Hong Kong license plate VA No. 4 and 9
Business Upgrade Guide
Authoritative application guide based on SFC official guidelines and Aiying's practical experience
Hong Kong license plate VA No. 4 and 9
ASPI-Re Supervision Blueprint
Access
Market Access
Safeguards
Safeguards
Policy
Policy development
Innovation
Innovation support
Regulation
Supervision and Execution
Core legal basis
Securities and Futures Ordinance (SFO)
Hong Kong's securities regulatory framework provides the legal basis for VA business upgrades. This process is formally known as applying to the SFC to vary or expand the business scope of an existing license.
Anti-Money Laundering and Counter-Terrorist Financing Ordinance
Standardize the anti-money laundering and counter-terrorist financing requirements for VA business, including special requirements such as the Travel Rule and on-chain transaction monitoring.
VAFM T&Cs
"Terms and Conditions Applicable to Licensed Corporations or Registered Institutions Managing Portfolios Investing in Virtual Assets", the core operating principles of the upgraded license.
Responsibilities of the supervisory agency
Securities and Futures Commission (SFC)
• VA business upgrade review for license plates 4 and 9
• Issuance and supervision of VATP licenses
• VA fund recognition and oversight
• Investor protection and market integrity maintenance
Hong Kong Monetary Authority (HKMA)
• VA Business Guidelines for the Banking Industry
• Custody Services Regulation
• Payment system supervision
• Jointly issued supervisory circular with SFC
Core Supervision Principles
“Same business, same risks, same rules”
Ensure that VA business and traditional financial business are subject to the same regulatory standards at the same risk level
investor protection
Ensure that investors' rights and interests are fully protected
Market integrity
Maintain a fair and transparent market environment
Risk prevention
Preventing systemic financial risks
Innovation promotion
Supporting the innovative development of financial technology
Comparison of license system architectures
| License plate type | Business scope | Regulatory focus | Capital requirements | Upgrade trigger point |
|---|---|---|---|---|
| No. 4 license + VA securities consulting upgrade | Securities consulting (including VA-related securities) | Quality of investment advice and client suitability | HK$100,000+ | STO, VA ETF investment advisory services |
| No. 9 License Plate + VA Asset Management Upgrade | Asset management (including VA investment) | Portfolio management, custody arrangements | HK$3,000,000+ | 10% GAV threshold and clear investment goals |
| VATP trading platform license | VA trading platform operation | Platform security and market supervision | HK$5,000,000+ | Independent application (dual license) |
Core Concept Analysis
What is the "VA Business Upgrade" for No. 4/No. 9 license plates?
Defining "upgrade": changing business scope, not applying for a new license
official name
Apply to the SFC to change or expand the business scope of the existing license
legal basis
Securities and Futures Ordinance (SFO)
Regulatory documents
Joint Circular and Guidance Issued by the SFC and HKMA
Result
Specific terms and conditions attached to the licence, such as VAFM T&Cs
Important reminder:After a licensed institution successfully upgrades, specific terms and conditions (T&Cs) will be added to its license, such as the VAFM T&Cs. These terms and conditions define the legal boundaries and operational guidelines for conducting VA business. Therefore, the entire process is a prudent expansion of the existing regulatory framework, rather than a complete overhaul.
Card No. 9 upgrade trigger conditions
Clear investment target trigger
The fund prospectus or investment authorization (Investment Mandate) clearly states that investing in virtual assets is one of its main investment objectives.
10% GAV threshold triggered
The fund or portfolio plans to invest 10% or more of its gross asset value (Gross Asset Value) in virtual assets.
Important exemptions
If the VA holdings exceed 10% passively due solely to market fluctuations and the manager is taking reasonable steps to reduce them below the threshold as soon as possible, an exemption may be granted. However, if this situation is expected to continue, it must still be reported to the SFC.
Card No. 4 upgrade trigger conditions
Security Token Offerings (STOs)
Providing advice to clients on buying, selling, or holding security tokens representing equity, debt, or other economic interests.
Virtual Asset ETFs
Providing investment advice on virtual asset spot ETFs approved in Hong Kong, such as Bitcoin and Ethereum ETFs.
Other security tokens
Provide advice on certain platform coins or governance tokens that may be identified by the SFC as having characteristics of a “collective investment scheme (CIS)”.
Compliance risk reminder
A key compliance risk is misclassification. If a licensed person mistakenly provides advice to a VA that should be considered a "securities VA" as a non-securities VA, they will face serious compliance risks.
