Update: structuring a Web3 business

Hong Kong's mandatory licensing regime for centralised virtual-asset trading platforms – administered by the Securities and Futures Commission under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance – has been in force since 1 June 2023, and the regulatory posture has continued to sharpen since then. Founders and groups structuring a Web3 business through Hong Kong now face a defined set of licensing, AML and substance questions that must be resolved at the entity level before commercial operations begin.

What has changed – and what the current position requires

The virtual-asset trading platform (VATP) licensing regime brought centralised exchanges within the Securities and Futures Commission's direct supervisory perimeter. Operating a centralised virtual-asset trading platform without a licence is a criminal offence. The regime does not simply layer compliance onto an existing structure; it changes the sequencing of structural decisions entirely.

Where a virtual asset meets the definition of a "security" or "futures contract" under the Securities and Futures Ordinance, a separate licensing obligation under that Ordinance is also engaged. The two regimes can overlap, and the analysis must be done asset by asset. Groups that assumed a single licence covers the full product set are, in our cross-border practice, often wrong on the facts.

For fiat-referenced stablecoin issuers, the Hong Kong Monetary Authority has introduced a licensing regime that commenced in 2025. The precise commencement date and the perimeter of that regime should be verified against the current published position before any structural reliance is placed on it.

AML obligations apply across the board. VATPs are subject to customer due diligence requirements and the FATF travel rule (the Financial Action Task Force standard requiring originator and beneficiary information to accompany virtual-asset transfers above a defined threshold). Non-compliance with the travel rule is an enforcement trigger, not a soft expectation.

Who is affected across the corridor

The immediate audience is any group – whether incorporated in Hong Kong, the BVI, the Cayman Islands, or elsewhere – that operates or intends to operate a virtual-asset business with a Hong Kong nexus. A Hong Kong nexus can arise from the location of operations, the residence of key personnel, or the targeting of Hong Kong users. Offshore incorporation does not remove the licensing obligation where the factual nexus exists.

Cross-border groups with a Mainland China connection face additional complexity. The structural interface between the Hong Kong licensing regime and Mainland restrictions on virtual-asset activities requires careful mapping. Hong Kong operates as an international counsel hub for this work; the Mainland position remains restrictive and must be treated separately.

Counsel on our desk regularly see groups that have built an offshore holding structure – typically BVI over a Cayman operating entity or vice versa – without resolving the Hong Kong-regulatory question for the operational layer. That sequencing error generates enforcement risk rather than eliminating it. The holding structure and the licensing posture must be designed together.

The immediate action

Three steps apply in sequence. First, determine whether the planned or existing business activity falls within the VATP licensing perimeter, the Securities and Futures Ordinance perimeter, or both. Second, assess whether the AML and travel-rule obligations are met at the operational level, including the customer due diligence framework and the transaction-monitoring arrangements. Third, review the holding structure for consistency with the licensing entity requirements and any substance conditions imposed by the relevant offshore regimes.

If the business is already operating, the sequence is the same but the urgency is higher. Unlicensed operation is not a civil matter to be regularised at leisure; it is an active enforcement risk. The stablecoin question, where relevant, should be verified against the current HKMA position before any public issuance or pre-issuance structuring is finalised.

For a read on how the licensing, AML and structural questions interact in your specific cross-border position, write to us at info@lockhartyip.com.

Further detail on our Tech & Web3 practice and on the AML obligations arising for virtual-asset service providers is available on the site. For the cross-border data and services dimension, see our briefing on cross-border SaaS and data agreements touching the UAE.

Frequently asked questions

What does the route look like for structuring a Web3 business through Hong Kong?

The standard route involves selecting a holding jurisdiction – often the BVI or Cayman Islands – above a Hong Kong-regulated operating entity, determining the applicable licence category under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance and, where relevant, the Securities and Futures Ordinance, and then building the AML and travel-rule framework into the operating layer. The licensing analysis must precede the structural decision, not follow it. Groups that reverse this sequence regularly encounter complications that require restructuring.

What are the main risks in structuring a Web3 business through Hong Kong?

The primary enforcement risk is operating within the VATP licensing perimeter without a licence. Secondary risks include: failing to identify a Securities and Futures Ordinance licensing obligation where a virtual asset qualifies as a security; non-compliance with the FATF travel rule and customer due diligence requirements; and a mismatch between the offshore holding structure and the substance or licensing requirements of the regulated operating entity. Each of these is, independently, an enforcement trigger.

What is the first step in structuring a Web3 business through Hong Kong?

The first step is a licensing perimeter analysis: mapping each virtual asset or product against the definitions in the Anti-Money Laundering and Counter-Terrorist Financing Ordinance and the Securities and Futures Ordinance to determine which regulatory regime – or combination of regimes – applies. This analysis drives every subsequent structural decision, including entity choice, jurisdiction of incorporation, and the design of the AML compliance framework. Beginning with the holding structure before completing this analysis is the most common sequencing error our desk encounters.

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.

Update: structuring a Web3 business through Hong Kong

What has changed – and what the current position requires

Who is affected across the corridor

The immediate action

Frequently asked questions

Speak with Lockhart & Yip

Related