Where a token issuance reviewed under Hong Kong's regime stands now

A token issuance reviewed under Hong Kong's regulatory regime is now subject to a mandatory licensing architecture administered by the Securities and Futures Commission and, where the token carries features of a fiat-referenced stablecoin (a digital token whose value is pegged to one or more fiat currencies), additionally by the Hong Kong Monetary Authority. The governing instruments are the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, the Securities and Futures Ordinance, and the HKMA's stablecoin licensing regime, which commenced in 2025. Any issuer that has not mapped its token squarely against those instruments is carrying undisclosed regulatory exposure.

This analysis sets out where the commercial stakes sit, how the regime actually bites in practice, what the cross-border interface demands, and where our desk assesses the risk to be concentrated at this stage of the regime's development.

What is commercially at stake in a token issuance reviewed under Hong Kong's regime?

The short answer is market access, reputational standing, and the enforceability of the entire capital-raising structure. Hong Kong's virtual-asset licensing regime is not a disclosure exercise. It is an authorisation gate. A token offering that proceeds without the correct licence – or without a considered and documented basis for not requiring one – exposes the issuer, its directors, and potentially its advisers to regulatory action and, depending on the instrument, to criminal liability.

For the commercial principal, the stakes look like this. An issuance that is treated by the Securities and Futures Commission as involving a security token (a virtual asset that constitutes a "security" or "futures contract" under the Securities and Futures Ordinance) requires that the offering be conducted through a licensed intermediary. Retail distribution adds a further compliance layer. A utility token that migrates toward economic return, through staking yield or revenue-sharing mechanics, can re-characterise mid-project. And a stablecoin, if it references a fiat currency, sits inside a dedicated HKMA perimeter regardless of the Securities and Futures Ordinance analysis.

What this means commercially is that the structuring decision is also the regulatory decision. A group that sets the token's economic features without simultaneously running the regulatory classification risks building a distribution architecture that must be rebuilt, or worse, one that cannot legally operate at all once it faces scrutiny.

In our cross-border practice, the most common presenting problem is not a deliberate evasion. It is a project structured outside Hong Kong – typically in a jurisdiction with a lighter initial classification regime – that subsequently seeks to access Hong Kong investors, list on a Hong Kong-licensed virtual-asset trading platform (VATP), or anchor its operational entity in the city. Each of those moves triggers the Hong Kong analysis afresh.

How does the governing regime actually apply to a token issuance at present?

The mandatory VATP licensing regime under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, with the Securities and Futures Commission as licensing authority, commenced on 1 June 2023. That date is the correct reference point for when centralised virtual-asset trading platforms became subject to a formal licence requirement in Hong Kong.

For a token issuer, the VATP licensing date matters in two respects. First, any platform through which the token is offered to the Hong Kong public must hold or have applied for a VATP licence. An issuer that routes its offering through an unlicensed platform is not insulated from the platform's regulatory position; the conduct of the offering is what the Commission examines. Second, the SFC has developed conduct standards for licensed VATPs that include requirements about which tokens may be listed, what due diligence the platform must undertake, and what disclosures must be made. Those requirements flow directly to the issuer's documentation package.

Where the token is a security under the Securities and Futures Ordinance, the route is different. The offering must comply with prospectus requirements or rely on an exemption – professional investors, private placements, or small offers – and must be conducted through a licensed intermediary. The dual-licensing point is real: a VATP that also handles security tokens must hold both its VATP licence and the relevant Securities and Futures Ordinance licences.

The stablecoin position is distinct and still developing. The HKMA's fiat-referenced stablecoin licensing regime commenced in 2025. Parties should verify the current commencement date and perimeter before citing any specific regulatory obligation, because the regime's detailed rules on issuer capital, reserve management, and redemption rights were subject to consultation and subordinate legislation after the initial announcement. What is clear is that a stablecoin issuer operating in or from Hong Kong that references a fiat currency cannot proceed as if only the SFC's framework applies.