Upgrade Prerequisites
A comprehensive self-assessment checklist before starting your application
Why do you need a comprehensive self-assessment?
Before formally submitting an application to the SFC, a significant investment of time and money, it's crucial to conduct a thorough and prudent internal gap analysis. This not only significantly increases the chances of a successful application but also helps institutions identify potential operational risks. The SFC explicitly states that the onus is on applicants to demonstrate they are "fit and proper."
Company qualifications and capital requirements
Check the status of existing license plates
• Confirm that the company currently holds a valid SFC Type 4 or/and Type 9 license
• No significant, unresolved violations in the past
• Any pending regulatory review could pose a hurdle to upgrading the application
Company structure requirements
• The applicant must be a limited company registered in Hong Kong
• The company must have a fixed, real physical office address in Hong Kong
• The SFC will focus on the company’s “substantive business” in Hong Kong
Capital requirements (key points)
- No. 9 card upgrade
If you plan to hold client virtual assets, you must maintain liquid capital of no less than HK$300 million at all times. - No. 4 card upgrade
It is recommended to prepare more sufficient capital (e.g. more than HK$50)
Core personnel requirements: RO and MIC "VA competency"
Responsible Officer (RO) Requirements
Quantity and location requirements
- Appoint at least two ROs for each regulated activity
- At least one RO must be the company's executive director
- At least one RO must be permanently stationed in Hong Kong
VA-related experience (key to application success)
No. 9 card upgrade
At least one RO has no less than three years of directly related VA management experience
No. 4 card upgrade
RO needs to demonstrate a deep understanding of VA products and relevant investment analysis experience
SFC's pragmatic approach
Important strategic windows
Recognizing the talent shortage in the market, SFC has articulated a “pragmatic approach” in its official FAQ.
RO with only VA experience
Their experience may be considered relevant to traditional securities business, but conditions may be imposed on their licenses.
RO with only traditional financial experience
May be subject to a "non-sole" requirement and must work under the supervision of an experienced RO
Examination and training requirements
- Pass the relevant HKSI qualification examination (LE Papers)
- Basic Paper 1, No. 4 card requires Paper 6, No. 9 card requires Paper 9
- Completion of VA professional training such as CVAP is strongly recommended
Ultimate Application Guide
Disassembly of the entire process from preparation to approval
Preparation and document writing
2-4 months
• Establishment of a special task force
• Gap analysis
• Writing application documents
• Search for external auditors
Submit application
1-2 weeks
• WINGS system submission
• Pay application fee of HK$4,740
• Obtain a case number
• Assign case director
SFC Audit Interaction
3-6 months
• Respond to inquiries (1-3 rounds)
• Interview/site review
• Supplementary information
• Ongoing communication
Approval and follow-up
1-2 months
• Approval in Principle (AIP)
• Meet licensing requirements
• Officially licensed
• Fulfilling ongoing responsibilities
Core Application Document List
| File category | file name | Core content points | Aiying Suggestions |
|---|---|---|---|
| Application Form | Business Scope Change Application Form | Accurately fill in the company's basic information, existing license details, and the VA business scope to be added | Must be signed by a person authorized by the board resolution |
| Personnel | RO/MIC Update Questionnaire and Resume | A detailed description of the VA-related experience, management responsibilities, and professional training of each RO and key MIC | Attach copies of HKSI test transcripts, CVAP and other training certificates |
| Business and Compliance | VA Business Plan | Business model, target customers, investment strategy, fee structure, risk management framework | Must be clear, pragmatic, and demonstrate a deep understanding of the business and risks |
| Technology and Security | Cybersecurity Policy and Assessment Report | Private key management system, multi-signature mechanism, access control strategy, disaster recovery plan | It is strongly recommended to attach a penetration test report issued by an independent third party |
| Finance | Capital adequacy ratio calculation table | Demonstrate compliance with liquid capital requirements based on the calculation methods of the FRR and VATP guidelines | Must be signed and confirmed by RO and financial director |
Cost structure analysis
SFC license change application fee
HK$4,740
Legal and compliance advisory fees
HK$150,000-400,000+
External audit/assessment fees
HK$100,000-300,000+
Total estimate
HK$250,000-700,000+
note:The actual cost will vary significantly depending on factors such as the complexity of the project, the applicant's own preparation, the qualifications and charging standards of the consultant hired.
