Where a fintech entity and regulatory engagement

For a fintech group weighing its next move in Asia, the question is rarely whether to engage Hong Kong. It is how quickly the regulatory clock is running, and whether the entity in view is correctly structured before engagement begins. The window for a clean entry – one that reaches the Securities and Futures Commission or the Hong Kong Monetary Authority before a structural problem is baked in – is narrower than most founding teams expect.

A fintech entity operating in or from Hong Kong now sits within a mandatory licensing regime under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, administered by the Securities and Futures Commission, which commenced on 1 June 2023. Where the entity's product touches instruments that qualify as securities or futures contracts, the Securities and Futures Ordinance overlays a second licensing requirement. Fiat-referenced stablecoin issuers face a further, HKMA-administered regime that commenced in 2025. The analytical challenge is identifying which of these regimes bites first – and in what combination.

This analysis covers the commercial stakes, the governing instruments and the cross-border interface, a comparative read between Hong Kong and the offshore holding centres most commonly used above fintech operating companies, and our read on where the regulatory risk sits at present.

What is actually at stake commercially for a fintech group entering Hong Kong?

The commercial proposition is straightforward. Hong Kong offers common-law courts, an established international-arbitration seat, a deep institutional investor base, and a regulatory authority – the Securities and Futures Commission – that is internationally recognised and, for licensing purposes, bankable with institutional counterparties. A virtual-asset trading platform or a fiat-referenced stablecoin issuer licensed in Hong Kong carries a credential that moves the conversation with prime brokers, custodians and corporate treasury desks in a way that a registration in a smaller offshore centre generally does not.

That credential comes at a cost. The licensing process is substantive. It requires a locally incorporated or registered entity with genuine operational substance, a responsible officer of the required type, and an AML programme that meets the standards set out in the Anti-Money Laundering and Counter-Terrorist Financing Ordinance and the SFC's own guidelines. Groups that attempt to book the Hong Kong brand through a thin local entity while operating the real business elsewhere find that the regulator's substance assessment is not easily satisfied.

Why does this matter beyond licence acquisition? Because the licence position determines the enforcement posture of the entity across the cross-border chain. A licensed entity transacting with Mainland Chinese users, BVI holding vehicles or Singapore-domiciled funds carries a different counterparty-risk profile than an unlicensed one. In our cross-border practice, we see the absence of a clear licensing posture surface as a deal-breaker in institutional financing rounds and in cross-border M&A due diligence – even where the entity's home jurisdiction does not formally require a Hong Kong licence.

Which instruments govern – and how does the cross-border interface bite?

Three instruments define the current regulatory perimeter for a Hong Kong fintech entity. Understanding their interaction is the first analytical step.

The Anti-Money Laundering and Counter-Terrorist Financing Ordinance is the primary licensing instrument for centralised virtual-asset trading platforms. The mandatory licensing regime for virtual-asset trading platforms commenced on 1 June 2023. The Securities and Futures Commission is the licensing authority. Any platform operating a centralised exchange function in or from Hong Kong – matching buy and sell orders in virtual assets – requires a licence from the SFC under this regime. The AML and know-your-customer obligations that accompany the licence are calibrated to the Financial Action Task Force standards, including the travel rule for virtual-asset transfers.

Where a virtual asset constitutes a security or a futures contract under Hong Kong law, the Securities and Futures Ordinance applies in addition. The SFC's approach has been to assess the economic character of the asset rather than its label. A token with profit-sharing or governance features attached to an underlying business may qualify as a collective investment scheme interest, triggering Type 1 (dealing in securities) or Type 9 (asset management) licensing obligations. This overlay is not hypothetical – it is a live enforcement position that the SFC has applied.

For fiat-referenced stablecoin issuers, the Hong Kong Monetary Authority administers a dedicated licensing regime that commenced in 2025. Parties should verify the current commencement date and perimeter before acting, as the implementing instrument and the scope of the exemptions were subject to finalisation. The practical effect is that a stablecoin issuer targeting Hong Kong users, or issuing a stablecoin denominated in or pegged to a Hong Kong dollar equivalent, is now in the HKMA's regulatory perimeter in a way that did not apply before 2025.

