Reading the risk in structuring a Web3 business

Structuring a Web3 business through Hong Kong requires engagement with a mandatory licensing regime under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (the principal AML statute governing virtual-asset trading platforms), a parallel securities overlay administered by the Securities and Futures Commission (SFC, the statutory market regulator), and a stablecoin licensing regime that commenced in 2025 under the Hong Kong Monetary Authority (HKMA, the central banking authority). The risk is not theoretical. It is enforcement risk, and it sits at the point where the structure meets the regulator that actually applies.

This analysis sets out the commercial stakes, maps the governing instruments, reads the cross-border interface between Hong Kong and the principal offshore centres used above and alongside the Hong Kong operating entity, and gives our assessment of where the risk concentrates now. The practical sequence follows the argument.

What is actually at stake commercially?

A Web3 business is not a technology business in the way that description is sometimes used to deflect regulatory scrutiny. It moves value. It may issue instruments that are, in substance, securities. It may operate systems that function as exchanges or custodians. The commercial proposition – fast settlement, programmable assets, borderless distribution – is also the source of the regulatory friction.

For a group structuring through Hong Kong, the commercial stakes are threefold. First, a Hong Kong entity that touches virtual assets without the correct licensing faces enforcement action from the SFC, the HKMA, or both, depending on the asset type and the activity. Second, an offshore holding layer that is wrongly structured – whether in the Cayman Islands, the British Virgin Islands, or elsewhere – does not insulate the Hong Kong operating entity from its local obligations. Regulators look through the structure to the activity. Third, banking access, counterparty relationships and investor appetite all depend on demonstrable regulatory compliance. The licence is not a formality. It is the commercial prerequisite.

In our cross-border practice, we regularly advise groups that have built a sophisticated offshore holding architecture without addressing the Hong Kong regulatory layer. The commercial logic is not wrong. The sequencing is. The holding structure is meaningless if the operating entity cannot open accounts, onboard institutional counterparties, or demonstrate to a regulator that the activity is properly authorised.

What is the right question to ask before choosing Hong Kong as the operating hub? It is not whether Hong Kong is a favourable environment for Web3 – by most measures it is, and the legislative activity since 2022 reflects a considered policy choice. The right question is whether the specific activity of the business falls within the licensed perimeter, and which regulator holds the key.

The governing instruments and the regulatory perimeter

The mandatory licensing regime for centralised virtual-asset trading platforms commenced on 1 June 2023 under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, with the SFC as the licensing authority. Any platform that operates a centralised exchange for virtual assets – whether or not those assets are also securities – requires a virtual-asset trading platform (VATP) licence from the SFC.

The VATP perimeter covers centralised trading platforms. It does not, on its face, cover decentralised protocols. That distinction matters, but it is not stable. A protocol that retains administrative control over contract upgrades, fee collection, or user access may be characterised as centralised in substance, regardless of the label applied by its developers. Our desk sees this characterisation question regularly, and the honest answer is that the boundary is fact-specific and not yet settled by published regulatory guidance at the granular level that practitioners need.

Where a virtual asset is itself a "security" or "futures contract" within the meaning of the Securities and Futures Ordinance (the primary market-regulation statute), SFC licensing under that Ordinance also applies, in addition to the VATP regime. The two regimes overlap. A group that analyses only one of them takes an incomplete position.

For fiat-referenced stablecoins – instruments that maintain a peg to a fiat currency such as the United States dollar or the Hong Kong dollar – a separate licensing regime administered by the HKMA commenced in 2025. Parties should verify the current commencement date and perimeter before acting, because the regime's operational details continue to develop. What is clear is that issuing a fiat-referenced stablecoin in or from Hong Kong without the applicable authorisation is a regulatory breach, not a gap in the rules.

The Anti-Money Laundering and Counter-Terrorist Financing Ordinance also imposes customer due diligence (CDD) obligations and the FATF travel rule (the Financial Action Task Force standard requiring originator and beneficiary information to accompany virtual-asset transfers) on licensed VATPs. These are not administrative formalities. They are substantive obligations with criminal consequences for non-compliance. A structure that positions the Hong Kong entity as the VATP licensee must build those obligations into the operational model from day one.

How does the cross-border interface actually bite?

The interface between Hong Kong and the offshore centres is the point where most structuring errors concentrate. The typical architecture places a Cayman or BVI holding entity at the top, with a Hong Kong limited company as the VATP licensee or the principal operating entity. That architecture is not inherently wrong. The problem is what the group assumes the offshore layer does for it.