Timeline Estimation
Internal preparation and document writing
2-4 months
SFC audit and inquiry
3-6 months
Meeting AIP conditions and final licensing
1-2 months
Comprehensive timeline
6-12 months
remind:The 15-week processing time officially promised by the SFC only counts the SFC's internal processing time and does not include the applicant's time to respond to inquiries.
FAQ and practical strategies
Provide strategic and actionable solutions to the most core pain points
Q1: What does SFC focus on most in a business plan?
In my experience, the SFC is most concerned with how a company manages risk, not its profit forecasts. The core of your business plan is to demonstrate to regulators your ability to implement a risk management and compliance framework for your VA business.
Key reminder:A business plan needs to be like a rigorous "operation manual" rather than a "financing roadshow PPT".
SFC's core areas of focus:
- Due diligence and valuation
How do I conduct due diligence on a proposed virtual asset investment? What is the valuation model?
- Counterparty Risk Management
How do you select and continuously monitor your custodians, trading platforms, and OTC desks?
- Technical and security measures
How can we prevent cyber attacks and insider fraud through specific technologies and processes?
- AML/CFT practical process
How to specifically deal with the anonymity and cross-border characteristics of on-chain transactions?
Key questions that must be answered:
- How to conduct due diligence on the VA?
Especially for non-mainstream tokens, what is the data source and how to deal with the lack of fair market prices?
- What is a valuation model?
How to ensure the accuracy and consistency of valuations?
- How to choose a custodian and trading platform?
What are the selection criteria and what is the contingency plan if there is a problem with the counterparty?
- Internet security protection measures?
How is the multi-signature mechanism for private key management specifically designed? Who has authority? How is it audited?
Q2: What are the asset custody options? What is the SFC's preference?
Asset custody is a top priority for the SFC, especially after the collapse of several exchanges around the world. The SFC has very clear preferences in this regard:
Preferred: Independent, regulated third-party custodian
The ideal custodian should be an affiliated custodial entity of an SFC-licensed VATP, or a trust company regulated in a reputable jurisdiction (such as the United States) that specializes in digital asset custody. This maximizes asset segregation and professional management, and offers the highest regulatory approval, but also carries higher costs.
Secondary option: Technically mature non-independent hosting solution
Some technology companies offer custody solutions based on technologies like MPC (Multi-Party Computation). While these aren't independent legal entities, they technically enable sharded private key management. The SFC maintains an open but cautious approach to these solutions, rigorously reviewing their technical security, audit reports, and insurance coverage. While these solutions offer relatively low costs, they require more rigorous scrutiny.
Not recommended: Complete self-custody
Unless the applicant can demonstrate technical security capabilities, internal control systems, and corporate governance comparable to those of top-tier financial institutions, and pass the most rigorous independent third-party audits (such as SOC 2 Type II), it will be extremely difficult for the SFC to approve this proposal. For most asset management companies, this path is extremely difficult and costly, requiring technical security capabilities at the level of top-tier financial institutions.
Hard requirements:Regardless of which option is chosen, the two rigid requirements of 98% of assets being stored in cold wallets and having adequate insurance must be met.
Q3: After upgrading to VA Type 9, can I manage funds that invest in NFTs or participate in DeFi protocols?
This depends on the nature of the fund and the type of investors. The SFC adopts a tiered and prudent approach to this:
Retail Funds (SFC Authorised Funds)
Currently, the SFC only allows funds open to retail investors to invest in highly liquid, large-cap tokens, primarily those included in at least two recognized independent indices. Currently, this is effectively limited to Bitcoin (BTC) and Ethereum (ETH).
in conclusion:It is almost impossible for retail funds to invest in NFTs or directly participate in complex DeFi protocols to be approved at this stage.
Funds for professional investors only
The SFC provides greater flexibility for funds open only to professional investors (PIs). In theory, they can invest in NFTs or participate in DeFi strategies, but this requires case-by-case consultation with the SFC.
Conditions that must be proven:
• The team has deep expertise and management experience in these specific areas
• A very robust risk management framework has been established specifically to address these new risks
Aiying recommends:In the early stages of the application process, a wise strategy is to start with mainstream, highly liquid tokens. Once the license is approved and a good regulatory record is established, gradually communicate with the SFC to expand to more complex asset classes.
Q4: How to respond to the SFC’s review of RO’s “actual participation in management”?
The SFC has a zero-tolerance policy towards "nominal ROs." Proving the RO's substantive involvement is key to ongoing compliance and a key focus of license reviews.
