Where a stablecoin or digital-asset custody arrangement stands now

The commercial logic behind stablecoin issuance and digital-asset custody looked straightforward two years ago: a fiat-pegged token reduces settlement friction, and a licensed custodian sitting in a credible common-law hub gives institutional counterparties the comfort they need to participate. The regulatory position, however, has moved faster than most structures anticipated. For groups with Hong Kong as their forum or operating hub, the question is no longer whether regulation applies but which regime, which regulator, and what the cross-border interface does to a custody or issuance arrangement that was built before the rules crystallised.

A stablecoin or digital-asset custody arrangement operating in or through Hong Kong is now subject to a layered regulatory regime administered by two distinct authorities – the Hong Kong Monetary Authority for fiat-referenced stablecoin issuance, and the Securities and Futures Commission for virtual-asset trading platform licensing and custody activities that touch securities-class assets – each carrying its own anti-money-laundering obligations under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, effective from the commencement of the virtual-asset trading platform regime on 1 June 2023.

This analysis covers the commercial stakes, the governing instruments by name, the cross-border interface between Hong Kong and the principal counterparty jurisdictions our desk sees, and our read on where the risk sits now for groups caught between an older structure and a regime that has since changed underneath them.

What is actually at stake commercially for an issuer or custodian?

The market question is straightforward. Institutional treasury teams, payment operators and digital-asset funds want a credible legal ring around the assets they hold or the tokens they issue. Without that ring – a licensed custodian, a regulated issuance vehicle, a clear legal characterisation of the token – the counterparty due-diligence process stalls, banking relationships remain precarious, and the structural benefit of the arrangement collapses.

In our cross-border practice, we regularly see three commercial configurations where the regulatory exposure is acute. First, a group that issues a fiat-referenced stablecoin through a Hong Kong entity and settles against a Mainland or Southeast Asian counterparty. Second, a digital-asset fund or treasury that uses a third-party custodian in Hong Kong as its prime custody layer, with assets also held at offshore nodes in the British Virgin Islands or the Cayman Islands. Third, a payment operator that routes stablecoin settlements through a Hong Kong entity without having assessed whether that activity constitutes dealing in a "specified stablecoin" under the emerging Hong Kong Monetary Authority regime.

Each configuration carries a different regulatory footprint. The common thread is that the licensing status of the Hong Kong entity determines whether the arrangement is commercially viable for the institutional counterparties who will review it.

What does that mean in practice? It means that a group whose custody or issuance arrangement was assembled before 1 June 2023 – when mandatory licensing for centralised virtual-asset trading platforms commenced – is now operating with a compliance file that does not reflect the current regulatory requirements. The gap between the old structure and the new rules is where enforcement exposure concentrates.

The governing instruments: which regime applies and who administers it?

Two regulatory regimes govern digital-asset custody and stablecoin activity in Hong Kong, and they do not map onto each other neatly. Getting the characterisation wrong at the outset is the most common structural error we see.

The first regime covers centralised virtual-asset trading platforms and associated custody. Under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, as amended to introduce the virtual-asset service provider framework, any person who operates a centralised virtual-asset trading platform in Hong Kong – or actively markets such services to Hong Kong investors – requires a licence from the Securities and Futures Commission. The regime commenced on 1 June 2023. Custody activities associated with a licensed virtual-asset trading platform fall within that licensing perimeter. The Anti-Money Laundering and Counter-Terrorist Financing Ordinance also imposes customer due-diligence obligations, the travel rule (the FATF requirement that originator and beneficiary information accompanies virtual-asset transfers above the applicable threshold), and ongoing transaction-monitoring requirements on all licensed entities.

The second regime covers fiat-referenced stablecoin issuance. The Hong Kong Monetary Authority has introduced a licensing regime for issuers of fiat-referenced stablecoins (tokens pegged to one or more fiat currencies and designed to maintain a stable value by reference to those currencies). That regime commenced in 2025. Parties should verify the current commencement date and the precise scope of the perimeter before relying on this position, as transitional provisions and implementation details remain subject to official confirmation.

