How to approach structuring a Web3 business through Hong Kong

A Web3 business moving into Asia faces a decision that looks deceptively simple: pick a jurisdiction, form an entity, begin operations. In practice, the sequencing matters more than the jurisdiction choice itself. Hong Kong's regulatory regime for virtual-asset businesses is live, operational, and enforced – and a structure that skips the licensing-posture analysis at the outset can foreclose options that are difficult or impossible to reopen later.

Structuring a Web3 business through Hong Kong requires a defined sequence: characterise the activity under the relevant instrument, determine whether the business requires a licence from the Securities and Futures Commission or the Hong Kong Monetary Authority, establish the correct entity, meet the anti-money laundering and substance requirements, and build the cross-border interface with the operating layer. The governing instruments are the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (for virtual-asset trading platform, or VATP, licensing) and the Securities and Futures Ordinance (where the virtual asset is a security or futures contract). The mandatory VATP licensing regime commenced on 1 June 2023.

This guide sets out the sequence in the order it should actually run, identifies the gate at each step, and flags the structural error that our desk most commonly sees at the intake stage.

What is the decision the reader faces – and why the sequencing matters?

The starting decision is not "Hong Kong or Singapore" but rather "what does this business actually do, under Hong Kong law?" That characterisation drives everything downstream. A platform that facilitates trading in virtual assets that qualify as securities sits under a different licensing pillar than one that trades only non-security tokens. A stablecoin issuer faces a distinct licensing layer altogether. Get the characterisation wrong at the formation stage and the entity, the ownership structure, and the compliance architecture may all need to be rebuilt.

In our cross-border practice, we see two distinct business profiles arriving at this question. The first is a team building a net-new platform, choosing a domicile and a regulatory posture before launch. The second is an established operator – often incorporated offshore or in a European hub – seeking to access Asian institutional liquidity and deciding whether Hong Kong is the right regulatory entry point. The analysis differs, but the sequence does not.

What makes Hong Kong a credible option is the combination of a transparent, rule-based licensing process under a common-law system, access to Greater China deal flow, and the ability to interface with the Mainland through a defined legal channel. What makes it demanding is that the regulatory expectations are substantive, not nominal. The Securities and Futures Commission does not license entities that cannot demonstrate genuine governance, AML infrastructure, and qualified personnel.

The cross-border dimension sharpens the point further. A Hong Kong-domiciled platform serving counterparties in the Mainland, the BVI, or the UAE must layer on a multi-jurisdictional AML analysis, address the FATF travel rule (the Financial Action Task Force requirement that virtual-asset service providers exchange originator and beneficiary information on transfers above the applicable threshold), and ensure that the offshore holding layer does not inadvertently trigger a licensing obligation in a second jurisdiction. Sequence governs outcome.

Step 1: Characterise the activity before forming anything

The first gate is activity characterisation under Hong Kong law, and it must be completed before incorporation. Two instruments govern. Where the virtual asset is a "security" or "futures contract" as defined under the Securities and Futures Ordinance, the relevant licensing pillar is the SFC's existing framework for dealing in, advising on, and managing securities and futures. Where the virtual asset is not a security but the business operates a centralised trading platform, the Anti-Money Laundering and Counter-Terrorist Financing Ordinance imposes the VATP licensing obligation administered by the SFC.

The distinction between a security token and a utility or payment token is fact-specific. No mechanical rule resolves every case. The analysis turns on the rights attached to the token, the expectations of the token holder, and the economic substance of the arrangement. An instrument that grants rights to profits, a share of assets, or governance influence will typically satisfy the criteria for a "collective investment scheme" or a "security" under the relevant definitions. One that grants only access to a service or network function may not – but the line is contested and the SFC has issued guidance that is read narrowly by the regulator and broadly by operators. Independent characterisation advice before any entity is formed is not optional.

For stablecoin issuers, a third layer applies. The Hong Kong Monetary Authority administers a licensing regime for fiat-referenced stablecoin issuers that commenced in 2025. Parties should verify the current commencement date and the perimeter of that regime before relying on it in a structuring analysis, as implementation details were still being confirmed at the time of this writing.

The practical gate here: do not form the entity, choose the directors, or draft the shareholder agreement until the activity characterisation is settled. Those decisions follow from characterisation, not the reverse.

Step 2: Determine the licensing route and its structural implications

Once the activity is characterised, the licensing route is determined. A VATP applicant must apply to the SFC under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance. A business dealing in or managing security tokens must hold the relevant SFC licence under the Securities and Futures Ordinance. A business that straddles both categories – for example, a platform that proposes to list both security and non-security tokens – requires both frameworks to be satisfied simultaneously.