A Cayman or BVI holding entity does not exempt the Hong Kong operating subsidiary from Hong Kong regulatory obligations. It does not create a buffer against SFC or HKMA enforcement. It does not, by itself, provide a defensible position on source of funds, because the SFC and the HKMA look at the whole group when assessing fitness and propriety. Both offshore centres have economic-substance regimes that impose their own conditions on holding entities. A Cayman entity that holds the intellectual property or receives the fee income of a Hong Kong operating business must satisfy Cayman substance rules, which are a separate and parallel compliance obligation.

The question of which law governs a Web3 commercial agreement – a token purchase agreement, a liquidity provision arrangement, a protocol participation deed – is not resolved by choosing Cayman Islands law as the governing law and the Hong Kong courts as the dispute forum. Those choices are legitimate and frequently appropriate. But they do not determine which regulator applies to the activity. Regulatory jurisdiction follows the activity and the persons conducting it, not the governing-law clause.

A group with users or counterparties in Mainland China faces an additional layer. Mainland China's prohibition on virtual-asset trading and initial coin offerings applies to persons within China's regulatory jurisdiction. A Hong Kong VATP that onboards Mainland-resident individuals without appropriate controls runs the risk of regulatory exposure in both jurisdictions simultaneously. The cross-border interface here is not theoretical. It is a live enforcement point.

Consider a practical scenario. A technology group based in Central Asia established a Cayman holding entity, tokenised a real-world asset pool, and proposed to list the tokens on a Hong Kong-incorporated exchange platform (autumn 2026). The tokens had features that arguably made them securities under the Securities and Futures Ordinance. The group's view was that the Cayman holding structure placed the issuance outside Hong Kong's regulatory perimeter. That view was incorrect. The exchange platform, as the venue, was the relevant Hong Kong-nexus entity. Its obligations under both the VATP regime and the Securities and Futures Ordinance applied regardless of where the issuer was incorporated. We advised on the re-sequencing of the regulatory analysis before any listing application was made.

The comparative read: Hong Kong against the alternatives

Groups structuring a Web3 business through Hong Kong frequently benchmark against Singapore, the UAE and certain European Union member states. The comparison is useful, but it needs to be read accurately.

Singapore operates a licensing regime under its Payment Services Act for digital payment token services. The scope is different from Hong Kong's VATP regime: Singapore's approach distinguishes payment services from securities-dealing in a way that does not map directly onto Hong Kong's framework. A structure that is compliant in Singapore is not automatically compliant in Hong Kong, and vice versa. The two regimes must be read separately against the specific activity.

The UAE – principally the Dubai International Financial Centre and the Abu Dhabi Global Market – offers licensing regimes that are, in several respects, faster to complete and more permissive in their activity scope. The trade-off is that UAE-registered entities have less institutional recognition in Mainland-China-linked transactions, where counterparties and their banks often require a Hong Kong or Singapore entity as the contracting party. The choice of hub is therefore partly a function of where the client base sits.

Within the European Union, the Markets in Crypto-Assets Regulation (MiCA) creates a harmonised regime across member states. MiCA is relevant to groups with European distribution or a European investor base. It is not a substitute for Hong Kong licensing when the principal activity is in the Asia-Pacific corridor.

The honest read is that Hong Kong's licensing regime is more demanding in certain respects – particularly on AML obligations and the travel rule – than some competing centres. That is not an argument against structuring through Hong Kong. It is an argument for structuring correctly, with full regard to what the licence actually requires operationally. In our cross-border practice, we advise against a strategy of choosing the most permissive licensing environment as a means of reducing compliance costs. Regulators, banks and institutional counterparties now read licensing quality as a signal of group quality.

Where does the risk sit now?

Enforcement risk in Hong Kong's Web3 sector concentrates at three points: unlicensed activity, deficient AML controls, and inadequate source-of-funds documentation. Each of these is a function of structuring decisions, not of bad intentions after the fact.

Unlicensed activity is the clearest risk. A platform that operates without a VATP licence – whether because it misjudged the commencement date, misread the perimeter, or assumed its offshore structure provided insulation – is in breach from the moment the activity begins. The SFC has demonstrated willingness to take enforcement action, and the consequences extend to the individuals directing the activity, not only to the entity.

Deficient AML controls are a subtler risk, but in practice a more common one. A group that obtains the licence but builds its CDD and travel-rule infrastructure poorly creates a compliance liability that can take months or years to manifest. When it does, the remediation cost – in management time, legal costs and regulatory attention – is typically several multiples of the cost of building the controls correctly at the outset.