The overlap between the two regimes matters. Where a fiat-referenced stablecoin is also characterised as a "security" or "futures contract" under the Securities and Futures Ordinance, the Securities and Futures Commission's jurisdiction is engaged concurrently. A stablecoin issued in a form that gives holders an economic interest in a pool of assets, for instance, may well satisfy the definition of a collective investment scheme under the Securities and Futures Ordinance. At that point, the group faces a dual-regulator position: Hong Kong Monetary Authority for the issuance perimeter, Securities and Futures Commission for the securities characterisation. That dual exposure is not hypothetical. Counsel on our desk regularly encounter structures where the token documentation does not clearly address the characterisation question, and where the issuer has assumed that a stable price means a non-security instrument.

For custody specifically, the question is whether the custodian holds the assets on behalf of a licensed virtual-asset trading platform, on behalf of a fund or institutional client, or in a proprietary capacity. Each relationship carries a different set of obligations. A standalone digital-asset custodian that does not operate a trading platform may fall outside the virtual-asset trading platform licensing requirement but remains subject to general anti-money-laundering obligations and, depending on the asset class and structure, to the Securities and Futures Ordinance's provisions on regulated activities. The governing analysis runs from the asset characterisation first, then to the activity, then to the applicable licensing gateway.

How does the cross-border interface between Hong Kong and the Mainland or offshore centres affect the arrangement?

Hong Kong implements United Nations sanctions and does not give domestic effect to unilateral measures of other states. That position is well-established and shapes the compliance calculus for groups with counterparties in jurisdictions that are subject to unilateral measures by other states but not to United Nations-mandated restrictions. For a stablecoin issuer or custodian, the practical consequence is that a transaction flow that is permissible under Hong Kong's sanctions posture may be impermissible under the unilateral measures of a third jurisdiction whose law also has a claim on the group's activity – through the location of a node operator, a server, a correspondent bank, or an investor.

The Mainland interface raises a separate set of questions. Virtual-asset trading and certain token-issuance activities remain restricted for Mainland participants under Mainland rules. A Hong Kong-based custodian or issuer that serves Mainland-connected clients must therefore assess whether the arrangement constitutes a prohibited offering or service when viewed from the Mainland side, regardless of the Hong Kong regulatory status of the activity. This is not a question that the Hong Kong licensing regime resolves. It is a question for specialist Mainland-law analysis, conducted alongside the Hong Kong regulatory review.

For groups using BVI or Cayman entities above a Hong Kong operating entity – the most common configuration in the funds and treasury space – the economic-substance requirements of those offshore jurisdictions are now a standing compliance obligation. A BVI entity that issues a stablecoin or holds digital assets as its primary activity needs to satisfy the BVI's economic-substance test for the relevant category of business. The BVI Business Companies Act framework and the associated substance regulations impose a reporting obligation; failure to satisfy it exposes the entity to regulatory action in the BVI and, as a practical matter, undermines the structural rationale for using the offshore entity in the first place. The same point applies to Cayman Islands structures.

Consider a mid-market configuration our desk has seen: a Southeast Asian payment operator uses a BVI holdco above a Hong Kong operating entity to issue a fiat-referenced stablecoin for cross-border trade settlements between Southeast Asian exporters and Mainland importers. The Hong Kong entity is the issuer and the liquidity manager. The BVI holdco holds the reserve assets. The arrangement worked commercially before the Hong Kong Monetary Authority stablecoin regime commenced. After commencement, the Hong Kong entity is prima facie within the licensing perimeter, the BVI holdco faces substance questions about the nature of its reserve-management activity, and the Mainland-connected payment flows require a separate analysis of Mainland restrictions. All three dimensions need to be addressed in sequence; none of them resolves the others.

The enforcement point follows. If the Hong Kong entity is unlicensed when a licence is required, the arrangement is not merely non-compliant; it creates a regulatory exposure that affects every counterparty who has relied on the Hong Kong entity's status. Banking relationships, correspondent accounts, and institutional investor agreements commonly contain representations about licensing status. A breach of those representations can unwind an entire commercial relationship, not just the specific transaction in question.

For guidance on structuring a digital-asset fund using Hong Kong and Mainland access, see our analysis of digital-asset fund structures through Hong Kong and the Mainland. Separately, platform operators with data flows across the region should review the position on data transfer and privacy terms for Asia-facing platforms.

The sequence above describes the standard position. Your matter turns on the token documentation, the jurisdictions actually engaged by the distribution and custody flows, and the order in which the regulatory steps are taken – which is where the analysis is won or lost.