The cross-border interface bites at two points. First, at the entity level: a BVI or Cayman holding company above the Hong Kong operating entity does not insulate the operating entity from the Hong Kong licensing requirement. The SFC and HKMA assess the conduct from Hong Kong, not the address of the parent. Second, at the product level: a platform incorporated offshore but actively soliciting Hong Kong users, or a stablecoin issuer whose token circulates in Hong Kong, faces extraterritorial reach under the relevant ordinance. The question of where the activity occurs is a facts-and-conduct analysis, not a corporate-registry query.

The sequence above describes the standard position. Your matter turns on the documents, the jurisdictions actually engaged, and the order of steps – which is where the route is won or lost.

For a structured assessment of your licensing perimeter across the relevant instruments and jurisdictions, write to us at info@lockhartyip.com.

How does the holding structure above the Hong Kong entity affect the regulatory read?

Most fintech groups reach Hong Kong with a pre-existing holding structure. The typical architecture is a BVI or Cayman parent above a Singapore or Hong Kong operating subsidiary, with the intellectual property held in a separate vehicle and the treasury function sitting elsewhere. The holding structure is usually optimised for investor entry, exit, and the avoidance of stamp duty on share transfers – but it is rarely designed with the Hong Kong licensing perimeter in mind.

The Cayman Islands and the British Virgin Islands are common-law holding centres widely used above Hong Kong operating companies. Both jurisdictions have economic-substance regimes that require genuine activity at the holding level. A pure holding entity with no local staff, no board meetings in the jurisdiction, and no real economic function at the Cayman or BVI level may fail the substance assessment. That failure, in isolation, is an offshore-regulatory issue. But it becomes a Hong Kong issue when the SFC or HKMA assesses the group structure as part of its fit-and-proper analysis of the licence applicant.

What does this mean in practice? The regulator will look through the holding structure to assess who controls the Hong Kong entity, what their track record is, and whether the group's overall governance is consistent with a licensed operator. A group that cannot demonstrate coherent governance at the holding level – because the BVI entity has no real directors and no board minutes – will struggle to satisfy the SFC's fit-and-proper standard, even if the Hong Kong operating entity is correctly staffed and locally present.

The interaction with the Significant Controllers Register (an obligation under the Companies Ordinance requiring Hong Kong-incorporated companies to identify and register their beneficial owners, in force since 1 March 2018) adds a transparency layer. The SFC and HKMA expect to see a clear and accurate beneficial-ownership picture. Groups that have used nominee arrangements or multi-layer offshore structures without a genuine commercial rationale should expect scrutiny.

We regularly advise on restructuring the holding architecture before regulatory engagement begins. In our experience, the moment to address a structural problem is before the licence application is filed, not after the regulator has identified it.

What does the AML and travel-rule obligation actually require?

AML compliance is not a back-office function for a licensed virtual-asset trading platform. It is the substance of the regulatory obligation. The Anti-Money Laundering and Counter-Terrorist Financing Ordinance requires the licensed entity to implement customer due diligence, ongoing monitoring, suspicious-transaction reporting, and – for virtual-asset transfers – the FATF travel rule. The travel rule requires that originator and beneficiary information accompany virtual-asset transfers above the applicable threshold. The obligation runs between virtual-asset service providers.

The cross-border dimension here is significant. A Hong Kong-licensed platform transacting with a counterparty platform in a jurisdiction that has not implemented the travel rule faces a gap. The outgoing transfer carries the required information; the incoming transfer may not. The licensed entity's obligation is to have a policy for handling that gap – typically, enhanced due diligence on the counterparty transfer. A policy that simply ignores the gap is an AML deficiency.

The SFC's approach to AML oversight of licensed platforms has, in our desk's experience, been substantive rather than procedural. The regulator is not merely checking whether an AML manual exists. It is assessing whether the manual is implemented, whether the staff are trained, and whether the transaction-monitoring system is calibrated to the risk profile of the business. A platform that operates in multiple jurisdictions, accepts users from higher-risk countries, and processes large or complex transactions will attract a correspondingly higher scrutiny threshold.

Source-of-funds analysis is a point that foreign founding teams frequently underestimate. The licensed entity must be able to demonstrate the source of funds for its own capitalisation as well as for its clients. A founding team that raised seed capital in an informal round, without documented investor onboarding and source-of-funds files, will face questions at the licensing stage that are difficult to answer after the fact.

If an earlier filing, structure or enforcement attempt produced an adverse or stalled result, a second read can identify the strategic error and the routes still open. Contact us at info@lockhartyip.com to discuss the position.

