How to approach a fintech entity and regulatory engagement in Hong Kong

Establishing a fintech entity in Hong Kong and engaging its regulators is a defined sequence of structural, licensing and compliance decisions governed by the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (the AML/CTF Ordinance) and, where virtual assets or securities are involved, by the Securities and Futures Ordinance and the licensing regime administered by the Securities and Futures Commission (SFC) and the Hong Kong Monetary Authority (HKMA). The sequence matters as much as the individual steps: the gate at each stage determines whether the engagement moves forward or stalls at the next.

The window for early-mover positioning in Hong Kong's fintech regulatory environment is not permanent. A mandatory licensing regime for centralised virtual-asset trading platforms commenced on 1 June 2023, and a separate HKMA licensing regime for fiat-referenced stablecoin issuers followed in 2025. Groups that have not yet mapped their activities against the current perimeter face compounding uncertainty with each passing quarter. In our cross-border practice, we see the consequences of deferred engagement regularly – and they are almost always avoidable.

This guide sets out the decision the reader faces, the options on the table, the correct sequence of steps, the gate at each stage, and the common mistakes that send well-resourced groups off course.

What is the decision, and what are the options?

The first question is not "how do we get licensed?" It is "which activities do we intend to conduct, in or from Hong Kong, and which regulator has jurisdiction over each?" The answer determines both the entity structure and the engagement path.

Hong Kong's fintech regulatory environment is activity-based, not entity-based. The same corporate vehicle can attract obligations under two or more regimes simultaneously. A group offering a platform that allows users to trade virtual assets and hold tokenised securities faces concurrent scrutiny from the SFC (for the virtual-asset trading platform licence and any securities-related activity) and potentially from the HKMA (if fiat-referenced stablecoin issuance is contemplated). A payments-only business without virtual-asset exposure sits in a different lane.

The principal options are broadly three. First, full establishment: incorporate a Hong Kong entity, apply for the relevant licence or registration, and engage the regulator proactively from the outset. Second, a staged approach: establish a holding or operating entity without immediately triggering licensable activity, build the compliance infrastructure, then move to formal application once the product is defined. Third, a cross-border structure that places the licensed entity offshore (BVI, Cayman, Singapore) while using Hong Kong as the commercial or operational hub – an approach that requires careful analysis of whether the Hong Kong nexus itself attracts regulatory obligations regardless of where the entity is incorporated.

The third option is the one most frequently misunderstood. Incorporation elsewhere does not insulate a group from Hong Kong licensing requirements if the activity is conducted in or directed at Hong Kong. Our desk sees this mistake consistently in groups arriving from jurisdictions where regulatory perimeter is drawn more narrowly around the entity rather than the activity.

How does the Hong Kong licensing perimeter actually work?

Hong Kong applies a functional perimeter: if the regulated activity occurs in Hong Kong, or is marketed to Hong Kong persons, the relevant licence applies irrespective of where the operating entity is registered. Two regimes are central for most fintech groups.

The first is the virtual-asset trading platform (VATP) licensing regime under the AML/CTF Ordinance. The SFC administers this regime. A centralised platform that facilitates the buying and selling of virtual assets, and which operates in Hong Kong or actively markets to Hong Kong investors, requires a VATP licence. The AML/CTF Ordinance imposes customer due diligence obligations, the FATF travel rule (a requirement that originating institutions transmit identifying information alongside virtual-asset transfers), and ongoing reporting obligations. Compliance with those obligations begins at application stage – the SFC reviews the applicant's systems before granting a licence, not after.

The second is the securities and futures regime. Where a virtual asset constitutes a "security" or a "futures contract" within the meaning of the Securities and Futures Ordinance, the SFC's Type 1 (dealing in securities) or Type 7 (providing automated trading services) licensing requirements may apply in addition to – or instead of – the VATP regime. The boundary between utility tokens and security tokens is not always clear, and the SFC has issued guidance that treats the substance of the arrangement, not the label the issuer applies, as determinative.

A third regime is emerging for stablecoin issuers. The HKMA commenced a licensing regime for fiat-referenced stablecoin issuers in 2025; the precise perimeter and commencement date should be verified against the current position before any reliance is placed on it.

The practical consequence: a fintech group must map its activities against all three regimes before deciding on an entity structure. Licensing under one regime does not satisfy the requirements of another.

What is the correct sequence of steps, and where is the gate at each stage?

The sequence for a group approaching Hong Kong fintech regulatory engagement as a new entrant follows a defined order. Departing from it does not save time; it typically creates rework.