The AML and travel rule obligations are perhaps the most immediate operational burden for a new issuance. VATPs are subject to customer due diligence requirements and the FATF travel rule (the international standard requiring that originating and beneficiary institution information accompanies virtual-asset transfers). An issuer whose token circulates on a VATP must understand that each transfer on that platform generates a compliance event. If the token's design does not accommodate the data that the travel rule requires, the VATP may decline to list it.

How does the cross-border interface bite – and which system takes priority?

The cross-border dimension in a Hong Kong token issuance is not incidental. It is structural. The typical issuance involves at least three layers: a Cayman Islands or BVI foundation or company as the issuing entity, an operating entity or protocol development company in a second jurisdiction (Hong Kong, Singapore, or a tech hub in the UAE), and distribution to investors across multiple markets including Greater China.

Each layer generates a separate regulatory question, and the questions do not align automatically. The issuing entity may sit outside Hong Kong law entirely. But if the offering targets Hong Kong investors, uses a Hong Kong-licensed VATP, or is conducted from premises in Hong Kong, the SFC's and HKMA's jurisdiction is engaged. The location of the issuing entity does not determine the location of the regulated activity.

The Mainland China dimension is equally critical. The People's Republic of China does not permit general public issuance of, or trading in, most virtual assets. A Hong Kong-structured issuance that is accessible to Mainland investors – directly or through secondary trading – carries a cross-border compliance exposure that is separate from Hong Kong's own regime. Issuers sometimes treat the Mainland restriction as an investor-side problem, to be managed by a representation in the subscription agreement. Our desk's view is that a representation alone is not sufficient for a token designed to trade freely on a global secondary market. The structural question is whether the token can be traded by Mainland persons without the issuer's facilitation, and what the issuer has done to prevent that.

For an issuer with a BVI or Cayman holding entity that plans to operate the protocol from Hong Kong, the common-law system offers certain advantages: English is an official working language of the courts, the Court of First Instance has well-developed jurisprudence on financial instruments and corporate matters, and the Hong Kong legal environment has experience with offshore holding structures above a Hong Kong operating entity. The enforcement question – what happens if a token-holder disputes the issuer's conduct – maps better against Hong Kong's courts and arbitral institutions than against the courts of many offshore jurisdictions in isolation.

For issuers coming the other direction – structuring in Singapore or the UAE and seeking access to Hong Kong – the question is not whether Hong Kong's regime applies to the token in the abstract. The question is whether any activity in connection with the token constitutes a regulated activity in Hong Kong. Marketing to Hong Kong residents almost certainly does. Listing on a Hong Kong VATP almost certainly does. Maintaining Hong Kong accounts or infrastructure may do so. Issuers that have taken legal opinions in their home jurisdiction and assumed that those opinions cover the Hong Kong analysis are regularly surprised when they map their activities against the Anti-Money Laundering and Counter-Terrorist Financing Ordinance and the Securities and Futures Ordinance.

The sequence of regulatory engagement matters. The SFC has published its expectations for VATPs and has engaged with prospective licensees in a structured way since 1 June 2023. An issuer that begins dialogue with the relevant regulator early – before the offering documentation is finalised and before the distribution architecture is locked – retains more options than one that approaches the regulator after a structure is in place. That sequencing point is not theoretical. In our cross-border practice, late regulatory engagement is the single most common cause of material restructuring costs in digital-asset issuances.

The comparative read: Hong Kong against the offshore structuring alternatives

The relevant comparison for most cross-border issuers is between Hong Kong as the operating and regulated hub, and the alternatives: Singapore, the UAE (Abu Dhabi Global Market and Dubai International Financial Centre), and the Cayman Islands as an issuer-only domicile.

