Hong Kong VASP transaction monitoring is moving from a niche concern to a mainstream compliance task. The city already licenses virtual asset trading platforms, and the Financial Services and the Treasury Bureau (FSTB) and the Securities and Futures Commission (SFC) are finalising separate licensing regimes for virtual asset dealing, custody, advisory and management. A bill to amend the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) is targeted for the Legislative Council in 2026.
Much commentary blurs what is law and what is proposal. This article separates the two, sets out the timeline, and explains what the direction of travel means for monitoring programmes at virtual asset businesses and the banks that serve them.
What is in force and what is proposed
The licensing regime for virtual asset trading platforms has operated since June 2023 under the AMLO. The other regimes remain proposals. On 27 June 2025 the FSTB and SFC issued consultation papers on virtual asset dealing and custodian services. On 24 December 2025 they published consultation conclusions on both and launched a further one-month consultation, ending 23 January 2026, on advisory and management services. On 26 May 2026 they published conclusions on that second consultation, saying they were finalising the legislative proposals for all four regimes. Separately, the Stablecoins Ordinance, which regulates fiat-referenced stablecoin issuers, took effect on 1 August 2025.
As of late September 2026 the bill had been neither published nor introduced. The Policy Address Supplement of 16 September 2026 said drafting was under way with introduction expected in the fourth quarter, and on 5 October 2026 the Secretary for Financial Services and the Treasury told the Legislative Council that the bill would be introduced within the year. Until it is enacted, none of the new regimes has legal effect.
How the proposed regimes are structured
The advisory and management regimes are modelled on the existing framework for securities advice and discretionary asset management, aligning virtual asset advice with the Type 4 regulated activity and virtual asset management with the Type 9 asset management activity under the Securities and Futures Ordinance. Authorities describe the approach as same business, same risks, same rules. The conclusions also confirm an extraterritorial dimension, so that persons inside or outside Hong Kong would be barred from actively marketing these services to the Hong Kong public without a licence.
Together with dealing and custody, the regimes are intended to form a comprehensive virtual asset service provider framework under the SFC's ASPIRe roadmap. Regulators have said the aim is to broaden participation in the digital asset market while supporting a robust and secure ecosystem.
What this means for transaction monitoring
Because the new regimes are being built into the AMLO, as the existing platform regime is, licensed firms should expect to carry the Ordinance's customer due diligence and ongoing monitoring obligations and to report suspicious transactions through the Joint Financial Intelligence Unit. That is an expectation based on the existing regime, not a statement about the final text of the bill.
Monitoring design for virtual assets is different from that for fiat flows. A firm needs to handle on-chain transfers, wallet exposure, rapid movement between assets and venues, and customers who may transact across several platforms. Firms preparing now should plan for customer risk rating that reflects product and channel, escalation of unusual transfers to a documented investigation process, and records that show why activity was allowed, held or reported.
Banks and the wider ecosystem
Banks that serve virtual asset businesses will feel the effect as customers move from unlicensed to licensed status. Onboarding teams will need to verify licence category and status, understand whether a customer is dealing, custodying, advising or managing, and monitor accounts according to that activity. The HKMA has separately run workshops on money laundering and terrorist financing risk management for crypto-asset services, which indicates supervisory interest in this segment.
Everyone involved should watch the bill's text when it appears. Until then, the sensible position is to build monitoring that is risk-based and well documented, and to avoid hard-coding assumptions about thresholds or categories that the legislation might change. Until the bill is enacted, Hong Kong VASP transaction monitoring should be built to be risk-based and easy to adjust.
