Where a digital-asset fund structured through Hong Kong and Cyprus stands now

A fund manager combining Hong Kong and Cyprus in a digital-asset structure is working with two genuinely different regulatory systems. The tension is not academic. It is live, and it sharpens the moment the fund receives its first external investor, its first virtual-asset transfer, or its first regulatory inquiry.

A digital-asset fund using Hong Kong as the operating and licensing hub and Cyprus as the holding or feeder layer sits at the intersection of the Securities and Futures Commission's mandatory virtual-asset trading platform regime – which commenced on 1 June 2023 under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance – and Cyprus's own European Union regulatory perimeter, which reaches into the structure through the fund's Cyprus entity whenever that entity deals in instruments regulated under EU law. The governing instrument in Hong Kong is the Anti-Money Laundering and Counter-Terrorist Financing Ordinance for virtual-asset service providers and the Securities and Futures Ordinance where the digital asset is a "security" or "futures contract". In Cyprus, the Markets in Crypto-Assets Regulation and the Alternative Investment Fund Managers Directive form the primary perimeter.

This analysis maps the current position of a Hong Kong–Cyprus digital-asset fund structure. It covers the commercial stakes, the licensing and AML obligations on each side, the points where the two systems interact, and where the structural risk now sits for managers who have not revisited their fund documents since the regulatory environment shifted.

What is actually at stake commercially

The commercial logic of a Hong Kong–Cyprus structure is straightforward. Hong Kong offers direct proximity to Asian capital, a mature arbitration market, a common-law court system, and a licensing regime that allows a virtual-asset trading platform operator to market credibly to institutional investors. Cyprus offers access to the European single market through EU regulatory passporting, a developed fund-services sector, and a network of double-taxation treaties that is relevant when the fund holds digital assets generating income with an arguable source in a treaty-partner state.

The problem is that both regulatory perimeters are live simultaneously. They do not cancel each other out. A fund that raises capital from EU investors through its Cyprus entity is inside the EU regulatory perimeter for those investors, regardless of where the trading desk sits. A fund that routes trades through a Hong Kong platform operator is inside the SFC regime, regardless of where the fund itself is domiciled. Managers who built the structure to extract the benefits of both jurisdictions have, in many cases, also accumulated the compliance burden of both.

The commercial stakes concentrate in three areas. First, the ability to continue raising capital from the fund's existing investor base without triggering a licensing event in a jurisdiction that was not anticipated at inception. Second, the ability to transfer virtual assets between the Hong Kong and Cyprus legs of the structure without breaching the FATF travel rule obligations that apply in both systems. Third, the ability to demonstrate to an institutional investor – or an institutional lender – that the fund has a defensible compliance position across both systems, not merely one.

In our cross-border practice, we regularly see fund managers who have optimised one side of the structure and left the other partially addressed. The risks that flow from that gap are more significant now than they were at the time most of these structures were put in place.

How does the Hong Kong licensing regime apply to the fund?

The answer depends on exactly what the Hong Kong entity does – and the SFC's view of "what it does" may differ from the manager's. The mandatory licensing regime for centralised virtual-asset trading platforms under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance requires any platform operating a centralised exchange in Hong Kong, or actively marketing its services to Hong Kong investors, to hold a licence from the Securities and Futures Commission. The regime commenced on 1 June 2023.

For a fund structure, the critical question is whether the Hong Kong entity operates a "centralised virtual-asset trading platform" or whether it is a fund manager or adviser that accesses such platforms on behalf of the fund. Those are different regulatory characterisations with different licensing consequences. A fund manager that executes trades through a licensed VATP for the account of its fund is not, without more, operating a VATP itself. But a fund manager that provides a trading facility to third parties, holds client virtual assets on an omnibus basis, or performs functions that look like exchange operation in substance rather than name is in different territory.

Where the digital assets in question are "securities" or "futures contracts" under the Securities and Futures Ordinance – a question that turns on the specific characteristics of the asset, not its label – the Securities and Futures Commission licensing requirements under that Ordinance apply concurrently. The overlap between the two regimes is one of the points that most commonly generates structural uncertainty in fund reviews we conduct on structures built before the 2023 commencement.

AML obligations follow the licensing position. A licensed VATP in Hong Kong is subject to customer due diligence obligations and the FATF travel rule for virtual-asset transfers under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance. Those obligations apply to the platform, not the fund as such – but where the fund's Hong Kong manager sits close enough to the platform function to be treated as operating within its perimeter, the obligations effectively reach the fund.

