Where structuring a Web3 business through Hong Kong stands now

Structuring a Web3 business through Hong Kong today means engaging a mandatory licensing regime under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, a parallel licensing track under the Securities and Futures Ordinance where the virtual asset qualifies as a security, and an emerging stablecoin-issuer regime administered by the Hong Kong Monetary Authority – all against a common-law backdrop that gives the jurisdiction its enforceability advantage across the region. The structural question is no longer whether to engage the regulatory perimeter; it is how to engage it in a sequence that does not foreclose the commercial options a cross-border business actually needs.

This analysis sets out the current position, the cross-border interface between Hong Kong and the principal offshore structures that most Web3 groups use, the risk points our desk sees with regularity, and a read on where the exposure is concentrated now. It is structured for a general counsel or founding principal who has moved past the orientation stage and is weighing execution options.

What is actually at stake commercially

The commercial case for Hong Kong has never rested on regulatory lightness. It rests on enforceability, common-law courts, a convertible currency, and a jurisdiction that sits at the intersection of Mainland Chinese capital and international counterparties. For a Web3 business, those features are load-bearing in a way they are not for a purely digital-first operation that could in theory sit anywhere.

A centralised virtual-asset trading platform wants counterparties – institutional, wholesale, and eventually retail – who will transact only through a licensed and auditable venue. A token issuer wants its instruments recognised as having been issued in a jurisdiction with defined legal consequences. A stablecoin operator needs a credible regulatory relationship with a monetary authority that commands recognition across Asian financial centres. None of those things is achievable from a bare BVI or Cayman structure operating without a licensed Hong Kong entity in the group.

The structural question, then, is which entity in the group holds the licence, what that entity's relationship is to the offshore holding layer, and how the group's capital, revenue and compliance obligations flow between them. That is the question our cross-border practice handles most frequently in this space. Getting the entity map wrong in the pre-licensing phase creates problems that are expensive to unwind: regulatory attribution, AML records, and source-of-funds documentation attach to the entity, not to the beneficial owner, and an entity substitution mid-application is not a neutral act in the eyes of the Securities and Futures Commission.

What does the governing regime actually require?

The mandatory licensing regime for centralised virtual-asset trading platforms commenced 1 June 2023 under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, with the Securities and Futures Commission as licensing authority. Any person operating or actively marketing a centralised virtual-asset trading platform in or from Hong Kong – the "in or from" formulation is critical for offshore groups with Hong Kong-based personnel or marketing activity – requires a licence under that ordinance.

The regime carries a customer due diligence obligation, a travel-rule obligation for virtual-asset transfers consistent with the Financial Action Task Force standards, and a suite of operational requirements covering custody, insurance, governance and reporting. These are not light-touch conditions. A group that has operated without a compliance infrastructure – as many early-stage Web3 businesses have – will need to build one before a licence application is viable, not during the application process.

Where a virtual asset also qualifies as a "security" or a "futures contract" under the Securities and Futures Ordinance, the Securities and Futures Commission licensing obligation runs in parallel, not as an alternative. This dual-track exposure is one of the points that foreign counsel most frequently underestimate. The analysis of whether a token is a security is fact-specific and turns on the economic rights the token confers, the manner of its distribution, and the marketing representations made at the time of issue. We return to this below.

The stablecoin regime – specifically, a Hong Kong Monetary Authority licensing regime for fiat-referenced stablecoin issuers – commenced in 2025. Parties considering a stablecoin issuance or acquisition of a stablecoin-issuing entity should verify the current commencement date and precise perimeter before structuring, as the detail of the licensing conditions was subject to evolution through the consultation and legislative process.

How does the cross-border interface actually bite?

Most Web3 groups approaching Hong Kong arrive with an existing structure: a BVI or Cayman holding company, an operating entity in a third jurisdiction, and a founding team whose personal tax residence may be anywhere from Singapore to the United Arab Emirates. The Hong Kong licensing question sits on top of that existing architecture, and the interaction is where the structural complexity concentrates.

Consider the most common pattern. The Cayman entity is the group holding company. A BVI subsidiary holds the intellectual property and the token treasury. A newly formed Hong Kong company is intended to be the licensed operating entity. The question immediately becomes: how does revenue flow from the licensed Hong Kong entity back to the Cayman holding layer without creating a Hong Kong tax event, a transfer-pricing problem, or a deemed-conduct-in-Hong-Kong issue for the entities upstream?