The comparative read: Hong Kong versus Singapore for a fintech licensing strategy

The choice between Hong Kong and Singapore as the primary regulatory home for an Asia-Pacific fintech entity is, at present, genuinely consequential. The two jurisdictions have taken different approaches to the pace and scope of virtual-asset licensing, and the difference affects both the timeline to market and the counterparty-risk profile of the licensed entity.

Singapore's Payment Services Act (the primary licensing instrument for digital-payment token services in Singapore) offers a licensing pathway that has been operational for longer, and the Monetary Authority of Singapore (Singapore's central bank and financial regulator) has processed a larger volume of licence applications. The Singapore regime is well-understood by institutional investors and by the banking system. A Singapore digital-payment token service licence carries significant recognition in the institutional market.

Hong Kong's VATP licensing regime commenced on 1 June 2023, and the SFC's regime is newer in operational terms. The SFC has been deliberate about the pace of processing and the standard of approval. That deliberateness has two effects: the approval timeline is substantive, and the set of licensed operators is, at present, a relatively small and credentialled group. Membership of that group carries a signal value that may exceed what a Singapore licence alone provides in the Mainland-connected institutional market.

The Mainland dimension is important. Hong Kong is the gateway to the Mainland Chinese institutional market in a way that Singapore structurally is not. A licensed Hong Kong entity has a legal and regulatory posture that is recognisable to Mainland counterparties, Mainland-connected funds, and – to the extent that cross-border digital-asset activity becomes more formalised under the one country, two systems framework – to Mainland regulators. Singapore does not offer that positioning.

The decision matrix in practice runs as follows. A fintech group whose primary institutional target market is Southeast Asian or global-institutional will weigh Singapore heavily. A group whose commercial thesis depends on Mainland-connected capital flows, Greater Bay Area institutional clients, or distribution through Mainland-linked intermediaries will need Hong Kong in its licensing map, regardless of what it has in Singapore. The question is not either/or; it is sequencing and primary regulatory home.

Where does the regulatory risk sit now, and what is moving?

The risk, as at mid-2028, sits in three places. First, in the gap between a fintech entity's current activity and its licensing status. The SFC and HKMA have moved from a posture of policy development to a posture of active oversight and, where necessary, enforcement. An entity that was operating in a grey zone while the regime was being designed is now operating in a regulated zone with defined obligations. The grace period, to the extent one ever formally existed, is over.

Second, the risk sits in the stablecoin perimeter. The HKMA's fiat-referenced stablecoin licensing regime is new, and the market's understanding of its exact scope – which stablecoins, which issuers, which distribution activities – is still forming. Parties that issue, distribute, or facilitate settlement in fiat-referenced stablecoins in or from Hong Kong without having assessed their position under the HKMA regime are carrying a live regulatory-exposure risk. This is precisely the kind of window-closing moment where early engagement with counsel and then with the regulator produces a materially better outcome than a reactive response to a regulatory query.

Third, the risk sits at the intersection of the fintech entity's AML programme and the increasingly assertive approach of both the SFC and the HKMA to AML supervision. Both regulators have signalled that AML compliance is a substantive licence condition, not a box-ticking exercise. An entity whose AML programme has not kept pace with the growth of its transaction volume or the complexity of its counterparty base is operating with a programme that is underweight for its current risk profile.

Is there a structural fix that addresses all three risk points simultaneously? Not a single one. But the approach that our desk has seen work most consistently is a structured pre-application review: map the activity against the licensing perimeter, assess the group structure against the fit-and-proper standard, review the AML programme against the regulator's current guidelines, and file the application – or the regulatory engagement – from a position of documented readiness rather than reactive adjustment.

Our Tech & Web3 practice covers the full spectrum of licensing, AML, and structural work for virtual-asset and fintech entities in Hong Kong. For matters involving fund structures, see our analysis of a digital-asset fund structured through Hong Kong and the BVI. The specific AML obligations applicable to licensed virtual-asset service providers are addressed in our note on AML obligations for virtual-asset service providers.

What foreign counsel and founding teams consistently get wrong

Three patterns appear with predictable regularity in our cross-border practice. Each is correctable before engagement with the regulator; each is significantly harder to correct after.

The first is treating the licensing decision as a product-launch decision rather than an entity-level decision. A founding team that asks "do we need a Hong Kong licence for this product?" is asking the right commercial question but the wrong legal question. The legal question is whether the entity – as currently structured and as currently conducting its affairs – is within the regulatory perimeter. The answer depends on the entity's conduct, its users, its counterparties, and the nature of its assets, not on the product's marketing materials.

