Two Responsible Officers, real fitness-and-properness, and a 10—15 month review window. A practical read of the SFC's posture.
This brief covers what the RO requirement actually demands in practice — not what the circulars say, but what the SFC has scrutinised across our active Hong Kong dossiers.
The RO requirement — what it actually means
Every licensed VATP must appoint a minimum of two Responsible Officers. At least one must be an executive director who actively participates in managing the licensed activity. The second must be genuinely available to step in — a passive appointment is not compliant, and the SFC has become adept at identifying nominees who exist on paper only.
The RO must be fit-and-proper under SFC criteria, an executive director or senior management figure with effective control over the regulated activity, able to demonstrate substantive understanding of the VA products the platform handles, and demonstrably present in Hong Kong for regulatory accountability purposes. The residency point is less rigid than it sounds — “regularly present” has meant demonstrable travel patterns in practice, not domicile. But the SFC has rejected nominees clearly inserted for the application without operational substance.
The RO is not a compliance checkbox. The SFC treats it as the individual personally accountable if the platform fails. Nominating a figurehead is the fastest route to a deficiency notice.GSS Legal internal note — Hong Kong VASP practice
Fitness and properness in practice
The SFC’s assessment goes considerably beyond a criminal background check. Across our active dossiers we have seen the SFC request five-year employment histories verified against public records, written explanations of any gaps or departures from regulated firms, and confirmation from prior regulated employers where the RO held a licence elsewhere. Non-disclosure discovered during review has in at least two cases resulted in full application withdrawal. For platforms whose proposed ROs have DeFi backgrounds — where regulatory history is sparse but the track record may include projects that attracted enforcement attention — disclosure strategy is the most important early decision in the engagement.
The 10–15 month review window
The SFC’s published timeline is 6 months from complete submission. In practice, across our active Hong Kong book, the first RFI arrives between weeks 8 and 14, with subsequent rounds extending the review. Most approvals have taken 10–15 months from initial filing to grant. The principal drivers: RO fit-and-proper queries (typically 3–6 weeks per round, frequently multi-round); AML/CFT programme gaps; custody architecture documentation; and business plan plausibility — the SFC increasingly asks for volume projections tied to existing or pipeline institutional relationships.
Applications that arrive with incomplete RO packages, template-derived AML programmes, or custody architecture that is described but not evidenced run to the 15-month end of the range. Applications that arrive prepared clear faster.
Custody and insurance
The SFC requires VATPs to hold at least 98% of client assets in cold storage. The insurance requirement applies to assets in hot storage: operators must hold adequate cover against loss, theft, or hack for the full value of hot-wallet assets at any time. Qualifying insurance is expensive and market-limited — effectively concentrated among a small number of Lloyd’s syndicates and specialist crypto insurers. We recommend operators secure insurance term sheets at the engagement scoping stage, not post-grant. Third-party custodian arrangements with Hex Trust, BitGo, or Fireblocks-equivalent providers are an increasingly accepted structure.
What operators do now
If you are at the pre-application stage, the three things to address before filing: RO identification and fit-and-proper pack preparation; AML programme drafting against the SFC’s specific VA guidance (not a generic template); and custody architecture commitment — operational or contractually committed, not a plan. One hour with a partner on the Hong Kong VASP regime is available at no retainer — the fastest way to identify where a dossier will attract scrutiny before it is submitted.