Hong Kong's territorial tax system – profits tax applies to Hong Kong-sourced profits at 8.25% on the first HK$2,000,000 of assessable profits and 16.5% above that – creates a defined environment for this analysis. Revenue generated by a Hong Kong-licensed entity from activities conducted in Hong Kong is taxable in Hong Kong. Revenue generated outside Hong Kong by an entity that does not carry on business in Hong Kong is generally not. The structuring question is whether the offshore entities are genuinely operating offshore – with substance, decision-making and execution – or whether they are nominal wrappers for activity that is in practice conducted from Hong Kong.

This is not a theoretical concern. The Inland Revenue Department applies a facts-and-circumstances analysis to source-of-profits questions, and the foreign-sourced income exemption regime that applies from 1 January 2023 imposes economic-substance conditions on passive income flowing to Hong Kong entities from offshore group members. For a Web3 group, where the distinction between "managing the platform" and "carrying on the business" can collapse quickly, the substance point is one of the first things our desk maps in the structuring phase.

The Pillar Two implications are relevant for larger groups. The Hong Kong minimum top-up tax and income inclusion rule apply to in-scope multinational enterprise groups with consolidated revenue at or above EUR 750 million, for fiscal years beginning on or after 1 January 2025. Most early-to-mid-stage Web3 businesses will not be in scope by revenue threshold, but acquisition or investment by a larger corporate group can bring the target into scope at the group level.

The token classification question: where the analysis turns

Token classification is the most consequential analytical step in the structuring process, and it is one that cannot be resolved by commercial assumption or analogy to a previous issuance. The Securities and Futures Commission has been explicit that it approaches classification on a substance-over-form basis.

A token that represents a fractional interest in a revenue-generating pool, entitles the holder to distributions linked to enterprise performance, or is marketed with reference to the expectation of profit from the efforts of a third party is likely to be treated as a collective investment scheme interest or a security. The consequence is not merely a licensing obligation; it is that the issuance, the distribution arrangements, and the secondary trading venue all become regulated activities requiring authorisation. An offshore issuance does not resolve this if the offer is made to persons in Hong Kong or if the marketing activity is conducted from Hong Kong.

A token that confers only utility – access to a defined service, a discount against a service fee, a governance vote over protocol parameters that does not carry economic rights – sits in a different position. But the utility/security boundary is contested and the Commission has not provided bright-line guidance in a form that removes the analytical burden from issuers and their advisers.

The practical consequence is that a token classification opinion, prepared before structuring and updated before any distribution, is not a formality. It is the document that determines which licensing tracks apply, which offshore distribution routes are available, and what the group's ongoing compliance obligations look like. We have seen groups proceed to structure on the basis of an informal view that their token was "utility" and discover, when the application stage arrived, that the Commission read the economic rights in the same instrument differently.

What foreign counsel and founders most commonly get wrong

In our cross-border practice, the errors that create the most durable structural problems fall into a short and consistent list. They are not exotic mistakes. They are the predictable consequences of analysing the Hong Kong position through a lens built for a different jurisdiction.

The first is treating the offshore holding layer as regulatory insulation. It is not. The "in or from Hong Kong" formulation in the Anti-Money Laundering and Counter-Terrorist Financing Ordinance reaches actively through an offshore entity whose operations, personnel or marketing activity are conducted from Hong Kong. A BVI entity whose sole director is resident in Hong Kong, whose website is operated from Hong Kong, and whose client communications are handled from a Hong Kong office is not operating from the BVI in any sense the Commission will accept.

The second is underweighting the AML/travel-rule infrastructure requirement. Founders of technology businesses often treat compliance as a downstream concern – something to address once revenue is established. In a regulated virtual-asset environment, that sequencing is reversed. The customer due diligence programme, the transaction monitoring system, and the travel-rule implementation must be in place before the licence application is filed. A post-filing compliance build, or a compliance infrastructure that is nominal at the application stage, will not survive the Commission's review.

The third is failing to account for the cross-border implications of the Significant Controllers Register requirement. Hong Kong-incorporated companies have been required to maintain a Significant Controllers Register since 1 March 2018. For a Web3 group with a complex token-holder base and a multi-layered offshore structure, identifying and documenting the significant controllers in a form that satisfies the requirement is not a clerical exercise. It is an exercise that requires both the corporate and the AML analysis to be coordinated.

The fourth – and perhaps the most commercially consequential – is proceeding with the entity map before the token classification analysis is complete. The entity that holds the licence, the entity that issues the token, and the entity that operates the treasury are not necessarily the same entity, and the relationships between them have regulatory and tax consequences that differ depending on which entity does which thing. Sequencing the structure before the classification analysis is done is the single most common error our desk encounters in this practice area.