The sequence above describes the standard position. Your matter turns on the documents, the jurisdictions actually engaged, and the order of the licensing and characterisation steps – which is where the route is won or lost.

For a structured assessment of your Hong Kong entity's licensing position and the steps required to regularise or confirm it, write to us at info@lockhartyip.com.

What does the Cyprus and EU perimeter add – and where does it bite?

Cyprus sits inside the EU regulatory perimeter. The Markets in Crypto-Assets Regulation – commonly referred to as MiCA – entered into application across EU member states including Cyprus by the end of 2024. It creates a passportable licensing regime for crypto-asset service providers and issuers of certain categories of crypto-assets. A Cyprus entity that qualifies as a crypto-asset service provider under MiCA requires authorisation from the Cyprus Securities and Exchange Commission, which serves as the national competent authority.

For a fund structure, the MiCA question is whether the Cyprus entity provides crypto-asset services within the MiCA perimeter. Providing custody and administration of crypto-assets on behalf of third parties, operating a trading platform for crypto-assets, or exchanging crypto-assets for funds or other crypto-assets all fall within the defined categories of crypto-asset services under MiCA. A Cyprus feeder vehicle that merely holds interests in the fund and passes subscription proceeds upstream is unlikely to be a crypto-asset service provider. A Cyprus management company that makes investment decisions over a portfolio of crypto-assets is a more nuanced position, and the interaction with the Alternative Investment Fund Managers Directive adds a further layer.

The Alternative Investment Fund Managers Directive applies in Cyprus to managers of alternative investment funds above the relevant thresholds. A digital-asset fund with a Cyprus-based manager or a Cyprus fund vehicle is, in principle, within the AIFMD perimeter unless an exemption applies. The exemption for below-threshold managers requires registration rather than full authorisation, but the manager remains subject to conditions that include investor-disclosure obligations and, in Cyprus, conditions imposed by the Cyprus Securities and Exchange Commission as competent authority.

The interaction between MiCA and AIFMD is a live issue across EU member states. Where the Cyprus entity manages a fund that invests in crypto-assets that are financial instruments under EU law, the MiFID II framework may also be engaged. These three instruments can apply simultaneously to the same entity performing the same functions. In practice, the regulator that "actually applies" with the most immediate consequence for a fund is determined by the fund's investor base, the nature of the assets, and the functions performed by the Cyprus entity.

A second issue specific to Cyprus concerns the entity's place in the group for tax purposes. Cyprus has no capital gains tax on disposal of securities in most circumstances, a corporate tax rate of 12.5%, and a wide treaty network. For a digital-asset fund, the question is whether gains on disposal of digital assets are treated as gains on securities or as trading income – a characterisation that Cyprus tax rules and, increasingly, the OECD's work on the tax treatment of crypto-assets, address differently. This analysis does not extend to tax advice, but the characterisation point is relevant to the structure design and should be assessed by tax counsel alongside the regulatory review.

The cross-border interface: where the two systems meet in practice

The two regulatory regimes do not operate in sealed compartments. They intersect at three points that are, in our experience, the most likely sources of structural difficulty.

The first is the travel rule. The FATF travel rule for virtual-asset transfers requires the originating virtual-asset service provider to collect and transmit identifying information about the originator and beneficiary to the receiving VASP. Both Hong Kong's AML regime for VATPs and Cyprus's implementation of FATF standards through its AML rules require travel-rule compliance on transfers of virtual assets above the relevant threshold. A transfer from the Hong Kong trading entity to the Cyprus holding entity – or the reverse – is a cross-border virtual-asset transfer between two entities that may both be treated as VASPs by their respective regulators. The travel rule applies to both legs. If the group's internal transfer procedures do not treat intra-group transfers as within the travel-rule perimeter, that is a gap.

The second intersection is investor-marketing. A fund that accepts subscriptions from EU-resident investors through the Cyprus entity is inside the EU marketing regime for those investors. The fund must comply with the relevant national private placement rules or the AIFMD passport, depending on the manager's status. But the fund's trading activity may also give rise to a question about whether the Hong Kong entity is "marketing" to those investors by performing the investment function. The answer is fact-specific. What matters is whether the relevant regulator in Cyprus – or in the investor's home member state – would regard the Hong Kong entity's activities as constituting regulated conduct in relation to EU investors.

The third intersection is source-of-funds and AML files. Both the Hong Kong AML regime and the Cyprus AML framework require the relevant obliged entity to conduct and document customer due diligence. Where the fund has investors onboarded through the Cyprus entity whose source-of-funds files are held in Cyprus, and trades are executed through the Hong Kong entity whose AML files are maintained in Hong Kong, the question is whether the group's overall file is coherent and accessible to either regulator on demand. In our cross-border practice, we regularly see structures where the AML file is maintained in one jurisdiction but the actual KYC was conducted partly in the other. That split creates difficulty on examination.

