Licensed crypto exchanges in Hong Kong: the full SFC list, checked line by line

A licensed crypto exchange in Hong Kong is one that appears on the Securities and Futures Commission's list of licensed virtual asset trading platforms (VATPs). As of the list's last update on 29 May 2026 there are exactly 13, from OSL (licensed 15 Dec 2020) to Bixin.com (18 May 2026). Nothing new had been added by the time we checked again on 30 September 2026.

This page is a registry, not a ranking. We mirror the official SFC list, add the CE number you need to check each firm yourself, and flag which platforms an ordinary retail customer can actually open an account with. That last column matters more than most listicles admit: several licensees serve only professional or institutional clients, so being on the list does not mean you can download an app and buy Bitcoin tonight. If what you really want to know is how the rules fit together, read our wider guide to Hong Kong crypto regulation alongside this list.

The SFC list of licensed crypto exchanges in Hong Kong

Every platform below holds a licence under Part 5B of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615), which has required anyone running a crypto exchange in Hong Kong, or actively marketing one to Hong Kong investors, to be licensed since 1 June 2023. Platforms that also handle security tokens carry SFO Type 1 and Type 7 licences on top. The table uses the operator's legal name exactly as the SFC prints it, because that is the name you will search for on the register, not the marketing brand.

Two things jump out. First, the list grew slowly for years and then in bursts: four platforms were licensed on a single day, 18 December 2024, under what the SFC called its swift licensing process for applicants that were already deemed licensed. Second, the newest names are not the ones you see on tram adverts. VDX, licensed on 13 February 2026, was the first new licence since June 2025, and Bixin.com's operator NewBX became the 13th licensee on 18 May 2026 after almost two years as a deemed applicant. A few naming traps are worth spelling out: HKbitEX is run by Hong Kong Digital Asset EX Limited, which some articles shorten to "HKDAEX" as if it were a separate exchange; VDX belongs to Victory Fintech, not DFX Labs; and EX.IO is a licensee in its own right, not to be confused with similarly named international exchanges.

Which licensed platforms retail investors can actually use

A licence lets a platform serve retail clients, but it does not force it to. Some licensees have chosen to build businesses around tokenisation, institutional custody or wholesale liquidity instead. The second table sorts the 13 by who they serve today, based on the platforms' own announcements and reputable press. Where we could not confirm retail access on a primary source, we say so rather than guess.

For a typical Hong Kong resident with an HKID and an FPS-enabled bank account, the realistic direct options are OSL and HashKey Exchange, plus the two broker-owned venues, PantherTrade and YAX, which you reach through the Futubull and Tiger Brokers apps rather than a separate account. OSL advertises 0% trading fees on its Flash Trade product, with the cost built into the spread, and accepts FPS, eDDA, bank transfer, Visa/Mastercard and Apple Pay. HashKey merged its exchange and global apps on 27 July 2026; the new app routes you to a Hong Kong hub based on your KYC, and that hub supports about 40 assets and four fiat currencies, though retail clients see fewer. Our detailed HashKey Exchange review and OSL review go through deposits, minimums and the parts of each app that still feel clunky.

Bullish is the clearest example of a licensed platform that is closed to you: its filings limit Hong Kong services to qualified investors. VDX describes itself as serving licensed institutions. HKVAX, the first platform licensed under the 2023 AMLO regime, concentrates on professional investors, security-token offerings and custody. None of that makes them less legitimate, it just means they are not where a first-time buyer should start.

Deemed-to-be-licensed applicants are not licensed

The SFC page has a second list that confuses a lot of people: applicants. Platforms that were already operating in Hong Kong before 1 June 2023 and applied by 29 February 2024 were allowed to keep serving existing business while the SFC decided, and are marked "deemed-to-be-licensed". The SFC's own wording is blunt: deemed-to-be-licensed VATP applicants are NOT formally licensed by the SFC. On the 29 May 2026 list there are three of them.

• Foris DAX HK Limited (Crypto.com), applied 9 Feb 2024.
• Whalefin Markets Limited (WhaleFin), applied 21 Feb 2024.
• Flying Hippo Technologies Limited (Matrixport HK), applied 26 Feb 2024; the SFC notes it has ceased operating a VATP business.

The remaining applicants, HighBlock Limited (bitV), Nebulas Hong Kong Limited and Bybit's Spark Fintech Limited, which re-applied on 6 June 2025, are not deemed licensed at all. They are simply in the queue. If any of these brands tells you it is "licensed in Hong Kong", it is wrong, and you should read that as a warning sign about how the firm talks to customers in general.

