Briefing: a fintech entity and regulatory engagement

Hong Kong's licensing regime for virtual-asset and fintech businesses is now fully operational. Operators that have not yet mapped their activities to the correct regulatory perimeter are exposed – not to a future risk, but to a present one.

The Anti-Money Laundering and Counter-Terrorist Financing Ordinance provides the primary licensing framework for centralised virtual-asset trading platforms in Hong Kong, with the Securities and Futures Commission as the licensing authority for that regime and additional Securities and Futures Ordinance licensing where a virtual asset qualifies as a security or futures contract. A separate Hong Kong Monetary Authority licensing regime for fiat-referenced stablecoin issuers commenced in 2025. Fintech businesses operating across the Greater China corridor – or holding a parent or sister entity in a Mainland, BVI, Cayman or European structure – carry a layered exposure that the licensing posture of one entity alone does not resolve.

This briefing sets out what the current position demands, who it affects, and the immediate step.

What the regulatory position requires now

The mandatory licensing regime for centralised virtual-asset trading platforms commenced 1 June 2023. That date marks the point at which operating without an authorised licensing posture became a present exposure, not a prospective one.

The regime sits inside the Anti-Money Laundering and Counter-Terrorist Financing Ordinance. The Securities and Futures Commission is the licensing authority. Where a virtual asset constitutes a "security" or "futures contract" as defined, the platform operator also requires the relevant Securities and Futures Ordinance authorisation. The two regimes can overlap, and the analysis of which applies – or whether both apply – is fact-specific.

The stablecoin position adds a further layer. The Hong Kong Monetary Authority now administers a licensing regime for fiat-referenced stablecoin issuers. Groups running a stablecoin issuance programme alongside a trading or custody function carry a dual-regulator position that requires active management. Parties should verify the current commencement date and exact perimeter of the stablecoin regime before acting.

AML obligations are not deferred until licensing is complete. Customer due diligence requirements and the FATF travel rule (the international standard requiring originator and beneficiary information to accompany virtual-asset transfers) apply to licensed and licence-seeking platforms alike. A group that enters the licensing process without a functioning AML programme materially weakens its application.

Who is affected across the corridor

The exposure is not confined to platforms incorporated in Hong Kong. Any entity with a meaningful cross-border nexus to Hong Kong – through customers, settlement infrastructure, counterparty relationships, or a holding structure with a Hong Kong entity in the chain – may be within the perimeter or on its edge.

In our cross-border practice, we regularly see four distinct positions: a BVI or Cayman holding entity that controls a Hong Kong-facing platform; a Mainland-linked group that uses Hong Kong as the distribution or settlement hub; a European or Middle Eastern fintech expanding into Asia through a Hong Kong subsidiary; and a web3 project that began as a decentralised protocol and has since added features that bring it within the centralised-platform definition. Each of these requires a licensing analysis, not a deferral.

The cross-border interface matters in a second respect. A fintech group that is licensed or regulated in another jurisdiction – the United Kingdom, Singapore, the UAE – does not carry that licensing status into Hong Kong. The Hong Kong regime applies independently. Groups that assume equivalence between their home-market authorisation and the Hong Kong position routinely miscalculate their exposure.

For an assessment of your group's cross-border licensing and AML position across the relevant jurisdictions, write to us at info@lockhartyip.com.

The immediate action

The first step is a licensing perimeter analysis: which activities, which entities, and which jurisdictions are within scope. That analysis drives everything that follows – the entity structure, the AML programme, the regulator engagement, and the sequencing of any application.

Groups that have already begun an application or engagement with the Securities and Futures Commission or the Hong Kong Monetary Authority and have stalled should treat that stall as a signal, not a pause. In our experience, the most common cause is a mismatch between the entity structure presented to the regulator and the commercial reality of how the business actually operates across the corridor. Resolving that mismatch requires a structural review before the regulatory engagement continues.

Our desk covers the full sequence: reviewing the licensing and AML position, structuring the entity, and preparing the regulatory engagement. We work alongside locally licensed Hong Kong firms where the matter engages Hong Kong law directly.

For guidance on your fintech entity's regulatory position and the engagement route in Hong Kong, contact info@lockhartyip.com.

Further analysis of structuring a web3 business through Hong Kong is available at our web3 structuring guide. For stablecoin and digital-asset custody considerations, see our stablecoin briefing. Our full Tech & Web3 practice page is at lockhartyip.com/practices/tech-web3.

Frequently asked questions

How does the cross-border element affect a fintech entity and regulatory engagement in Hong Kong?

A group with entities or operations across multiple jurisdictions cannot treat its Hong Kong licensing position in isolation. Where a BVI or Cayman holding entity controls a Hong Kong-facing platform, or a Mainland-linked group uses Hong Kong as a settlement hub, the regulatory perimeter analysis must map every entity in the chain. A licence or authorisation obtained in another jurisdiction does not carry over; the Hong Kong regime applies independently and must be addressed on its own terms.

What does the route look like for a fintech entity and regulatory engagement in Hong Kong?

The route begins with a perimeter analysis to determine which activities and entities are within scope of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance regime and, where relevant, the Securities and Futures Ordinance. That analysis determines the licensing authority – the Securities and Futures Commission, the Hong Kong Monetary Authority, or both – and the sequencing of any application. A functioning AML programme, including customer due diligence and the FATF travel rule, is a precondition rather than a post-licensing step.

Do I need a Hong Kong adviser for a fintech entity and regulatory engagement in Hong Kong?

Yes, and the adviser needs to operate across the relevant legal systems, not only within Hong Kong. The licensing analysis requires an understanding of how the Hong Kong perimeter interacts with the group's existing entity structure – which may be governed by BVI, Cayman, Mainland or European law. International counsel with cross-border fintech experience, working alongside locally licensed Hong Kong firms for Hong Kong-law aspects, provides the most effective coverage for groups in this position.

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.

Briefing: a fintech entity and regulatory engagement in Hong Kong

What the regulatory position requires now

Who is affected across the corridor

The immediate action

Frequently asked questions

Speak with Lockhart & Yip

Related