Source-of-funds documentation is the third concentration point, and it connects directly to the cross-border structure. A Hong Kong VATP licensee that receives capital from offshore entities without documented source-of-funds trails exposes the group to both AML liability in Hong Kong and – in the event of a dispute or regulatory inquiry – to an inability to demonstrate the legitimacy of the capital flows. The Cayman or BVI holding entity at the top of the structure must itself be able to produce source-of-funds documentation to the satisfaction of the Hong Kong regulator and the group's banking partners.

There is a second scenario that illustrates the enforcement dynamic. A European fund-of-funds invested in a Web3 protocol developer incorporated in the BVI, with a Hong Kong subsidiary providing technical services (early 2027). The Hong Kong subsidiary began taking a fee calculated by reference to protocol revenues. The SFC assessed that this arrangement brought the subsidiary within the VATP perimeter. The group had not obtained a VATP licence. We advised on the restructuring of the fee arrangement and the regulatory engagement strategy. The outcome was qualitatively favourable, but the process was materially more costly and time-consuming than a correct initial structure would have been.

The sequence-of-steps question – which licence first, which entity engages the regulator, which activity sits in Hong Kong versus offshore – is not a technical detail. It is the central strategic decision in a Web3 structuring exercise.

What foreign counsel and promoters consistently get wrong

The most common error we see is the conflation of incorporation jurisdiction with regulatory jurisdiction. A BVI or Cayman entity is incorporated outside Hong Kong. It is not regulated outside Hong Kong if the activity it conducts – or the activity conducted by its subsidiary – falls within the Hong Kong regulatory perimeter.

The second error is the assumption that a "technology services" characterisation of the business places it outside financial-services regulation. Regulators look at economic substance. A technology services company that runs the order book, controls the custodian keys, and distributes the settlement is a trading platform in substance, whatever the services agreement says.

The third error is treating the licensing timeline as a post-structuring step. In our cross-border practice, the licensing strategy must precede the finalisation of the holding structure, not follow it. The structure needs to be built around the licence requirements, not around the optimistic assumption that the licence will follow the structure.

The fourth – and in our experience the most consequential – error is underestimating the banking dependency. A VATP licence creates regulatory permission to operate. It does not create a bank account. Hong Kong banks conduct their own enhanced due diligence on VATP applicants and licensees, and a group that cannot demonstrate clean source of funds, credible AML infrastructure, and a coherent ownership structure will find banking access as difficult to obtain as the licence itself. The two processes need to run in parallel, not in sequence.

A group that has received advice from counsel in an offshore centre – counsel who are expert in that centre's corporate law but not in Hong Kong regulatory matters – often arrives with a holding structure that is internally coherent but externally incomplete. The holding structure works. The Hong Kong layer is the gap.

For groups that have already filed or structured and are finding the regulatory engagement more complex than anticipated, a second read of the position – mapping what has been done against what the applicable instruments actually require – is the practical starting point. If an earlier structure or filing produced an adverse or stalled outcome, identifying the strategic error early expands the routes still available.

The sequence above describes the standard risk position. Your matter turns on the specific activity, the entities actually conducting it, and the order in which the regulatory steps are taken – which is where the analysis is won or lost. To discuss how the licensing and AML regime applies to your cross-border structure, contact info@lockhartyip.com.

The interaction with tax and the holding structure

The foreign-sourced income exemption (FSIE) regime – the Hong Kong set of rules requiring economic substance for certain foreign-sourced passive income to remain tax-exempt in Hong Kong – applies to Web3 groups as it applies to any holding structure. A Cayman or BVI entity receiving royalty income, dividend income, or gains characterised as income from intellectual property must satisfy FSIE substance conditions if that income is remitted to or used in Hong Kong. The FSIE regime has been in force since 1 January 2023 and applies as amended.

For groups within the scope of Pillar Two – the global minimum tax framework applicable to multinational enterprise groups with consolidated revenue at or above EUR 750 million, effective for fiscal years beginning on or after 1 January 2025 – the Hong Kong minimum top-up tax and income inclusion rule create an additional layer of analysis. The interaction between the VATP licensing structure, the offshore holding layer, and the Pillar Two calculation is not something that can be approached as an afterthought.