For a preliminary read on your stablecoin or custody arrangement and the applicable licensing perimeter, email info@lockhartyip.com.

Comparative read: how does Hong Kong's approach differ from the principal alternative centres?

The relevant comparators for an institutional group choosing a hub for stablecoin issuance or digital-asset custody are Singapore, the UAE, and – for groups with a European investor base – the EU under the Markets in Crypto-Assets Regulation (the EU's comprehensive regulatory regime for crypto-asset issuers and service providers, which became fully applicable in 2024). Each offers a different risk-benefit profile. The right choice depends on where the counterparties sit, where the assets are held, and where the group can satisfy substance requirements.

Singapore's framework for digital payment token services and custody requires licensing under the Payment Services Act from the Monetary Authority of Singapore. The regime is substantively similar to Hong Kong's in its customer-due-diligence and travel-rule obligations, but the licensing scope and the categorisation of stablecoins differ in detail. A group that is licensed in Singapore but operates a distribution or custody node in Hong Kong does not thereby acquire Hong Kong licensing status. The two regimes are concurrent, not mutually recognising.

The UAE – specifically the Abu Dhabi Global Market and the Dubai Financial Services Authority – has moved quickly to provide a licensing pathway for virtual-asset service providers and stablecoin issuers. For groups with a Gulf investor base or Middle Eastern payment flows, the UAE hub can be the primary regulatory perch. But the enforcement and legal-system questions – including the question of how an award or judgment obtained in Abu Dhabi or Dubai is recognised and enforced in Hong Kong or on the Mainland – require separate analysis. Hong Kong's common-law courts and the mechanisms available under the Mainland Judgments in Civil and Commercial Matters (Reciprocal Enforcement) Ordinance (Cap. 645), in force since 29 January 2024, provide a well-tested enforcement route for monetary and certain non-monetary judgments; that route is not available for UAE judgments without an additional step through the common-law recognition process.

Hong Kong's advantage in the comparative read is its combination of a mature common-law system, direct access to Mainland enforcement mechanisms, a clear two-regulator structure that the market understands, and a sanctions posture that is defined by United Nations obligations rather than unilateral extensions. For groups whose primary commercial flows run through Greater China and Southeast Asia, that combination is difficult to replicate from a purely offshore base.

What Hong Kong does not yet offer is a fully operational stablecoin-issuer licensing process with a settled track record of licence grants and supervisory guidance. The Hong Kong Monetary Authority regime is recent, and the first cohort of licensed issuers is still being established. That transitional uncertainty is a real risk factor for a group that needs to be able to represent to counterparties – today, not in eighteen months – that it holds a valid licence in good standing. Parties should verify the current state of the licensing process before acting on any assumption about timelines or scope.

Where does the risk sit now, and how has it shifted?

Our read, based on experience across the cross-border digital-asset space, is that the risk profile for stablecoin and custody arrangements has shifted from structural risk to operational risk. The structural question – whether to use Hong Kong, whether to place a BVI holdco above the operating entity, whether to characterise the token as a security – was the dominant concern three years ago. Those questions are not resolved, but the more immediate exposure now is operational: a licensed entity that fails its travel-rule obligations, a custody arrangement whose client-asset segregation documentation does not satisfy the regulator's expectations, or a stablecoin issuer whose reserve management is not conducted by the licensed entity but by an affiliated vehicle that sits outside the licensing perimeter.

The Anti-Money Laundering and Counter-Terrorist Financing Ordinance's customer due-diligence obligations apply to every licensed virtual-asset service provider from the first transaction. There is no grace period for anti-money-laundering compliance. A custodian that onboards a client without completing the applicable customer due-diligence process – enhanced due diligence where the counterparty is in a high-risk category or the source of funds is not clearly established – creates an immediate regulatory exposure. That exposure is not confined to the specific transaction; it creates a pattern that can inform a broader regulatory review.

The travel rule is a distinct operational challenge for the digital-asset space. Unlike a traditional wire transfer, a blockchain transaction does not automatically carry originator and beneficiary information in a form that satisfies the FATF travel-rule standard. Licensed virtual-asset service providers in Hong Kong are required to implement technical and procedural solutions to capture and transmit the required information. For a custodian receiving assets from a counterparty in a jurisdiction that does not have a functionally equivalent travel-rule obligation – or from a counterparty whose own compliance systems do not generate the required data – the receiving entity faces a judgement call about whether to proceed with the transaction or request additional information. Getting that call systematically wrong is an enforcement risk.