Who withdrew: OKX, Bybit, Gate, Huobi and BitMart

The third part of the SFC page is a list of applications that were withdrawn or returned. It reads like a who's who of global exchanges that decided the Hong Kong rulebook was not for them, or were told as much. Platforms on this list had to wind down their Hong Kong business.

• Huobi HK (HBGL Hong Kong) withdrew on 23 Feb 2024; HTX's terms now ban Hong Kong users.
• Gate.HK (Gate Digital) withdrew on 22 May 2024; Gate lists Hong Kong as a restricted location.
• OKX (OKX Hong Kong FinTech) withdrew on 24 May 2024; Hong Kong is a restricted location in OKX's risk and compliance disclosure, updated 8 Jul 2026. Its self-custody wallet still works.
• Bybit (Spark Fintech) withdrew on 31 May 2024 after landing on the SFC alert list on 14 Mar 2024; it re-applied in June 2025 but remains unlicensed and excludes Hong Kong in its terms.
• BitMart (Spread Technologies HK) withdrew on 28 Aug 2025.

Smaller names such as HKX (hi5), HKDAX, Ammbr, BitHarbour, Meex, HKVAEX, IBTCEX, QuanXLab, VAEX and Bitcoin World also left the process. Binance, Coinbase, Kraken and KuCoin never applied. You can still find residents using some of them, since Hong Kong does not block offshore exchanges and using one is not an offence, but none of them is a legal crypto exchange in Hong Kong in the sense that matters: supervised, audited and answerable to the SFC.

How to verify a Hong Kong crypto licence on the SFC register

Clone websites are now the SFC's most common alert, so checking the list once is not enough. You want to confirm that the site or app in front of you belongs to the licensed company. It takes about five minutes.

1. Open the official list yourselfType sfc.hk into your browser rather than following a link from an advert or chat group, then go to Fintech Contact Point → Virtual assets → Lists of virtual asset trading platforms.
2. Find the operator, not the brandNote the licensed company name and the CE number, for example Hash Blockchain Limited, BPL992 for HashKey Exchange. Check it sits in the licensed table, not under applicants.
3. Search the CE number on the Public RegisterOn the SFC Public Register, search by CE number. Confirm the licence is active, read the regulated activities and conditions, and note the principal place of business and website listed.
4. Match the domain character by characterCompare that website with the address bar on your phone. Clones use extra words or dots, such as hashkeycom.com, flagged by the SFC in Aug 2026.
5. Check the alert list lastSearch the brand on the SFC Suspicious VATP Alert List. If a look-alike appears there, bookmark the genuine site and only ever log in from the bookmark or the official app store listing.

The same method works for brokers. The SFC does not publish a single list of brokers approved to deal in virtual assets, so you check each firm's licence conditions on the register. If a salesperson cannot tell you their firm's CE number, that is your answer.

Retail rules: large-cap tokens, knowledge test and exposure limits

Hong Kong opened crypto to retail on licensed platforms in 2023, but on its own terms. The SFC's VATP Guidelines set three limits that shape what you will experience when you sign up.

Only eligible large-cap tokens

A token can be offered to retail clients only if it is an eligible large-cap virtual asset: it must be included in at least two acceptable indices issued by at least two independent index providers, one of which follows IOSCO benchmark principles, and it needs a 12-month track record plus due diligence on its team, liquidity and legal risks. That is why retail menus are short. OSL offers four tokens to retail (BTC, ETH, SOL and XRP, the last since 29 July 2026) and Tiger lists five (BTC, ETH, SOL, AVAX and LINK). Since November 2025, stablecoins issued by an HKMA licensee can also be offered to retail without the 12-month record. Meme coins and fresh launches are simply not available.

A knowledge assessment before your first trade

Before you trade, the platform must check that you understand virtual assets, and give you training if you don't. Expect a short online questionnaire on volatility, custody and loss scenarios, plus risk profiling. It is not hard, but it adds time to onboarding, which is why we compare it honestly on our page about the quickest way to buy crypto in Hong Kong.

A personal exposure limit

Each retail client gets a client-specific exposure limit, set against their financial situation. Professional investors, meaning individuals with a portfolio of at least HK$8 million under the Professional Investor Rules (Cap. 571D), escape these limits and get wider token lists, OTC access and, since 11 February 2026, perpetual contracts, which are restricted to them. Licensed platforms also cannot give you gifts to induce trading, and client assets sit in trust with an associated custodian, originally with 98% in cold storage.

Banks and brokers that route to licensed venues

You don't have to open an account with an exchange to buy through one. Since the joint SFC–HKMA circular of 22 December 2023, banks and brokers with an upgraded licence may run an omnibus account at an SFC-licensed platform and let you trade from their own app. There is a catch that trips people up: omnibus clients deposit and withdraw fiat only. You cannot send coins in from a wallet or move them out, so these are exposure tools, not a way to fund your own wallet.