Hong Kong operates on a territorial basis: profits tax applies to Hong Kong-sourced profits only. The two-tier rate – 8.25% on the first HK$2,000,000 of assessable profits, and 16.5% above – applies to corporations. There is no capital gains tax and no withholding tax on dividends or interest in the general position. That profile remains genuinely attractive for a Web3 operating entity, but only if the profits are correctly characterised as Hong Kong-sourced and only if the FSIE and Pillar Two conditions are satisfied where relevant.

The interaction between the licensing regime and the tax position needs to be modelled together. A structure that is optimised for tax but is incorrect on licensing, or correct on licensing but incomplete on FSIE substance, creates two separate compliance liabilities where one integrated analysis would have avoided both.

Our read and the next move

The regulatory environment for Web3 in Hong Kong is more mature than it was three years ago, and more demanding. The VATP regime is in force. The stablecoin regime is in force. The AML obligations are operational. The enforcement appetite of the SFC and the HKMA is demonstrated. That is not a hostile environment for a well-structured business. It is a demanding one.

The argument for Hong Kong as the operating hub for a serious Web3 group remains strong. The common-law system, English as an official language of the courts, the New York Convention framework for dispute resolution, the proximity to Mainland China capital flows, and the institutional infrastructure of the city all support that argument. The licensing regime, properly navigated, provides institutional credibility that offshore or lightly regulated centres cannot match.

What has changed is the tolerance for incomplete structures. The period during which a group could operate in or from Hong Kong without clear regulatory status – while arguing that the regime was still developing – is over. The regimes are now established. The analysis must be current, specific to the activity, and sequenced correctly.

Our assessment is that the risk concentration point for 2025 and beyond is not the initial licensing decision. It is the ongoing compliance infrastructure: AML controls, travel-rule implementation, source-of-funds documentation, and the annual regulatory engagement that a licence requires. Groups that obtained a VATP licence early but under-invested in the operational compliance layer will face that risk first.

For cross-border groups that have not yet structured, the correct sequence is: regulatory analysis of the specific activity first; holding structure second; banking strategy third; licensing application fourth. Any other order creates a structure that needs to be rebuilt. Rebuilding is possible. It is more expensive than building correctly.

For a preliminary read on your Web3 structure and the licensing route, write to us at info@lockhartyip.com.

Related practices

Tech & Web3 – licensing, AML and cross-border structuring for virtual-asset businesses
Sanctions & AML – compliance file preparation and counterparty due diligence across jurisdictions
Holding Structures – offshore holding architecture reviewed against substance and FSIE requirements

Frequently asked questions

Which jurisdiction's law applies to structuring a Web3 business through Hong Kong?

Regulatory jurisdiction follows the activity, not the governing-law clause. A Hong Kong-incorporated entity conducting virtual-asset trading platform activity falls under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance and, where the asset is a security, the Securities and Futures Ordinance, regardless of whether the holding entity is Cayman or BVI incorporated or the commercial agreements provide for a different governing law. The governing-law clause in a token purchase agreement or protocol document determines private-law disputes between parties; it does not determine which regulator applies to the conduct of the business. Groups with users or counterparties in Mainland China face a concurrent regulatory position that requires separate analysis.

How long does structuring a Web3 business through Hong Kong usually take?

The timeline depends on the complexity of the activity and the state of the group's AML and compliance infrastructure at the point the licensing application is prepared. A VATP licence application under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance requires detailed documentation of the applicant's systems, controls, beneficial ownership and source of funds. The SFC's review process is not a fixed statutory period, and processing times vary with the regulatory pipeline and the completeness of the application. Concurrently, establishing banking relationships and building the travel-rule infrastructure each require their own lead times. Parties should plan for the full process to span several months from initial regulatory analysis to operational readiness, and should verify current SFC timelines before committing to a launch schedule.

How does the cross-border element affect structuring a Web3 business through Hong Kong?

The cross-border structure – typically a Cayman or BVI holding entity above a Hong Kong operating company – does not reduce the Hong Kong operating entity's regulatory obligations. The SFC and the HKMA assess fitness and propriety at the group level, which means the offshore holding layer and its source of funds are within scope. Separately, the offshore entities face their own economic-substance requirements under Cayman and BVI rules. A group with Mainland-resident users must also address the Mainland's position on virtual-asset trading, which creates concurrent exposure. The cross-border interface is therefore simultaneously a structuring question, a compliance question, and a banking question, and each of those dimensions must be addressed before the Hong Kong entity commences regulated activity.

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.

Reading the risk in structuring a Web3 business through Hong Kong