A mid-market digital-asset fund with a Cyprus-based general partner and Hong Kong-based trading entity came to us in late 2026 to review its compliance architecture. The fund had conducted onboarding in Cyprus, executed trades in Hong Kong, and maintained travel-rule records in neither jurisdiction in a form that satisfied the other's requirements. We reviewed the investor-facing documents, the intra-group transfer procedures, and the AML file structure, then produced a gap analysis and a sequenced remediation plan. The fund addressed the identified gaps over two cycles before its next institutional investor due-diligence process.

If an earlier filing, structure or compliance attempt produced an adverse or stalled result, a second read can identify the strategic error and the routes still open. Write to info@lockhartyip.com to discuss the next step.

Where the structural risk sits now: our view

The regulatory environment for digital-asset fund structures changed materially in the period between 2022 and 2025. Most Hong Kong–Cyprus structures in the market were designed before both the SFC's VATP licensing regime and MiCA were fully operative. That means a significant number of existing structures were built for a regulatory environment that no longer exists.

The risk concentration, as we see it from the work our desk handles, falls into four areas.

The first is unlicensed operation. A fund manager that was operating in the period before June 2023 without a VATP licence on the basis that the activity did not then require one has to re-examine that position. The regime is now in force. If the Hong Kong entity's activities fall within the licensing perimeter and no licence has been obtained, the manager is in breach. The SFC has enforcement powers and has used them.

The second is MiCA readiness. Cyprus entities that previously relied on the transitional period under MiCA need to have completed or be in the process of completing authorisation with the Cyprus Securities and Exchange Commission. A Cyprus crypto-asset service provider operating without authorisation after the transitional period ended is in breach of EU law as transposed in Cyprus. The consequence reaches beyond the Cyprus entity: a fund whose Cyprus manager is not properly authorised may be unable to accept subscriptions from EU investors through the standard distribution channels.

The third is the AML gap. Travel-rule compliance and cross-border AML file coherence are the areas where structures built for a simpler environment most commonly show gaps. Both regulators are increasingly focused on the travel rule's application to intra-group transfers. A gap in this area is both a regulatory exposure and a due-diligence obstacle for institutional investors, prime brokers, and custodians.

The fourth is characterisation. The question of whether specific digital assets in the fund's portfolio are "securities" under the Securities and Futures Ordinance, or financial instruments under MiFID II, or crypto-assets subject to MiCA is not resolved by the fund's own documentation. It depends on the legal characteristics of the assets. A fund that holds a range of digital assets and has not conducted a current characterisation analysis across both legal systems is carrying an undocumented regulatory risk in its portfolio.

What foreign counsel – and some fund managers – get wrong is assuming that because the structure was reviewed at inception, it remains compliant. Regulatory regimes have changed around these structures without the structures changing to match. A Hong Kong–Cyprus fund reviewed in 2021 was reviewed against a different regulatory environment. The inception review has not been invalidated; it has simply been superseded in the jurisdictions that matter most.

Decision map: situation, instrument, route and risk

The following maps the four structural situations we most frequently encounter to the governing instrument and the primary regulatory risk. This is a practical read, not a legal opinion; the specific position depends on the fund's documents and activities.

Situation A: the Hong Kong entity operates a centralised virtual-asset trading platform and holds client assets on behalf of the fund's investors. The governing instrument is the Anti-Money Laundering and Counter-Terrorist Financing Ordinance. The required route is SFC VATP licensing. The primary risk is unlicensed operation and custodial-rule breach. Timing is driven by the SFC's licensing process, which has no fixed statutory period but has in practice taken multiple months from application to determination.

Situation B: the Hong Kong entity is a fund manager that accesses licensed VATPs but does not operate one itself, and the assets are characterised as securities. The governing instrument is the Securities and Futures Ordinance. The required route is SFC licensing for the relevant regulated activity type. The primary risk is unregistered dealing in securities. The Cyprus entity may independently hold a MiFID II or AIFMD authorisation that covers the EU-side function.

Situation C: the Cyprus entity is a crypto-asset service provider under MiCA, is Cyprus-authorised, and passports services into other EU member states. The governing instrument is MiCA as transposed in Cyprus. The required route is a passporting notification to the relevant host-state regulator. The primary risk is providing services in host member states before the notification process is complete. The Hong Kong entity's activities are outside the MiCA perimeter but may create a linked AML obligation.