A cross-border micro-scenario: the offshore-plus-licensed entity model

An Asia-based founding team with an existing Cayman holding structure and a BVI intellectual-property vehicle approached our desk in late 2026. They were preparing a licensing application for a centralised virtual-asset trading platform in Hong Kong and had been advised by their formation agent that a new Hong Kong subsidiary of the Cayman holding company would suffice as the licensed entity.

The problem our analysis identified was not the entity form. It was the flow of obligations between layers. The token treasury sat in the BVI entity. The platform's trading revenue was intended to be charged to the licensed Hong Kong entity at cost-plus, with the margin sitting offshore. The Cayman holding entity provided management services to the Hong Kong company and charged a management fee.

Each of those flows created a distinct issue. The BVI treasury arrangement raised a source-of-funds question for the Commission's purposes, because the platform's liquidity provision came from the BVI entity, and the basis on which that liquidity moved to and from the Hong Kong licensed entity was not documented. The cost-plus arrangement was not well-supported by any transfer-pricing analysis. The management fee arrangement was potentially attributable to the Hong Kong entity under the territorial-source analysis.

We re-sequenced the entity relationships, prepared a transfer-pricing policy for the intercompany arrangements, and documented the source-of-funds position for the liquidity flows before the application was filed. The Commission's review of the application proceeded without the objections that would have arisen had those flows been presented without documentation. The lesson for similarly situated groups is that the licensing application is not the first point at which the intercompany arrangements are reviewed; it is the first point at which a regulator reviews them, and the regulator's review is less forgiving than a pre-application internal assessment.

For a structured assessment of your entity map and the cross-border licensing implications across Hong Kong and the relevant offshore centres, write to us at info@lockhartyip.com.

A second cross-border micro-scenario: the stablecoin issuer seeking to re-domicile

A mid-size stablecoin operator incorporated in a European jurisdiction came to our desk in early 2027. They had received interest from institutional counterparties in the Greater Bay Area and in Southeast Asia. Their existing entity was licensed in its home jurisdiction, but that licence was not recognised in Hong Kong, and the marketing activities their regional sales team was conducting from a Hong Kong office had not been mapped against the "in or from Hong Kong" perimeter.

The Hong Kong inward company re-domiciliation regime – which commenced in 2025 and allows an eligible non-Hong Kong company to re-domicile to Hong Kong while preserving its legal identity – was one option we explored. Parties in that position should verify the current eligibility criteria and the interaction with the home-jurisdiction licensing position before relying on re-domiciliation as a structuring route, as both the Hong Kong conditions and the home-jurisdiction implications require concurrent analysis.

The immediate step, which we addressed first, was to bring the marketing activity conducted from Hong Kong within a structure that either fell outside the AMLO perimeter or was conducted by an entity in the process of applying for a licence. The regional sales activity was restructured so that it was conducted by a properly identified Hong Kong entity operating under a defined mandate, with a licensing application prepared and filed within a defined timetable.

The broader lesson is that the "in or from Hong Kong" perimeter operates regardless of the group's formal registration, and a non-Hong Kong entity whose regional activity is conducted from Hong Kong is already inside the perimeter before it has asked whether it wants to be.

Where the risk sits now: our read

The risk in structuring a Web3 business through Hong Kong has shifted materially since the licensing regime commenced. In the pre-licensing period, the primary risk was regulatory uncertainty – not knowing what the rules would be. That uncertainty has substantially resolved. The rules are known. The Securities and Futures Commission has a defined review process. The Anti-Money Laundering and Counter-Terrorist Financing Ordinance's perimeter is visible.

The risk that has moved to the front is execution risk: the risk that a group structures its entity map, builds its compliance infrastructure, and proceeds to a licensing application in a sequence, or with intercompany arrangements, that the Commission will read as inadequate. That risk is concentrated in three areas.

First, source-of-funds documentation. The Commission's review of a licensing application is not limited to the applicant entity. It extends to the beneficial owners, the funding sources, and the intercompany flows. A group that cannot document, at the application stage, the origin of the capital that funds the Hong Kong entity and the basis on which intercompany transactions are priced is in a materially weaker position than one that can.

Second, token classification. A group that has proceeded on an informal assumption about its token's regulatory status – rather than a documented, reasoned analysis – faces the risk that the Commission reads the token differently. That risk does not go away at the application stage; it intensifies, because the application itself requires the group to characterise its activities, and an inconsistency between the characterisation in the application and the prior conduct of the business is a problem that must be addressed rather than avoided.

