensed institutions must simultaneously hold licenses for Type 1 (Dealing in securities) and Type 7 (Providing automated trading services) regulated activities. These two licenses constitute the "skeleton" of a compliant exchange:

• Type 1 License (Dealing in securities): Grants the platform the statutory qualification to buy and sell virtual assets for clients. It introduces the traditional broker's "Know Your Client" (KYC) and Investor Suitability Test requirements, ensuring the platform understands the client's risk tolerance.
• Type 7 License (Providing automated trading services): Approves the platform to conduct automated trading through a proprietary electronic matching system. This requires the platform to establish a comprehensive Market Surveillance System to prevent market manipulation and ensure trading fairness.

In addition to the licenses themselves, regulators have set clear requirements for licensed entities in the following key dimensions:

• Strict Financial Resource Requirements: Licensees must always maintain a paid-up share capital of not less than HKD 5 million and hold Liquid Capital matching their business scale, usually required to be not less than HKD 3 million or the sum of 12 months of operating expenses (whichever is higher). This ensures that the platform has sufficient risk-resistant capital reserves to maintain operations under extreme market conditions.
• Responsible Officer (RO) System: The platform must employ at least two Responsible Officers (RO) for each type of regulated activity, at least one of whom must be based in Hong Kong. Regulators specifically emphasize that ROs need not only traditional financial license qualifications but also actual industry experience in managing virtual asset trading. This requirement has greatly raised the talent threshold; currently, ROs with both traditional finance and Web3 experience are "hard to find."
• Market Integrity and Conflict of Interest Management: The SFC explicitly prohibits licensed platforms from engaging in Proprietary Trading or market-making businesses. This means the platform can only act as a pure matching intermediary, strictly forbidden from "being both the referee and the player," thereby rooting out the moral hazard of betting against user data like FTX did.

4.High Standards for Asset Security: The 98/50 Rule

Regarding client asset protection, the SFC has set hard indicators far above the industry average, directly constructing the highest moat for fund security.

• First is the hard rule of 98% Cold Storage rate. Regulation requires that 98% of client virtual assets held by the platform must be stored in Cold Storage to maximize physical isolation and defend against cyber hacking attacks. The platform is only allowed to keep no more than 2% of assets in hot wallets to meet daily withdrawal needs. This ratio requirement greatly increases the difficulty of liquidity management for platforms but also maximizes asset security.
• Second is the Full Insurance Coverage backstop mechanism. This is one of the links with the highest compliance costs. Regulation explicitly requires that hot wallet assets must be 100% covered by insurance, and cold wallet assets must also be 50% covered by insurance. This means that for every penny of a user's assets, there is an insurance company or an equivalent bank guarantee letter providing a risk backstop behind it, which is unimaginable in unregulated markets.

5.Asset Segregation and TCSP Trust Architecture

To avoid misappropriation risks, licensed exchanges are prohibited from directly holding client assets. The platform must establish a wholly-owned subsidiary and obtain a "Trust or Company Service Provider" (TCSP) license. Client assets are defined as "trust assets," completely physically segregated from the exchange's own funds, ensuring that users have priority claims in the event of bankruptcy liquidation.

III. Model Evolution: Traffic Distribution between Brokers and Exchanges

Against the backdrop of "difficulty in customer acquisition" faced by licensed exchanges, the "Broker-Exchange" linkage based on the upgraded Type 1 license has become the mainstream business model.

1.Two Compliance Paths: Omnibus Account vs. Introducing Agent

Brokers (intermediaries) holding a Type 1 license participate in the market in the following two ways:

• Omnibus Account Model: The broker opens a master account at a licensed exchange. Users place orders in the broker's APP, and the broker packages and sends the instructions to the exchange. Users do not perceive the existence of the exchange, resulting in the smoothest experience. Currently, mainstream brokers mostly adopt this model.
• Introducing Agent Model: The broker introduces clients to a licensed exchange, and clients open accounts directly at the exchange. The broker only acts as a traffic channel, and subsequent trading takes place on the exchange.

2.Separation of Traffic and Liquidity

The evolution of this business model has led to the separation of traffic entry points and liquidity hubs in the Hong Kong market. The traffic end is controlled by licensed brokers (upgraded Type 1 license) with millions of existing users. Meanwhile, licensed exchanges (Type 1+7 licenses), as liquidity providers, have gradually retreated behind the scenes, becoming underlying infrastructure similar to the HKEX, focusing on providing deep matching and asset settlement services.

Figure 1: Schematic Diagram of "Broker-Exchange" Linkage Model Business Process

IV. Industry Outlook: Compliance Logic Across Cycles

Looking ahead, with the increasing maturity of the regulatory framework and the self-iteration of the market ecosystem, the Hong Kong virtual asset market is expected to welcome critical business expansion amidst stability. We predict that as liquidity in the spot market stabilizes, regulators may prudently assess the feasibility of opening virtual asset derivatives to Professional Investors (PI) to address the pain point of institutional funds lacking effective hedging tools.

At the same time, referencing the experience of other compliant markets globally, Staking services that do not involve lending risks and the inclusion of more high-market-cap assets in the retail whitelist may also become directions for long-term exploration. Although this will not happen overnight, it represents the inevitable trend of Web3 assets gradually integrating into the mainstream financial system.

Compliance is not the end, but the starting point. Under the "New Order," user trust no longer stems from aggressive return promises, but from the platform's reverence for risk and ultimate pursuit of asset security. Bifu will continue to benchmark against the highest global regulatory standards, optimizing its risk control system and asset reserve transparency, serving not only as an observer of the industry but also as a practitioner of long-termism.

References

To ensure the accuracy and timeliness of the information, the regulatory framework details cited in this article are based on official documents from relevant regulatory bodies in Hong Kong, China. For in-depth research, it is recommended to visit the following official thematic pages:

Securities and Futures Commission of Hong Kong (2023):

https://www.sfc.hk/-/media/TC/assets/components/codes/files-current/zh-hant/guidelines/Guidelines-for-Virtual-Asset-Trading-Platform-Operators/Guidelines-for-Virtual-Asset-Trading-Platform-Operators_Chi.pdf?rev=722176b53f6a46d6b5713cedddc59483

Hong Kong Monetary Authority & Securities and Futures Commission:

https://apps.sfc.hk/edistributionWeb/gateway/TC/circular/doc?refNo=23EC52

Securities and Futures Commission of Hong Kong:

https://www.sfc.hk/TC/Regulatory-functions/Intermediaries/Licensing/Do-you-need-a-licence-or-registration

Disclaimer

This report is prepared by the Bifu Research Institute for informational purposes only and does not constitute investment advice, legal opinion, or endorsement of any specific asset. The digital asset market is highly volatile and risky; past performance is not indicative of future returns. Users should fully assess risks and consult professional advisors before investing.

Policy interpretations in this report are based on the regulatory environment at the time of publication. As local laws and regulations may update and adjust over time, please always refer to the latest documents published by official regulatory bodies for specific compliance requirements. Bifu assumes no legal liability for any decisions made based on this report.