The licensing route has direct structural consequences. The licensed entity must be a company incorporated in Hong Kong. It cannot be a branch of a foreign entity. It must be the direct operator of the platform. That means the holding layer – which for most cross-border groups sits in the BVI, the Cayman Islands, or another offshore centre – must be above the licensed entity, not substituted for it. The licensed Hong Kong company is the operating vehicle; the offshore entity holds the equity.

That structure is well understood in cross-border practice, but the detail matters. The offshore holding entity must be able to satisfy the SFC's fit-and-proper and ultimate-owner requirements. The controllers of the offshore entity – whether individuals or further corporate vehicles – will be assessed. Where the ultimate beneficial owner sits behind multiple layers of BVI or Cayman structures, the SFC expects transparency, and the Significant Controllers Register maintained by the Hong Kong company must accurately reflect the ownership chain.

A second structural consequence concerns the responsible officers – ROs (individuals approved by the SFC to supervise regulated activities) – who must be nominated at the time of application and must be ordinarily resident in Hong Kong or capable of demonstrating sufficient local presence. The RO appointment is not a formality. It is a substantive regulatory commitment that shapes who governs the entity and how.

Step 3: Build the AML and substance architecture before filing

The SFC licensing application is not a paper exercise. A VATP applicant must demonstrate, at the point of application, that its anti-money laundering and counter-terrorist financing programme is operational. The applicable rules derive from the Anti-Money Laundering and Counter-Terrorist Financing Ordinance and the SFC's regulatory requirements for VATPs, which cover customer due diligence, ongoing monitoring, record-keeping, and compliance with the FATF travel rule for virtual-asset transfers.

The travel rule requirement deserves particular attention in a cross-border structure. Where a VATP transmits virtual assets to or from a counterparty platform, it must pass originator and beneficiary information with the transfer, and it must have procedures for handling transfers from platforms that cannot or will not comply. For a Hong Kong platform serving counterparties in multiple jurisdictions – including jurisdictions with different or developing travel-rule implementations – this is an operational design question, not just a policy question. The technical infrastructure must be in place before the SFC will grant a licence.

Substance is the parallel requirement. Hong Kong regulators apply a genuine-presence standard. A licensed platform must have qualified personnel in Hong Kong, functioning governance, and documented controls. An entity formed in Hong Kong but managed from overseas, with a nominee director and a registered-office address as its only local presence, will not meet the threshold. In our experience, operators who treat the substance requirement as a compliance checkbox – rather than as the baseline for operating a regulated business – encounter the most difficulty at the application stage.

The practical gate at this step: the AML programme, the compliance manual, and the substance plan must be drafted and reviewed before the application is filed, not assembled in response to SFC queries. A pre-application assessment – mapping the programme against the SFC's published expectations – substantially reduces the risk of a stalled or refused application.

How does the cross-border interface work in practice?

A Hong Kong VATP or security-token business almost never operates in a single jurisdiction. The capital layer is typically offshore. The technology infrastructure may be cloud-based across multiple regions. The client base spans Asia, the Middle East, and Europe. Each of those interfaces raises a question that the structure must answer.

Consider the Mainland interface. Hong Kong is a separate jurisdiction from the Mainland, operating under its own common-law system with its own regulatory regime. A Hong Kong-licensed VATP does not carry a Mainland licence by virtue of its Hong Kong authorisation. Onboarding Mainland-resident retail clients raises questions under Mainland law that must be addressed independently. The structure must be clear about which entity is contracting with which counterparty, in which jurisdiction, and under which law.

The offshore holding layer introduces a different set of questions. A BVI or Cayman parent above a Hong Kong licensed entity is a familiar arrangement, but it is not invisible to regulators. The SFC's fit-and-proper assessment reaches through to the controllers of the offshore entity. The BVI and Cayman Islands have their own economic-substance regimes, which apply to holding entities in those jurisdictions. The Hong Kong entity's profits-tax position turns on whether profits are sourced in Hong Kong under the territorial basis, and the foreign-sourced income exemption regime – which requires economic-substance conditions to be met for passive income received by a Hong Kong entity – may apply depending on the income flows within the group.

On tax, the position is straightforward in outline: Hong Kong taxes profits on a territorial basis, charges no capital gains tax, and imposes no withholding tax on dividends or interest as a general position. The two-tier profits tax rates – 8.25% on the first HK$2,000,000 of assessable profits and 16.5% above that threshold – apply to Hong Kong-sourced profits. For groups within the scope of the Pillar Two minimum top-up tax, which applies to multinational enterprise groups with consolidated revenue of at least EUR 750 million for fiscal years beginning on or after 1 January 2025, the Hong Kong entity's effective tax rate must be modelled as part of the global structure. Groups below that threshold operate outside the Pillar Two perimeter, which is a material consideration in early-stage structuring.