The second area of shifting risk is the reserve-management position for stablecoin issuers. A fiat-referenced stablecoin is only as credible as its reserve. Under the Hong Kong Monetary Authority regime, an issuer is expected to hold reserves in qualifying assets at a level that matches the outstanding token supply. If the reserve assets are held by an entity other than the licensed issuer – a common structure, particularly where a BVI or Cayman holding entity manages the investment side – the issuer's control over those assets and its ability to meet redemption obligations is a live regulatory question. Reserve management by an affiliated but unlicensed entity outside Hong Kong does not eliminate the issuer's obligation to demonstrate control; it complicates the demonstration.

A mid-cap European fintech group with a Hong Kong issuance entity and a Cayman-domiciled reserve manager approached our desk in early 2025. The structure had been assembled with a view to the earlier, pre-commencement position. After the Hong Kong Monetary Authority regime commenced, the question was whether the Cayman entity's reserve-management activities needed to be brought inside the Hong Kong perimeter or whether the current structure could be sustained with enhanced documentation. We reviewed the contractual architecture between the two entities, assessed the control and segregation of the reserve assets against the regulatory expectations, and identified two structural adjustments that reduced the exposure without requiring a full restructuring of the Cayman entity. The arrangement is now the subject of a regulatory engagement with the Hong Kong Monetary Authority. The outcome of that engagement will determine the final structural position.

If an earlier filing, structure or enforcement attempt produced an adverse or stalled result, a second read can identify the strategic error and the routes still open. Contact info@lockhartyip.com to discuss.

What foreign counsel and in-house teams commonly get wrong

Experience before the Hong Kong regulators and in our cross-border advisory practice identifies a consistent set of errors that teams bring to us after the fact – typically when a regulatory query has arrived or a counterparty is asking questions the group cannot answer.

The first error is treating the Hong Kong licensing position as settled because the group has a licence in another jurisdiction. Singapore, the UAE, and Hong Kong do not operate a mutual-recognition regime for virtual-asset service providers or stablecoin issuers. A group that is licensed in Singapore and begins custody or issuance activity in Hong Kong – including by operating servers or engaging clients there – is not covered by its Singapore licence for Hong Kong regulatory purposes. The analysis of whether the Hong Kong activity triggers the licensing requirement runs independently of the offshore position.

The second error is conflating the anti-money-laundering obligations of the licensed entity with the general corporate governance of the group. Anti-money-laundering compliance under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance is an obligation of the licensed entity, managed by its designated compliance officer (the individual responsible within the licensed entity for the AML programme). It cannot be outsourced to a group function that sits in a different jurisdiction or delegated to a third-party service provider without the licensed entity retaining the control and oversight obligations that the Ordinance requires. Where the compliance function is effectively operated from outside Hong Kong – a common arrangement for groups that have centralised their compliance teams in a European or Singaporean hub – the regulatory position of the Hong Kong entity is exposed.

The third error is assuming that a stablecoin is outside the securities regulatory perimeter because it maintains a stable price. The test under the Securities and Futures Ordinance is not price stability; it is the legal characterisation of the instrument and the rights it confers. A stablecoin that gives holders a right to participate in a pool of reserve assets, a right to income from those assets, or a right to vote on the management of the issuer may well satisfy the definition of a collective investment scheme or a structured product. The characterisation analysis requires a review of the token documentation, the smart-contract mechanics, and the commercial arrangements between the issuer and the holders. That review is often not conducted until after the token has been distributed, which is too late.

For an overview of the firm's full practice across the digital-asset and Web3 space, including licensing strategy and AML programme review, visit our Tech & Web3 practice page.

Decision read: situation, instrument, route, risk

The analytical matrix for a group assessing its stablecoin or custody position runs as follows.

A group that operates a centralised virtual-asset trading platform in Hong Kong and provides custody to platform users is squarely within the virtual-asset trading platform licensing regime under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance. The route is a licence application to the Securities and Futures Commission. The timing depends on the completeness of the application and the state of the group's compliance programme at the date of submission. The risk of operating without a licence while the application is pending is a live enforcement exposure; the group should take legal advice on whether a transitional or grace period applies to its specific situation before the commencement date.

