What is "Virtual Asset (VA) Investment Internal Control"? SFC's Latest Compliance Requirements for Type 9 License VA Uplift
Licensed corporations holding a Type 9 regulated activity license (asset management) from the Securities and Futures Commission (SFC) are required to apply for a VA uplift if their managed portfolios directly invest in virtual assets (VA) exceeding 10% of their total assets, or if they establish a fund with VA as its sole investment objective. If VA allocation does not exceed 10%, only a notification to the SFC is required; an independent VA management license is not necessary. The core of the upgrade application lies in meeting the SFC's additional requirements regarding staff competence, asset custody arrangements, and anti-money laundering risk control systems.
RA1-VA, RA4-VA, and RA9-VA: A Business Comparison of Upgrading Three Types of Virtual Asset Licenses
牌照類別 License Category | 核心業務活動 Core Business Activities | 核心要求 Core Requirements | 預計時間表 Expected Timeline |
|---|---|---|---|
RA1-VA (Offers VA trading services under the integrated account arrangement) | Provide virtual asset trading services to clients under a unified account arrangement; act as an introducing agent to refer clients to a licensed VATP, or execute trades directly through a VATP unified account. | ⚠️ At least two Responsible Officers (ROs) must complete the HKSI-designated course.
⚠️ Must establish business relationships with local licensed VATP and VA trading system providers. | 4–6 months |
RA4-VA (Provides VA consulting services) | Provide advice on virtual asset investment, market trend analysis, and regulatory compliance suggestions, and assist clients in developing VA allocation strategies. | ⚠️ RO must have relevant experience in the VA industry.
⚠️ Must establish a comprehensive compliance consultation process and an appropriate client risk disclosure mechanism. | 4–6 months |
RA9-VA (Managing portfolios where VA accounts for more than 10%) | Manage portfolios with more than 10% of their assets allocated to VA or pure VA funds, encompassing discretionary asset management and fund portfolio management. | ⚠️ At least two ROs must complete the HKSI-designated course.
⚠️ ROs must have at least 3 years of relevant VA asset management experience (excluding VA ETFs and VA futures).
⚠️ A qualified VA custodian must be appointed and meet strict custody and risk control requirements. | 4–6 months |
RA9-VA Business Change Notification (VA allocation does not exceed 10%) | If the VA allocation in the managed portfolio does not exceed 10% of the total assets, only a business change notification to the SFC is required; a full upgrade is not necessary. | ⚠️ At least two ROs must complete the HKSI-designated course.
⚠️ No separate VA license is required. | 1-2 months |
Additional Explanation: The SFC adopts the regulatory principle of "same business, same risk, same rules" for RA1-VA, RA4-VA and RA9-VA. The relevant licensing conditions are consistent with the requirements of traditional regulated activities in categories 1, 4 and 9, but targeted adjustments have been made to address the unique risks of VA (such as high volatility, cybersecurity, and custody risks).
Why Apply for a Type 9 VA Uplift? (10% Threshold and Mandatory Requirements)
According to current SFC regulations, asset management companies holding a Type 9 license must apply for a VA license uplift if they meet any of the following conditions:
-
Manage funds that primarily invest in VA (as specified in the fund documents).
-
The VA allocation in the portfolio reaches or exceeds 10% of the total asset under management (AUM).
-
VA allocation exceeds 10% in discretionary accounts.
If the VA allocation does not exceed 10%, only a business change notification to the SFC is required, a full VA management license is not necessary. However, in its consultation conclusions released in December 2025, the SFC proposed abolishing the 10% exemption threshold, meaning that any asset management activity involving VA investment (regardless of the percentage) would then require an independent VA management license. This consultation concluded in January 2026, and the draft legislation is expected to be submitted to the Legislative Council for consideration in 2026.
Core Requirements for VA License Uplift: Custodian and Internal Control
Regardless of whether you apply for RA1-VA, RA4-VA, or RA9-VA, the SFC will impose a series of additional compliance requirements on the applicant in the form of licensing conditions.