Singapore operates a comparable regime under the Payment Services Act and the Securities and Futures Act. The Monetary Authority of Singapore's licensing framework for digital-payment-token services and capital-markets services is well-developed, and Singapore has become a preferred operating hub for many Asian digital-asset projects. The practical difference for a group with Greater China exposure is that Hong Kong's geographic and legal proximity to the Mainland, the established offshore-to-Hong Kong holding-structure market, and the common-law regime with Chinese-language capability create a different risk-management calculus. Neither system is inherently superior. The choice turns on where the investors are, where the operating team sits, where the protocol is maintained, and where any eventual dispute will most practically be resolved.

The UAE's ADGM and DIFC frameworks are increasingly used for issuances targeting Middle Eastern and international institutional investors. Their advantage is regulatory flexibility and geographic distance from the PRC restriction. Their limitation, for a group whose investor base or counterparties are concentrated in Greater China and Southeast Asia, is that enforcing any judgment or award arising from a UAE-domiciled dispute against a Mainland-connected counterparty involves a longer and less-tested recognition route than Hong Kong's established arbitral enforcement arrangements under the 1999 Arrangement and its supplements.

The Cayman Islands remains the dominant issuing entity domicile for offshore reasons unrelated to the token analysis: asset protection, flexible corporate law, and familiarity to institutional investors. But the Cayman entity does not itself provide a regulatory home for the token. The regulated conduct happens wherever the offering, trading, and custody activity occurs. An issuer that uses a Cayman entity but conducts its regulated activity through a Hong Kong operating entity still needs to map that activity against the Hong Kong regime. The Cayman entity is the structural layer; Hong Kong is the regulatory layer. The two must be consistent.

What foreign counsel regularly get wrong in this comparative analysis is treating the offshore issuer domicile as a regulatory domicile. It is not. The SFC's and HKMA's jurisdiction follows the activity, not the entity's place of incorporation. A BVI company that markets a token to Hong Kong investors is subject to Hong Kong's regulatory requirements in respect of that marketing, regardless of the BVI entity's formal legal status.

Where the risk sits now: our analytical read

The window for the informal "wait and see" approach to Hong Kong's virtual-asset regime has closed. The VATP licensing regime is in operation. The SFC has acted against unlicensed platforms. The stablecoin regime has commenced. The market is no longer in a pre-regulatory orientation phase.

The risk is now concentrated in three areas, and issuers should assess their exposure against each.

The first is token re-characterisation. A token issued as a utility instrument that has subsequently acquired investment-return characteristics – through staking, governance-token mechanisms that correlate with economic value, or protocol revenue-sharing – may now sit in a different regulatory category than it did at issuance. The classification is not static. The SFC's approach has consistently been activity- and substance-based, not label-based. If the token now functions economically as a security, the regulatory position may have changed regardless of what the original documentation said.

The second is distribution-channel exposure. A token that was structured to avoid Hong Kong distribution but is now traded on a Hong Kong-licensed VATP, or whose secondary-market activity includes Hong Kong residents, has acquired a Hong Kong regulatory footprint. The issuer's original analysis – which may have concluded that no Hong Kong regulatory obligations applied – may be out of date. The secondary-market position is harder to control than the primary issuance, and that loss of control is itself a regulatory consideration.

The third is AML and source-of-funds documentation. Even where the token classification and the distribution channel are well-managed, the travel-rule and customer-due-diligence obligations continue to run. An issuer whose token generates high-volume secondary trading faces ongoing compliance obligations at the VATP level. If the VATP's due-diligence findings surface issues with the issuer's own investor base – large undocumented positions, concentrated holdings from high-risk jurisdictions, or wallet addresses that appear on international sanctions lists – the issuer is drawn into the compliance event regardless of whether it is the licenced entity.