Core red line:The RO must be an “insider” of the VA business, not just a name on compliance documents. This is one of the core red lines of SFC supervision.
Response strategies:
Create a record of decisions
Evidence of the RO's involvement in key VA business decisions must be retained. Examples include: investment committee meeting minutes (with the RO's signature), email records approving new VA investments or new custodians, and attendance records at venture capital meetings.
Ensure RO is informed
ROs must be able to clearly and accurately explain to the SFC the company's VA business strategy, risk management details, compliance procedures, and the latest market trends. If an RO is completely clueless about the business during an SFC interview or on-site inspection, it will be considered a serious red flag.
Specific implementation measures:
Clear division of responsibilities
In the company's organizational chart and job description, clearly define the RO's specific supervisory and management responsibilities in VA business and ensure that he or she has the corresponding authority.
Regular internal reporting
Establish a formal internal reporting mechanism to ensure that business and operations teams regularly report to the RO on the status of VA business, risk events and compliance status.
About Aiying
Aiying (License.aiying.cc) specializes in global traditional finance and Web3-related license application and acquisition consulting services. With teams primarily located in Hong Kong, the UAE, and Europe, and strong relationships with local regulators, Aiying has successfully secured applications and smooth operations for leading and mid-tier crypto and traditional institutions. Team members are qualified in Hong Kong, Europe (Ireland), the UK, the UAE, and other jurisdictions, with a global network ensuring XNUMX/XNUMX professional support. Headquartered in Asia, the team brings together experts in operations, marketing, law, regulatory compliance, and accounting, adhering to clients' business objectives to provide comprehensive and in-depth strategies and solutions.
Authoritative guidance
Based on SFC official guidelines and Aiying's practical experience, we provide the most authoritative application guidance.
Useful Checklist
Detailed self-checklist and document preparation guide to ensure the completeness and accuracy of application materials
success case
100+ successful case experience summary, avoid common pitfalls and improve success rate
global vision
Integrate international best practices to ensure the forward-looking and adaptable compliance system
Aiying's "pre-screening mechanism"
To maximize your success rate, Aiying conducts an internal mock review of your application materials before formal submission. Our expert team acts as a regulator, scrutinizing each document from the most rigorous perspective to identify logical loopholes, data inconsistencies, and compliance gaps in advance.
Through this mechanism, we can ensure that the materials submitted to the regulatory authorities are highly professional, complete and impeccable, thereby minimizing the number of regulatory inquiries and significantly shortening the approval time.And reduced the license rejection rate by 67%.
Professional Articles
In-depth analysis of the key points and latest developments in VA1 license application
List of companies that have obtained VA No. 4 and 9 licenses
The following is a list of financial institutions that have obtained virtual asset business licenses, as publicly disclosed by the Securities and Futures Commission (SFC) of Hong Kong, showing the actual development status of the Hong Kong VA market.
List of licensed institutions with license No. 9+VA
| Institution type | Organization name | status |
|---|---|---|
| asset management company | HashKey Capital Limited | Licensed |
| asset management company | BC Technology Group | Licensed |
| asset management company | Venture Smart Asia Limited | Licensed |
| asset management company | Amber Group (HK) Limited | Licensed |
| Traditional financial institutions | Bosera Asset Management | Licensed |
| Traditional financial institutions | China Asset Management | Licensed |
| Traditional financial institutions | Harvest Global Investments | Licensed |
| Traditional financial institutions | Other applicant institutions | Under review |
List of licensed institutions with license No. 4+VA
| Institution type | Organization name | status |
|---|---|---|
| asset management company | HashKey Capital Limited | Licensed |
| asset management company | BC Technology Group | Licensed |
| asset management company | Venture Smart Asia Limited | Licensed |
| asset management company | Amber Group (HK) Limited | Licensed |
| Traditional financial institutions | Bosera Asset Management | Licensed |
| Traditional financial institutions | China Asset Management | Licensed |
| Traditional financial institutions | Harvest Global Investments | Licensed |
| Traditional financial institutions | Other applicant institutions | Under review |
Market statistics
15+
No. 9 license plate + VA agency
25+
No. 4 license plate + VA agency
50+
Applicant Institutions
HK$100B+
Assets under management
rapid growth
The number of licensed institutions has grown rapidly in the past two years, indicating the market's activeness.
Diversified development
Covering various types such as traditional financial institutions, financial technology companies, etc.
Regulatory maturity
The supervision framework is becoming increasingly perfect, providing guarantees for more institutions to enter