(I) Custodian Requirements
牌照類別 Liense Category | 托管人要求 Custodian Requirements |
|---|---|
RA1-VA | The entity must establish and maintain an integrated account (designated as a trust or client account) with a VATP licensed by the SFC and execute client transactions through that account. |
RA4-VA | There is no mandatory custody requirement, but an appropriate risk assessment and disclosure mechanism must be established for clients' VA investment advice. |
RA9-VA | Regardless of whether the VA allocation exceeds 10%, client VAs must be held by a licensed VA custodian in Hong Kong. If fund assets are held in a consolidated client account, it must be ensured that the assets of each fund are properly segregated and recorded, and that frequent and appropriate reconciliation is conducted. |
(II) Risk Management and Internal Control System
The SFC requires applicant institutions to establish sound policies and procedures in the following areas:
要求類別 Requirement Category | 具體內容 Specific Content |
|---|---|
Continuous Monitoring | Clients' VA positions and trading activities must be continuously monitored to promptly identify abnormal or suspicious transactions and generate Suspicious Transaction Reports (STRs). |
Customer Due Diligence (CDD) | Before providing VA trading or asset management services, an assessment of the client's knowledge and risk tolerance must be conducted, especially for retail clients where a reasonable VA position limit must be set. |
Independent Audit | It is recommended that firms regularly engage a third-party professional organization to conduct independent audits to review the effectiveness of VA-related internal control systems. |
Market Manipulation Prevention | Internal policies must be established to prevent market manipulation and illegal activities, and to monitor client trading behavior. |
Pre-funding Requirements | Before executing a transaction, it must be ensured that the client's account has sufficient fiat currency or VA to cover the transaction. No financial accommodation (financing or overdraft) may be provided. |
Record Keeping | All VA transactions and CDD records must be properly kept for at least 7 years. |
(III) Additional Competency Requirements for Responsible Officers (ROs)
要求 Requirement | RA1-VA | RA4-VA | RA9-VA |
|---|---|---|---|
HKSI Designated Courses | ✅ Must be completed | ✅ Must be completed | ✅ Must be completed |
VA-related Industry Experience | - | ✅ Recommended | ✅ At least 3 years (excluding VA ETF and VA futures) |
Detailed Resume Requirement: ROs for RA9-VA must provide a detailed resume demonstrating past practical experience in virtual asset management, including assets under management, investment strategies, and risk control measures.
Frequently Asked Questions (Q&A)
Q1: How can I determine if my Type 9 licensed corporation needs to apply for a VA license uplift?
A: Review your portfolio or fund documents. If a fund specifies VA as its primary investment objective, or if the actual VA allocation represents 10% or more of the total AUM, an RA9-VA license uplift is required. If the VA allocation does not exceed 10%, only a business change notification to the SFC is required.
Q2: Why are the fees for RA9-VA and RA1-VA similar, but the application process for RA1-VA is more complicated?
A: The advisory service fees for both are similar (HKD 160,000 – 180,000). However, the RA1-VA application involves additional technical and business cooperation arrangements: applicants must establish business relationships with local licensed VATPs and VA trading system providers (BSS), and ensure that the system can support trade execution, client asset segregation, and real-time reconciliation under integrated accounts. These technical requirements make the preparation of an RA1-VA application more complex than that for RA9-VA.
Q3: What are the specific SFC requirements regarding RO experience for RA9-VA?
A: At least two ROs must have completed the HKSI-designated courses and possess at least 3 years of relevant VA asset management experience. This experience does not include managing VA ETFs or VA futures, but refers to practical experience in directly managing VA spot investment portfolios. Detailed RO resumes and relevant supporting documents must be submitted with the application.
Q4: When applying for RA1-VA, how should I choose a suitable VATP partner?
A: Applicants must establish a business relationship with an SFC-licensed virtual asset trading platform. When selecting a platform, consider its compliance record, client asset segregation arrangements, insurance coverage, technological stability, and customer service quality. Some platforms also offer white-label solutions to accelerate the business launch of RA1-VA.
Q5: If my VA allocation is below 10%, do I need to apply for an RA9-VA upgrade?
A: Currently, you only need to submit a business change notification to the SFC. However, please note that the SFC has proposed abolishing the 10% exemption threshold, meaning that any VA allocation (regardless of percentage) will require an independent VA management license in the future. Institutions intending to expand their VA business are advised to upgrade to RA9-VA as soon as possible.
Q6: What are the main differences between RA4-VA and RA9-VA?
A: RA4-VA focuses on providing advice, market analysis, and compliance consultation on VA investments, and does not involve asset management rights. RA9-VA, on the other hand, involves the actual management of client assets and investment decisions, including discretionary accounts and fund portfolio management. The two differ significantly in regulatory requirements; RA9-VA has much higher requirements for RO experience, custody arrangements, and risk control measures than RA4-VA.
ComplianceOne can provide you with VA License Uplift Services
-
Responsible Officer (RO) Recruitment & Qualification Assessment: Assisting clients in identifying suitable RA1-VA / RA4-VA / RA9-VA ROs who meet SFC competency requirements, ensuring their experience and resumes align with regulatory expectations.
-
Business Plan & Internal Policy Drafting: Assisting clients in preparing business plans, AML policies, internal control manuals, and risk management frameworks that comply with virtual asset regulatory requirements.
-
External Technical Assessment Coordination: Arranging and following up on the Phase 1 and Phase 2 external system assessment reports required for RA1-VA applications.
-
VATP & BSS Partner Referrals: Connecting clients with SFC-licensed virtual asset trading platforms and trading system providers based on their business model.
-
SFC Application Submission & Ongoing Communication: Submitting the VA license uplift application on behalf of clients and handling all regulatory queries throughout the approval process.
-
One-stop Company Secretarial & Bank Account Opening Support: Assisting with Hong Kong company incorporation, company secretarial services, and corporate bank account opening.