SFC VATP Licensing and External Assessment Requirements
New VATP applicants undergo one external assessment after their systems and controls are deployed. The assessment is part of the SFC licensing process. This guide explains the appointed assessor’s role and how to prepare the technical evidence.
Who Needs a VATP Licence?
The SFC’s VATP licensing page covers centralised platforms operating in Hong Kong or actively marketing to Hong Kong investors. Security-token platforms fall within the Securities and Futures Ordinance (SFO) regime; non-security-token platforms fall within the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) regime.
The SFC recommends applying under both regimes because token classification can change. Applications can be consolidated through WINGS. Establish the proposed business model and licence scope with your advisers before commissioning an assessment.
This article covers a trading platform’s licensing assessment. Standalone custody licensing and the HKMA’s stablecoin issuer framework are separate subjects.
The Current Licensing Assessment Process
The 16 January 2025 circular (25EC2) applies to applications submitted after 18 December 2024 and replaces the June 2023 assessment scope. It removes the former first-phase and second-phase assessments.
- Apply: submit the application, written policies and procedures, and evidence identifying a suitable external assessor, including its capability statement.
- Deploy: after application acceptance, implement the systems, providers and controls, and adapt the procedures to how they operate.
- Agree the engagement: the applicant, SFC and external assessor enter a tripartite agreement before assessment.
- Assess and remediate: the assessor examines design and implementation; the applicant provides access to relevant people and information and addresses findings.
- Licensing decision: the SFC considers the assessment and remaining matters before deciding whether to grant a licence.
The circular requires a direct assurance engagement, signed by a certified public accountant (practising), under HKSAE 3000 or an equivalent standard. Its coverage includes the VATP Guidelines and applicable AML/CFT guideline. Material subsequent changes to the policies, procedures, systems or controls must be notified to the SFC and assessor as soon as practicable.
Who Can Be the External Assessor?
The SFC’s assessor eligibility FAQ calls for an independent professional accounting firm regulated by Hong Kong’s Accounting and Financial Reporting Council. The firm needs relevant assurance, intermediary and virtual asset expertise, and the ability to advise on remediation.
Independence extends to the applicant’s group. The assessor must not supply the systems being assessed. Appointment documentation includes the capability statement, the request for proposal and an indication that the assessor is willing to undertake the work. Overseas affiliate personnel should be covered in the capability information where used.
Guardian’s technical testing supports that engagement. Penetration tests, wallet reviews and remediation reports do not replace the accounting firm’s assurance opinion. Agree with the appointed assessor how technical reports will be used, who can rely on them and whether any work needs to be repeated or extended.
What Technical Evidence Should You Prepare?
The SFC circular directs applicants to its Fintech unit for the engagement’s terms and assessment scope. The following is Guardian’s recommended preparation checklist, not a substitute for the scope agreed by the three parties.
| Area | Evidence to assemble | Useful technical test |
|---|---|---|
| Trading applications and APIs | Data flows, account roles, authentication configuration and order lifecycle records. | Try cross-account access, session theft and unauthorised trading actions in the agreed environment. |
| Custody and withdrawals | Wallet architecture, signing policy, approver roles, key ceremony and recovery records. | Trace a withdrawal through screening, approval, signing and broadcast; test whether an approval can be bypassed. |
| Cloud and infrastructure | Asset inventory, identity roles, network boundaries, secrets inventory and logging configuration. | Test exposed services and whether an initial foothold can reach administration or signing systems. |
| Code and releases | Repository permissions, review records, build provenance, deployment approvals and rollback procedures. | Check who can change production code or configuration and verify a deployed version against its approved build. |
| External services | Provider responsibilities, integration settings, due diligence, contracts and failure procedures. | Exercise provider failure and check whether the platform detects stale or unavailable dependencies. |
| Response and recovery | Runbooks, alert ownership, escalation contacts, backup records and exercise results. | Rehearse a compromised account or signer and verify containment and recovery decisions. |
For each item, retain the environment, configuration version, date, test limitations and responsible owner. Screenshots alone rarely explain whether a control operated throughout a transaction or whether a tester examined the same version the business intends to launch.
Testing financial crime controls is also broader than a cybersecurity engagement. Work with the assessor and the relevant specialists on KYC, screening, surveillance and AML/CFT evidence. Do not treat an application pentest as coverage of those obligations.
How to Prepare Before the Assessor Starts
We recommend a readiness review before the formal assessment. Its purpose is to find missing or inconsistent evidence while the team still has time to correct it.
- Reconcile the system description: make the architecture, vendor list and written procedures describe the same deployed operation.
- Walk a real workflow: follow onboarding, trading, withdrawal and incident escalation with the people who operate each step.
- Test the important boundaries: customer-to-customer access, support-to-administrator access and application-to-signer access deserve explicit coverage.
- Close and retest findings: keep the original issue, affected version, change and verification result together.
- Maintain an evidence index: give every requested item an owner, location, version and status so the assessor can identify gaps quickly.
A change late in the project can invalidate an earlier result. For example, switching wallet vendors after testing may change signing permissions, approval paths and recovery assumptions. Assess the impact and agree what needs retesting with the appointed assessor.
What Changes After Licensing?
The licensing external assessment and ongoing technology reviews have different purposes and timing. Maintain separate schedules and scopes; the one-assessment licensing process does not remove later obligations.
Our SFC custody and technology guide covers wallet controls and recurring assessment evidence. Use it alongside this licensing guide when planning custody work.
Two later circulars also matter to the technical plan. The June 2026 AI cybersecurity circular addresses current asset inventories, faster remediation and management responsibility. The July 2026 authentication circular addresses phishing-resistant client login and device binding, suspicious activity monitoring and response. Reuse evidence where it fits, and document what each test actually covers.
See our key management guide and withdrawal security checklist for deeper technical preparation.
Where Guardian Fits
Guardian can test the trading application, APIs and infrastructure; review wallet and signing controls; examine release permissions; and verify remediation. The output is a technical report with the scope, methods, findings, affected systems and retest results.
The appointed external assessor decides how that evidence contributes to its assurance work and signs its opinion. The SFC makes the licensing decision. A technical report should be scoped and described accordingly.
Our SFC compliance assessment service can help plan the technical work with your team and appointed assessor. Share the proposed architecture, assessment terms, launch timetable and existing reports so the work addresses the actual evidence gaps.
Primary Sources
- SFC: VATP licensing scope and application documents.
- SFC: enhanced licensing and revamped external assessments, 25EC2, 16 January 2025.
- SFC: external assessor eligibility and appointment FAQ, questions 4–5.
- SFC: enhanced cybersecurity measures, 26EC32, 2 June 2026.
- SFC: robust authentication and monitoring, 26EC35, 9 July 2026.
Sources checked 7 November 2026. The evidence checklist is Guardian’s technical recommendation; the formal assessment scope is agreed with the SFC and appointed external assessor.
Plan your compliance assessment
Review the requirements, test your controls and verify the fixes with Guardian.