Step 1 – Activity mapping and perimeter analysis. Before any corporate vehicle is chosen, the group maps every activity it intends to conduct against the current licensing perimeter. This is not a compliance exercise; it is the commercial decision point. The output is a licensing matrix: activity A requires Regulator X licence; activity B triggers AML/CTF obligations from day one; activity C sits outside the current perimeter but may be caught by proposed changes. The gate at this step is a signed-off internal position on which activities are in scope and which regulator leads.

Step 2 – Entity selection and structural decision. With the licensing matrix confirmed, the group selects the entity form. A Hong Kong private company limited by shares is the standard vehicle for a licensed entity under both SFC and HKMA regimes. The holding layer is a separate structural question; BVI or Cayman holding entities are common above Hong Kong operating companies, but the holding layer must satisfy its own economic substance requirements in its home jurisdiction. The gate at this step is a final decision on the corporate structure, including the holding layer and its jurisdiction, before any incorporation is filed.

Step 3 – Compliance infrastructure build. Both the SFC and the HKMA require applicants to demonstrate – at the time of application – that their AML/CTF systems, customer due diligence processes, and internal controls are already operational or demonstrably ready to operate. This is the step that most new entrants underestimate. A credible application requires written policies, a named responsible officer (the individual accountable to the regulator), documented onboarding flows, and tested technology for travel rule compliance. The gate at this step is readiness of the compliance function, verified by an internal or external review before the application is filed.

Step 4 – Pre-application engagement with the regulator. Both the SFC and the HKMA accept pre-application meetings in appropriate circumstances. This step is not mandatory, but it is strategically significant. Regulators use pre-application engagement to signal concerns about the proposed business model before a formal application is submitted. A group that files without pre-application engagement risks a lengthy back-and-forth that could have been shortened – or a structural question could have been answered before the application clock started. The gate here is a clear agenda for the meeting: what the group is proposing, what the regulatory question is, and what specific feedback is sought.

Step 5 – Formal application. The formal application is filed with the relevant regulator. The SFC's VATP licensing application requires audited financial statements, a detailed business plan, the compliance documentation prepared in Step 3, information on beneficial ownership, and fit-and-proper information for responsible officers and significant controllers. The HKMA's stablecoin licensing process has its own documentation requirements, which should be verified against the current guidance. The gate at this step is a complete, consistent application package – gaps trigger requests for further information, which reset timelines.

Step 6 – Regulatory dialogue and conditions management. Regulators routinely impose conditions on newly licensed entities. Managing those conditions – responding accurately to requests within stated deadlines, reporting incidents without delay, updating the regulator when the business model changes – is an ongoing obligation, not a one-time step. The gate at this step is an internal process for monitoring and responding to regulatory correspondence, with clear ownership inside the business.

What is the most common mistake, and how does this route avoid it?

The most common mistake is treating the entity decision and the licensing decision as sequential rather than concurrent. Groups frequently incorporate a Hong Kong entity, open accounts, begin commercial activities, and then ask what licences are needed. By that point, unlicensed activity may already have occurred – a position that is significantly more difficult to remediate than one that was structured correctly from the outset.

Consider a fintech group from a Central Asian jurisdiction that arrived in Hong Kong in the second half of a recent year with a trading platform already operational under a foreign licence. The platform accepted Hong Kong users. The group had incorporated a Hong Kong entity but had not applied for a VATP licence, on the basis that the platform was "operated" from abroad. In our assessment, the Hong Kong nexus – users, marketing, customer support – was sufficient to engage the AML/CTF Ordinance perimeter regardless of where the servers sat. The group needed to suspend Hong Kong user onboarding, file a remediation plan, and begin a licensing application from a position of disclosed non-compliance, which affected the timeline materially.

The route described in this guide avoids that position by placing the perimeter analysis – Step 1 – before the entity decision. It also surfaces the cross-border dimension at the earliest stage: a group that uses an offshore holding entity above a Hong Kong operating company must confirm that the holding layer does not itself attract Hong Kong licensing obligations, and that the economic-substance requirements in the holding jurisdiction are satisfied.

The sequence above describes the standard position. Your matter turns on the activities actually conducted, the jurisdictions engaged, and the order of steps – which is where the regulatory outcome is determined.

For a structured assessment of your fintech activities and licensing position across the relevant jurisdictions, write to us at info@lockhartyip.com.

How does the cross-border interface affect the analysis?

Hong Kong sits at the intersection of common-law corporate governance, Mainland China's financial-regulatory system, and a network of offshore holding centres. Each of those interfaces raises distinct questions for a fintech group.

The Mainland interface is the most operationally significant for groups with Chinese-origin capital, Mainland users, or counterparties in the People's Republic. Mainland regulatory authorisations do not extend to Hong Kong, and Hong Kong licences do not authorise activity directed at Mainland users without separate Mainland approvals. A fintech group that serves both markets needs separate licensing in each, and must ensure that data flows between the two comply with applicable cross-border data rules in both directions.