Situation D: the structure involves both a Hong Kong trading entity and a Cyprus manager, each regulated in its own jurisdiction, with intra-group transfers of virtual assets between them. Both legs of the travel rule apply. The governing instruments are the Anti-Money Laundering and Counter-Terrorist Financing Ordinance in Hong Kong and the Cyprus AML laws implementing FATF standards. The primary risk is travel-rule non-compliance on intra-group transfers. The route is to implement and document a travel-rule procedure that satisfies both regulators.

A second scenario from our practice: a digital-asset fund with a Hong Kong trading entity and a Cyprus-authorised AIFM sought to expand its investor base to include sovereign wealth fund allocators in 2027. The allocators' due-diligence process required confirmation of SFC licensing status, MiCA authorisation of the Cyprus manager, travel-rule procedures, and cross-border AML file access. We reviewed the regulatory status of each entity, prepared the regulatory confirmations required by the allocators' diligence team, and identified one gap – the Hong Kong entity's VATP licensing application was in progress but not complete. We advised on the sequencing of the capital raise relative to the licensing timeline, and the first closing proceeded on a timetable the fund managers and investors had agreed on a fully informed basis.

For a preliminary read on your fund's cross-border regulatory position and the steps required, email info@lockhartyip.com.

Where is this heading? Regulatory direction and structural consequences

Both regulators are moving in the same direction: more authorisation requirements, more granular AML rules, and greater scrutiny of cross-border structures. That is the consistent direction of travel from the SFC in Hong Kong and from the European Securities and Markets Authority and national competent authorities in the EU, including Cyprus.

In Hong Kong, the SFC has made clear that the licensing regime is not static. The stablecoin licensing regime is now in development under the Hong Kong Monetary Authority. Verify the current commencement date and perimeter before acting on any specific timeline. But the direction is toward a more comprehensive licensing perimeter, not a narrower one. A fund structure that is currently outside the VATP licensing perimeter because its assets are not "virtual assets" for VATP-regime purposes may find that the perimeter has moved by the time of the fund's next vintage or its next investor round.

In the EU, the interaction between MiCA and the existing financial-instruments framework is still being worked through by regulators and market participants. There are assets that are simultaneously arguable as crypto-assets under MiCA and financial instruments under MiFID II. The regulatory outcome for those assets in Cyprus depends on the Cyprus Securities and Exchange Commission's position and, ultimately, on guidance from European Securities and Markets Authority. Fund managers holding such assets need to monitor that regulatory development actively, not periodically.

The broader direction of travel for cross-border digital-asset structures is toward a position where a manager can demonstrate, on demand to any of the relevant regulators, that every entity in the structure holds the right authorisation, has applied the right AML procedures to the right transactions, and maintains a coherent cross-border file. That is a higher standard than most structures currently meet. Getting from the current position to that standard is a sequenced process, and the sequence matters.

Objection: the structure was reviewed at inception – is a re-review necessary?

This is the most common position we encounter when a fund manager first engages with these issues. The fund documents were reviewed by counsel at launch. The regulatory position was assessed. Why does it need to be assessed again?

The answer is that the regulatory environment has changed, not the documents. The SFC's VATP licensing regime did not exist in its current mandatory form before 1 June 2023. MiCA was not in full application before late 2024. The HKMA's stablecoin licensing regime is newer still. A review conducted before those regimes came into force was accurate at the time. It does not speak to the current position.

There is a second reason. Fund structures evolve. The assets in the portfolio change. The investor base changes. The functions performed by each entity may change as the fund scales or as operational decisions are made for commercial reasons. A structure that was within a particular regulatory perimeter at launch may have moved outside it – or further inside it – as a result of operational change rather than any deliberate restructuring. Regulators assess the position as at the date of examination, not the date of launch.

A re-review is not a criticism of the original work. It is a recognition that digital-asset regulatory regimes were among the fastest-moving in either jurisdiction over the relevant period, and that a structure designed for one environment needs to be tested against the environment that now applies.

We regularly act on cross-border matters of this kind. Our approach is to review the regulatory status of each entity, assess the AML procedures against both regulatory standards, identify the gaps, and produce a sequenced remediation plan that addresses the most material exposures first.

Related practices

• Sanctions & AML – cross-border AML compliance, FATF travel rule and source-of-funds analysis
• Holding Structures – entity review and cross-border holding architecture for international groups

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

Related

• Tech Web3
• Digital Asset Fund Structured Through Hong Kong Bvi 5
• Cross Border Saas Or Data Agreement Touching Uae 3

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.