ZA Bank became the first bank in Asia to offer retail crypto on 25 November 2024, routing orders to HashKey. The 1.5% standard platform fee reported at launch has since come down: its FAQ now lists $0 commission and a 0.8% platform fee with a HK$15 minimum per order, on BTC, ETH, AVAX, LINK and SOL, with no crypto transfers in or out (see our ZA Bank crypto review). Mox, the Standard Chartered-led virtual bank, launched crypto in January 2026, also through HashKey with HashKey Custody holding the coins, and now offers BTC, ETH and SOL priced in US dollars; press reports put commission at 1.25% for basic users and 0.5% for Elite. Futu moved its crypto trading onto its own licensed venue, PantherTrade, around March 2026; our Futu PantherTrade review covers what that changed. Tiger Brokers charges a 0.05% handling fee with no commission and settles in USD. HSBC, for the record, offers no spot crypto at all, only the Hong Kong-listed Bitcoin and Ether ETFs.

Fee figures above come from each provider's own pages or press releases and change often, so treat them as a starting point. If you later want to turn those coins back into Hong Kong dollars, the fiat-only rule works in your favour: our guide on how to sell crypto and cash out to a Hong Kong bank explains why selling inside a licensed app is the least likely route to trigger a bank review.

What "not licensed" means for you

It is not illegal for a Hong Kong resident to open an account on an offshore exchange, and the government does not block them. What changes is who has your back. On an unlicensed platform there is no SFC supervision of how your coins are stored, no SFC rules on segregation or insurance, no knowledge test protecting beginners from leverage, and no regulator here to complain to when withdrawals stop. You are relying entirely on the company's own terms, often governed by a court on another continent.

The JPEX collapse is the case every Hong Kong investor should know. The platform was already on the SFC alert list in July 2022, the SFC warned publicly on 13 September 2023, and by then more than 2,700 people had claimed losses above HK$1.6 billion. It had been promoted by influencers and walk-in crypto exchange shops, and falsely claimed overseas licences. By March 2026, 26 people had been charged. Our page on crypto scams in Hong Kong tracks that case and the newer patterns that copy it.

Some international exchanges are properly regulated elsewhere even though they are not licensed here. CEX.IO, founded in London in 2013, holds registrations such as a US FinCEN MSB registration and a Bank of Spain VASP registration and is often used for quick card or Apple Pay purchases, but it is not licensed by the SFC and Hong Kong customers contract with its international entity, so you get no Hong Kong investor protection. The SFC's advice is to use licensed platforms; our CEX.IO review sets out the trade-off so you can decide with your eyes open.

Cash routes carry their own licensing gap. Bitcoin ATMs and walk-in shops are not licensed as virtual asset dealers yet; a new SFC dealing regime with no transitional period is still waiting for its bill to reach LegCo. If you are weighing a machine against an app, compare costs on our Bitcoin ATM guide first.

The SFC alert list and clone domains

The Suspicious Virtual Asset Trading Platforms alert list is where the SFC names websites and apps it suspects of misleading investors. Scroll through its recent entries and a pattern is obvious: fraudsters are no longer inventing brands, they are borrowing licensed ones. Entries in 2026 include EX.IO look-alike URLs (9 June), DFX Labs clones such as dfxlabs.org (28 July), HashKey look-alike domains like hashkeycom.com (14 August), Vebit (22 September) and dfx.cn / dfxcn.com (28 September). Older entries include MEXC, "Bitget Pro" and Bybit.

If you think you have already sent money to a fake platform, report it to the police and its Anti-Deception Coordination Centre (ADCC) and to the SFC as quickly as you can, and keep screenshots of every transfer. Speed matters because banks can sometimes freeze funds that are still in transit. Before your first deposit anywhere, it also helps to read our guide to crypto wallets, so you know when to leave coins on a licensed platform and when to take custody yourself.

Frequently asked questions

Sources & further reading

1. SFC — Lists of virtual asset trading platforms · updated 29 May 2026
2. SFC — Public Register of Licensed Persons · checked Sep 2026
3. SFC — Suspicious virtual asset trading platforms alert list · checked 30 Sep 2026
4. SFC — Guidelines for Virtual Asset Trading Platform Operators · June 2023
5. SFC & HKMA — Joint circular on intermediaries’ virtual asset-related activities (23EC66) · 22 Dec 2023
6. SFC press release 24PR47 — Bybit alert · 14 Mar 2024
7. OKX — Risk & Compliance Disclosure · updated 8 Jul 2026
8. Tiger Brokers HK — Virtual assets · checked 30 Sep 2026
9. OSL — XRP available to retail on OSL HK · 29 Jul 2026

Keep reading