The second is underestimating the group-governance dimension of the fit-and-proper assessment. The SFC and HKMA are not licensing a product or a technology. They are licensing an entity, and they assess the entity in the context of its group. A Hong Kong applicant whose offshore parent has governance deficiencies, unresolved regulatory actions in another jurisdiction, or opaque beneficial ownership will carry those deficiencies into its Hong Kong application.

The third – and most consistently underestimated – is the AML source-of-funds file. The licensed entity must be able to produce a documented, coherent source-of-funds analysis for its own capitalisation. A fintech entity that raised capital in an early-stage round without investor onboarding documentation, or that received capitalisation from corporate vehicles without a clear beneficial-owner analysis, cannot produce that file retrospectively without significant remediation work. The time to build the file is at each funding stage, not at the licence application.

The myth that a light-touch offshore structure above a Hong Kong operating entity insulates the group from regulatory scrutiny is, in practice, the single most expensive misconception that fintech founders carry into their first Hong Kong regulatory engagement. The SFC and HKMA look through structures. The operating entity's regulatory obligations are determined by its conduct, not by the address of its parent.

Two scenarios from our desk

A Southeast Asian fintech group held through a Cayman parent with a Singapore operating entity sought to expand its centralised exchange function to Hong Kong users. The group had a Payment Services Act licence in Singapore but no Hong Kong regulatory engagement. An internal review had concluded – incorrectly, as it turned out – that the Singapore licence covered the Hong Kong activity because the platform was incorporated offshore. We were instructed to map the position. The SFC's conduct-based perimeter reached the group's Hong Kong-user business regardless of the corporate seat. The group restructured its user-access protocols and filed a VATP licence application in Hong Kong before any regulatory contact from the SFC. The process was managed from a position of disclosed, cooperative engagement rather than reactive correction.

In a separate matter, a European fintech group with a fiat-referenced stablecoin product sought to assess its position under the HKMA's emerging stablecoin regime in late 2024. The group's issuance structure ran through a Cayman special-purpose vehicle, and the stablecoin was pegged to a basket that included a Hong Kong-dollar component. Our desk reviewed the draft regulatory perimeter against the group's issuance documents and advised on the engagement strategy with the HKMA in advance of the regime's commencement. The group was positioned to engage with the regulator as an identified, compliant participant from the outset of the regime, rather than as an entity subsequently swept within it.

Related practices

Sanctions & AML – AML compliance, source-of-funds analysis and sanctions-neutral contracting for cross-border entities
Holding Structures – offshore and Hong Kong holding architecture, substance analysis and group governance

Frequently asked questions

Do I need a Hong Kong adviser for a fintech entity and regulatory engagement in Hong Kong?

A fintech entity engaging with the SFC or HKMA needs counsel with direct familiarity with the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, the Securities and Futures Ordinance, and the HKMA stablecoin regime – and with the cross-border dimension of holding structures above the Hong Kong operating entity. The regulator's assessment is substantive, and the quality of the engagement – the documentation presented, the structural decisions made before application – materially affects the outcome. International counsel working alongside locally licensed Hong Kong practitioners is the standard model for a group without an existing Hong Kong legal relationship.

What is the first step in a fintech entity and regulatory engagement in Hong Kong?

The first step is a licensing-perimeter assessment: determining which of the three primary instruments – the Anti-Money Laundering and Counter-Terrorist Financing Ordinance for VATP licensing, the Securities and Futures Ordinance for securities-qualified assets, and the HKMA stablecoin regime – applies to the entity's actual conduct and product. That assessment drives the entity structure, the AML programme design, and the regulatory engagement strategy. Filing without a prior perimeter assessment is the most common source of avoidable delay and remediation cost in our cross-border practice.

What does the route look like for a fintech entity and regulatory engagement in Hong Kong?

The route begins with the perimeter assessment and the group-structure review, moves to AML-programme design and source-of-funds documentation, and then to the licence application or pre-application engagement with the relevant regulator. For VATP licensing, the SFC process is substantive and sequential; the timeline depends on the complexity of the applicant's structure and the quality of the pre-application preparation. For the HKMA stablecoin regime, parties should verify the current commencement position and the applicable transitional arrangements before acting. Coordinated engagement – counsel-led, with the regulator approached from a position of documented readiness – consistently produces the most efficient outcome.

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.

Where a fintech entity and regulatory engagement in Hong Kong stands now