There is a fourth area that is less immediately operational but strategically important: the interaction between the token's legal documentation and the enforcement route. A token-holder who disputes the issuer's conduct – failure to deliver promised functionality, governance manipulation, or misuse of treasury assets – needs a forum in which that dispute can be heard and a judgment or award that can be enforced against the issuer's assets. If the issuer's assets are in Hong Kong or held by a Hong Kong operating entity, the Court of First Instance or an HKIAC arbitral tribunal is a realistic enforcement route for a token-holder with a well-documented claim. If the assets are distributed across multiple wallets and offshore structures, the enforcement picture is materially more difficult. Issuers sometimes treat this as a token-holder problem. Our view is that it is also an issuer-governance problem, because the absence of a clear enforcement route damages the credibility of the instrument and the issuer's standing with institutional counterparties.

If you are at an earlier stage of the structural analysis – considering which entity to use as the issuer, whether a Hong Kong operating entity creates regulatory obligations, or how to document the token's classification – the sequence above describes the standard position. Your matter turns on the token's actual economic features, the jurisdictions your investors sit in, and the distribution channels you are using. Those specifics determine which regulatory obligations are engaged and in what order they must be addressed.

To discuss how the VATP and stablecoin regimes apply to your cross-border issuance position, contact info@lockhartyip.com.

AML obligations and the ongoing compliance architecture

The AML regime for virtual assets in Hong Kong operates continuously, not only at the point of issuance. A VATP that lists a token is an obliged entity under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance for all activity on its platform. The issuer's relationship with the VATP therefore creates an ongoing compliance interface that most issuers underestimate at the time of initial listing.

The customer due diligence requirements that the VATP applies to its own clients – the token buyers and traders – include source-of-funds and beneficial-ownership verification. Where those checks surface concerns about a position associated with the token's issuer, the treasury, or early investors, the VATP may restrict trading, request additional documentation from the issuer, or escalate to the SFC. The issuer is not the VATP's client in the traditional sense, but in practice the issuer is drawn into the VATP's compliance process because its conduct, documentation, and investor base are relevant to the VATP's own regulatory obligations.

The FATF travel rule adds a further layer. Virtual-asset transfers above the applicable threshold must be accompanied by originator and beneficiary information. For a token that trades in high volume, this generates a substantial data-management obligation at the VATP level. An issuer whose token is designed without regard to travel-rule compatibility – for example, because the token's smart-contract architecture does not accommodate the metadata required – may find that its token is effectively unlisatable on a compliant platform.

In our cross-border practice, AML architecture is the element of digital-asset issuance that receives the least attention at the structuring stage and creates the most practical difficulty at the compliance stage. The design of the token's transfer mechanics, the selection of the custody and settlement model, and the investor-identification architecture should all be planned with the VATP's compliance obligations in mind, not added retroactively once the token is in secondary trading.

If an earlier filing, structure, or engagement with a Hong Kong VATP has produced a compliance concern or stalled listing process, a second read can identify where the documentation or design creates the issue and what routes remain open to address it. Write to info@lockhartyip.com to begin that assessment.

Interaction with the private wealth and holding-structure dimensions

A token issuance does not exist in isolation from the issuer's corporate structure, and the corporate structure has its own regulatory and tax dimensions that interact with the token analysis in ways that are regularly overlooked.

Consider a common pattern: a BVI or Cayman entity is used as the issuing vehicle; a Hong Kong company is the operating entity responsible for protocol development and employee payroll; a family-office or founder trust sits above both, holding the equity in the Cayman entity. The token classification and VATP licensing analysis applies to the issuance and distribution activity. But the corporate governance of the issuing entity, the significant-controllers register obligations of the Hong Kong operating company, and the trust's asset-protection and succession structure are all live questions simultaneously.

The Significant Controllers Register (the SCR, Hong Kong's beneficial-ownership disclosure requirement for incorporated companies) has been in force since 1 March 2018 under the Companies Ordinance. A Hong Kong operating company that forms part of a token-issuance structure must maintain that register, and the beneficial ownership it records must be consistent with the AML documentation that the VATP holds for the issuance. Inconsistencies between the two are a compliance risk that the SFC and the Companies Registry can identify.