A group that issues a fiat-referenced stablecoin from a Hong Kong entity is within the Hong Kong Monetary Authority licensing perimeter. The route is a licence application to the Hong Kong Monetary Authority, with a reserve management and redemption framework that satisfies the regulatory expectations for the qualifying-asset composition and the segregation of reserve assets. The risk of operating without a licence is equivalent to the trading-platform position: a group should verify whether any transitional arrangement applies, and should not assume that pre-commencement activity confers a continuing right to operate.

A group whose stablecoin may also satisfy the definition of a security or a collective investment scheme under the Securities and Futures Ordinance faces a concurrent obligation to the Securities and Futures Commission. The route involves both a characterisation analysis and, if the instrument is a security, a licensing or authorisation step under the Securities and Futures Ordinance in addition to the Hong Kong Monetary Authority licence. The risk of mischaracterising the instrument – treating it as outside the securities perimeter when the analysis would support the contrary conclusion – is not merely a technical deficiency. It is a misrepresentation to the counterparties, investors, and banking relationships that rely on the group's representation of its regulatory status.

A standalone custodian – one that holds digital assets for institutional clients but does not operate a trading platform and does not issue a stablecoin – occupies a more nuanced position. Where the assets are securities-class digital assets, the custody activity is a regulated activity under the Securities and Futures Ordinance. Where the assets are non-securities virtual assets held through a centralised platform, the virtual-asset trading platform licensing analysis applies to the custody function. Where the assets are non-securities virtual assets held in a purely bilateral arrangement between the custodian and the client, without a platform intermediating the relationship, the licensing question requires careful analysis on the specific facts. A standalone custodian in this last category remains subject to the Anti-Money Laundering and Counter-Terrorist Financing Ordinance's customer due-diligence and travel-rule obligations regardless of its licensing status.

Our view on where the risk is heading

The regulatory trajectory in Hong Kong is toward consolidation and enforcement, not continued toleration of unlicensed activity. The period between the commencement of the virtual-asset trading platform regime in June 2023 and the operational establishment of the stablecoin licensing regime in 2025 has been one of transition. That transition period is closing.

Based on our read of the regulatory direction and our experience in the cross-border digital-asset space, we expect the next phase to be characterised by two developments. First, active supervisory engagement with licensed entities on the quality of their compliance programmes – particularly anti-money-laundering controls, travel-rule implementation, and client-asset segregation. The licensing step is the gateway; the compliance programme is the substance. A licensed entity with a deficient compliance programme is not in a materially better regulatory position than an unlicensed entity; it is in a worse one, because the regulator has both jurisdiction and access.

Second, attention to the boundary between licensed and unlicensed activity within group structures. Where a licensed Hong Kong entity is supported by offshore affiliated entities – a Cayman reserve manager, a BVI token issuer, a Singapore-based compliance function – the question is whether the licensed entity's regulatory obligations are being met by the group structure as a whole, or whether the offshore entities are effectively performing functions that the licensed entity is required to perform itself. That question will be asked by the Hong Kong Monetary Authority and the Securities and Futures Commission as supervisory capacity matures.

For groups that have already licensed a Hong Kong entity, the priority is now an internal compliance review: does the compliance programme as actually operated match the compliance programme as documented? For groups that are still in the pre-licensing phase, the priority is the characterisation analysis: which regime applies, which regulator is the primary counterpart, and what is the sequence of steps to reach a fully licensed position.

Neither of those exercises is straightforward on a cross-border structure. But the cost of getting it wrong – measured in regulatory exposure, banking access, and counterparty confidence – is now material. The window for treating the licensing position as a future problem rather than a present one is substantially closed.

Related practices

• Sanctions & AML – AML programme review, travel-rule compliance, and counterparty due-diligence structuring for virtual-asset businesses
• Holding Structures – BVI, Cayman and Hong Kong holding architectures above digital-asset operating entities

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

Related

• Tech Web3
• Digital Asset Fund Structured Through Hong Kong Mainland 6
• Data Transfer Privacy Terms Asia Facing Platform

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.