The offshore holding layer raises the economic-substance question. BVI and Cayman holding entities used above Hong Kong operating companies are subject to their own economic-substance regimes. A pure holding company that holds shares in the Hong Kong licensee and does nothing else may satisfy the relevant substance threshold; a holding company that also provides management, technology, or treasury services to the group may not. This distinction needs to be confirmed at the entity-design stage, not after the structure is in place.

The Singapore comparison is a further cross-border consideration. Singapore and Hong Kong have both developed licensing regimes for virtual-asset service providers, and some groups consider which jurisdiction to use as the primary hub. The two regimes are not equivalent: the SFC's VATP regime and Singapore's Major Payment Institution licence under the Payment Services Act address similar activities but differ in perimeter, in the treatment of retail versus professional investors, and in the ongoing compliance burden. A group choosing between the two as a primary hub is making a commercial decision with long-term regulatory consequences, not simply a registration choice. Our cross-border practice regularly advises on this comparison.

For SaaS or data agreements that touch the Cayman Islands or other offshore centres, see our related analysis at cross-border SaaS or data agreements touching Cayman.

If an earlier filing, structure or regulatory approach produced an adverse or stalled result, a second read can identify the strategic error and the routes still open. Write to us at info@lockhartyip.com.

What does the AML/CTF compliance function actually require at application stage?

The AML/CTF Ordinance sets the baseline compliance standard for every fintech entity operating within the Hong Kong regulatory perimeter. The SFC and HKMA both assess compliance readiness as part of the licensing process; a credible application is one where the compliance function is demonstrably operational before the licence is granted, not planned for after.

Customer due diligence is the first pillar. The applicant must have documented policies for identifying and verifying customers, for screening against sanctions lists (noting that Hong Kong implements United Nations sanctions and does not give domestic effect to unilateral measures of other states), and for ongoing monitoring of customer activity. Those policies must be implemented in the technology platform, not merely written in a policy document.

The travel rule is the second pillar. Virtual-asset service providers must collect and transmit originator and beneficiary information for virtual-asset transfers above the applicable threshold. Compliance requires a technical solution integrated into the platform's transaction flow; a manual process is unlikely to satisfy a regulator that is assessing scalability.

The responsible officer regime is the third pillar. Each licensed entity must designate a responsible officer who is personally accountable to the regulator for the entity's compliance. The responsible officer must satisfy fit-and-proper criteria and must have genuine oversight of the compliance function – a nominally appointed officer without substantive involvement is a red flag in any regulatory review.

Internal controls and incident reporting complete the picture. The applicant must demonstrate a process for detecting, escalating and reporting suspicious activity to the Joint Financial Intelligence Unit (the JFIU, the body in Hong Kong that receives suspicious transaction reports from reporting institutions), and a process for notifying the regulator of material incidents within the required timeframe.

Decision checklist: where does your group sit?

Before instructing counsel or engaging a regulator, a fintech group approaching Hong Kong should be able to answer the following questions. These are not legal conclusions; they are the commercial data points that determine the analysis.

• Which specific activities will the Hong Kong entity (or the offshore entity with a Hong Kong nexus) conduct? Is a complete and current list of those activities available in writing?
• Which of those activities involve virtual assets, tokenised securities, or fiat-referenced stablecoins? Has the group determined whether any virtual asset it issues or trades constitutes a "security" under the Securities and Futures Ordinance?
• Where will the licensed entity sit in the corporate structure – as the operating company, the holding company, or both? Is there an existing offshore holding entity, and has its economic-substance position been confirmed?
• Is the compliance function documented, tested, and ready to operate? Is a responsible officer identified, and has that individual reviewed the application?
• Has the group confirmed which Mainland activities (if any) are intended, and whether separate Mainland regulatory approvals are required for those activities?
• Is the group aware of the current perimeter for the HKMA's stablecoin licensing regime, and has it confirmed whether that regime applies to its activities?
• Has the group reviewed its position under the Significant Controllers Register (SCR) requirement – the obligation on Hong Kong-incorporated companies to maintain a record of individuals who ultimately own or control the entity – which has been in force since 1 March 2018?

A group that cannot answer all of these questions with confidence is not yet ready to file a licensing application. That is not a failure; it is the correct assessment. The application process is not the place to resolve structural ambiguities.

For a preliminary read on your licensing position and the engagement route, email info@lockhartyip.com.

Related practices

• Tech & Web3 – licensing, AML compliance and entity structuring for fintech and virtual-asset businesses
• Sanctions & AML – counterparty review, source-of-funds documentation and compliance file preparation

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

Related

• Tech Web3
• Cross Border Saas Or Data Agreement Touching Cayman 5
• Ip Licensing Technology Group Expanding Into Asia Guide

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.