Third, cross-border AML attribution. The travel-rule obligation and the customer due diligence requirements attach to the licensed entity's transactions, but the counterparties in those transactions may sit in jurisdictions with different standards or with enforcement postures that create secondary risk for the Hong Kong licensed entity. A Hong Kong-licensed platform that onboards counterparties from high-risk jurisdictions without adequate enhanced due diligence documentation is exposed to regulatory action regardless of the commercial rationale for those relationships.

Our desk sees this third area as the one most likely to generate enforcement activity in the near term. The Commission has the supervisory tools; the question is where it deploys them first. A well-documented enhanced due diligence programme is not a guarantee of regulatory comfort, but its absence is a reliable basis for regulatory concern.

If an earlier structure, entity map or compliance build has produced a stalled application or a regulatory query, a second read can identify the specific points of weakness and the options still available. Write to us at info@lockhartyip.com.

The decision matrix: situation, instrument, route, and timing

The structuring decision for a Web3 business in Hong Kong follows a defined analytical path. The situation determines the instrument; the instrument determines the route; the route carries a timing and a risk profile.

A centralised virtual-asset trading platform that does not trade securities-type tokens operates under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance regime, with the Securities and Futures Commission as the licensing authority. The route is a licence application, preceded by a compliance infrastructure build, a source-of-funds documentation exercise, and a token classification analysis. The timing is front-loaded: infrastructure first, application second. The primary risk is the adequacy of the compliance build and the source-of-funds documentation at the point of application.

A platform that does trade securities-type virtual assets adds the Securities and Futures Ordinance licensing track. The route is the same in structure but broader in scope, because the Securities and Futures Commission's review extends to the conduct of the securities business and the adequacy of the entity's internal controls for that category of activity. The timing is longer; the risk profile includes the securities-regulatory layer in addition to the AMLO layer.

A stablecoin issuer operates primarily within the Hong Kong Monetary Authority's licensing regime, but the precise perimeter, eligibility conditions and commencement details should be verified against the current position before structuring. The route involves HKMA engagement at an early stage – the HKMA has run sandbox and consultation programmes – and the timing should account for the fact that the regime is relatively new and the Monetary Authority's review practice for a novel licence type will develop over time.

A group whose primary activity is token issuance without a trading platform faces the token-classification analysis as its primary gateway. If the token is a security, the Securities and Futures Ordinance regime applies; if not, the group may operate without a VATP licence, but must still manage the "in or from Hong Kong" perimeter for any marketing or distribution activity conducted from the jurisdiction. The route for a non-security token issuer is narrower in scope but requires equally careful documentation of the classification analysis.

The objection: "We are structured offshore – Hong Kong does not apply to us"

The most persistent myth our desk encounters in the Web3 structuring context is the assumption that an offshore structure – a clean Cayman holding company, a BVI operating subsidiary, no physical presence in Hong Kong – insulates the group from Hong Kong regulatory obligations. It does not, where the relevant conduct is being carried out from Hong Kong.

The "in or from Hong Kong" formulation in the Anti-Money Laundering and Counter-Terrorist Financing Ordinance is the operative phrase. It is not a registration test. It is a conduct test. A person who operates a virtual-asset trading platform from Hong Kong – where "from" can mean conducting the business activity, employing the relevant staff, or directing the platform's operations from a Hong Kong office – is within the perimeter regardless of where the entity is incorporated.

The Securities and Futures Commission has been consistent in applying a substance-over-form approach to this question. The location of the servers, the incorporation jurisdiction of the entity, and the formal contractual structure of the group are all relevant, but none of them is determinative. What matters is where the activity is carried out and who carries it out. For a group with a Hong Kong office, a Hong Kong-based management team, or a Hong Kong-based compliance and operations function, the answer is usually Hong Kong – and the licensing obligation follows from that conclusion.

This is not a novel or contested reading of the statute. It is the reading that the Commission has applied, and any structuring advice that proceeds on a different basis is building on a foundation that will not hold.

Our practice in this area includes advising groups at the pre-structuring stage, reviewing existing structures for regulatory attribution risk, preparing and coordinating licensing applications with allied counsel admitted in the relevant jurisdiction, and managing the source-of-funds and enhanced due diligence documentation that the application and ongoing supervision require. For a preliminary read on your structuring position and the licensing route, email info@lockhartyip.com.

Related practices

• Tech & Web3 – licensing, AML and entity structuring for virtual-asset businesses in Hong Kong
• Sanctions & AML – source-of-funds, travel-rule and counterparty risk management for cross-border groups
• Holding Structures – offshore and Hong Kong entity architecture for multi-jurisdictional technology groups

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

Related

• Tech Web3
• Structuring Web3 Business Through Hong Kong Briefing
• Data Transfer Privacy Terms Asia Facing Platform Matter

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.