The tax dimension, addressed in detail in our Tech & Web3 practice, includes the question of whether token-sale proceeds constitute assessable profits for Hong Kong profits tax purposes, and whether the foreign-sourced income exemption regime applies to offshore income flows through the structure. Hong Kong operates on a territorial basis, taxing only Hong Kong-sourced profits. Whether token-sale proceeds are Hong Kong-sourced depends on where the profit-generating activity occurs. If protocol development, investor relations, and business decisions are made from Hong Kong, the profits-tax analysis is engaged even if the issuing entity is offshore.

Groups with a founder or family-office layer above the structure should also consider how the token's economic upside – carried in the Cayman entity's equity – interacts with succession planning across the jurisdictions involved. The Hong Kong trust regime, reformed substantially with effect from 1 December 2013, offers strong asset-protection and perpetuity-abolition features for settlors choosing Hong Kong law. But trust law interacts with the token's economic mechanics in ways that require specific legal analysis rather than generic structuring assumptions.

For a more detailed treatment of the holding structure question for digital-asset groups, see our matter analysis on a digital asset fund structured through Hong Kong and the cross-border considerations that arise from that structure.

What the issuer should do next: a practical decision framework

The decision matrix for an issuer at this stage of the regime is not complicated in principle, but it requires that each variable be assessed honestly rather than on the basis of the most favourable possible characterisation of the token's features.

If the token has investment-return characteristics – yield, governance rights that correlate with economic value, or revenue-sharing mechanics – the starting assumption should be that it is a security under the Securities and Futures Ordinance, and the issuer should obtain a formal legal opinion to the contrary before proceeding on any other basis. The cost of that opinion is trivial relative to the cost of a post-issuance regulatory determination that the token is a security that was distributed without compliance.

If the token is a utility instrument with no investment-return characteristics, the analysis shifts to the VATP licensing question: which platforms will be used for distribution and trading, and do those platforms hold the necessary licences? An issuer that routes its offering through an unlicensed platform takes on the platform's regulatory risk in addition to its own.

If the token references a fiat currency in any way – as a reserve backing, a redemption mechanism, or a peg – the HKMA's stablecoin licensing regime is engaged, and the issuer should verify the current commencement date and detailed perimeter before proceeding. The stablecoin regime commenced in 2025; the specific requirements for issuer capital, reserve management, and redemption rights should be confirmed against the current legislation and regulatory guidance.

If the distribution includes Mainland China investors, or if the token will trade on secondary markets accessible to Mainland persons, the cross-border compliance position requires separate analysis. Hong Kong's licensing regime does not resolve the Mainland restriction. The two must be addressed in sequence.

If the issuer has existing documentation – a white paper, a subscription agreement, an investor representation, or a prior legal opinion – that was prepared before the VATP licensing regime commenced or before the stablecoin regime took effect, that documentation should be reviewed against the current regime. The regulatory environment has moved materially since the pre-June 2023 period, and documentation prepared then may not reflect the current obligations accurately.

For a structured assessment of your token issuance position across the relevant jurisdictions, including the SFC, HKMA, and cross-border dimensions, write to us at info@lockhartyip.com.

For cross-border technology and data agreements that touch the Mainland alongside a token or digital-asset structure, see also our guide on cross-border SaaS and data agreements touching the Mainland, which addresses the data-governance layer that digital-asset operations in Greater China must also manage.

Related practices

• Tech & Web3 – licensing, AML, token structuring and regulatory engagement in Hong Kong and offshore
• Sanctions & AML – source-of-funds compliance, travel rule, and counterparty due diligence for digital-asset issuers
• Holding Structures – BVI, Cayman, and Hong Kong entity architecture above a token-issuing group

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

Related

• Tech Web3
• Cross Border Saas Or Data Agreement Touching Mainland 5
• Digital Asset Fund Structured Through Hong Kong United 5

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.