The contextual bridge here is enforcement. If a commercial dispute arises with a counterparty in a jurisdiction outside Hong Kong, the dispute-resolution clause in the platform's contracts determines whether an award or judgment can be enforced against that counterparty's assets. For counterparties with Mainland assets, the Mainland Judgments in Civil and Commercial Matters (Reciprocal Enforcement) Ordinance – in force since 29 January 2024 – and the arbitral-award mutual-enforcement arrangements both matter to the structuring analysis. Dispute-resolution architecture is part of the Web3 structuring decision, not an afterthought for the legal team to resolve after launch.

The sequence above describes the standard position. Your matter turns on the specific activities, the jurisdictions actually engaged, and the ownership chain – which is where the route is won or lost. To discuss how the cross-border interface applies to your specific structure, contact info@lockhartyip.com.

What is the most common structural mistake – and how is it avoided?

The single most common mistake our desk sees is the inversion of the sequence: the operator forms the entity, nominates directors, issues tokens, and begins contracting – then seeks regulatory advice when a licensing question arises. By that point, the structure is locked. Unwinding it is expensive, time-consuming, and sometimes impossible without triggering adverse tax or regulatory consequences in the jurisdictions that have already been engaged.

The specific pattern looks like this. A team incorporates a BVI entity, issues governance or utility tokens to early investors under a token purchase agreement, and then seeks to establish a Hong Kong presence to access institutional counterparties. The SFC licensing route requires a Hong Kong incorporated company as the licensed entity. The BVI entity cannot simply be converted. A new entity must be interposed. But the token issuance – depending on the terms of the token and the nature of the rights granted – may already have constituted a regulated activity in Hong Kong, or elsewhere, without a licence. The team is now managing a pre-existing regulatory exposure at the same time as it is trying to build a compliant structure.

The avoidance is straightforward in principle: do the characterisation analysis first, engage the licensing question before any issuance or public-facing activity, and design the holding structure to accommodate the regulatory requirements of the operating layer from the outset. In practice, this means advisers and operators working together before the commercial documents are signed.

A second, related error is treating the offshore holding layer as the primary entity for all purposes. The BVI or Cayman parent may hold the intellectual property, manage the treasury, and be the contracting party for institutional clients. But where the Hong Kong entity is the licensed entity, it must genuinely be the operator. Arrangements that drain the substance from the licensed entity – passing all commercial function to the offshore parent – expose the structure to a regulatory challenge and, if the arrangement is aggressive, to a substance-over-form analysis by the IRD on the tax side.

If an earlier structure or regulatory engagement has produced an adverse or stalled result, a second analysis can identify what went wrong and what routes remain open. To discuss a restructuring or an existing exposure, email info@lockhartyip.com.

Decision checklist: is the structure ready to proceed?

Before filing a VATP or securities-licence application, and before committing to a final entity structure, the following questions should each have a documented answer.

• Has each token or product been characterised under Hong Kong law, with a written analysis of whether it is a security, a futures contract, or neither?
• Has the applicable licensing pillar – the Anti-Money Laundering and Counter-Terrorist Financing Ordinance VATP regime, the Securities and Futures Ordinance, or both – been identified and confirmed?
• Is the licensed entity a Hong Kong incorporated company, sitting below the offshore holding layer, with a clear and documented ownership chain up to the ultimate beneficial owners?
• Have the proposed responsible officers been identified, and can they satisfy the SFC's fit-and-proper and residency expectations?
• Is the AML and counter-terrorist-financing programme drafted, reviewed against the SFC's published requirements, and capable of operational deployment at the point of application?
• Does the travel-rule compliance infrastructure cover the jurisdictions in which the platform's counterparties are located?
• Has the substance analysis been completed for the Hong Kong entity and for each offshore entity in the holding chain?
• Has the tax position – including the territorial-source analysis, the FSIE implications for passive income, and Pillar Two if the group is in scope – been modelled for the proposed structure?
• Does the platform's standard contract include a dispute-resolution clause that produces an enforceable outcome against the relevant counterparty population?
• Has any prior token issuance or operating activity been reviewed for pre-existing licensing exposure in Hong Kong or in the other jurisdictions engaged?

A "no" or "unsettled" answer to any of these questions is a gate. The structure is not ready to proceed until each point is resolved.

A note on the interaction with other practices

Web3 structuring through Hong Kong does not sit in isolation. The licensing and AML analysis touches the sanctions and compliance practice when the platform's counterparty population spans jurisdictions subject to United Nations sanctions – the regime that Hong Kong implements. The holding-structure analysis intersects directly with the tax-positions practice when passive income flows between the Hong Kong entity and the offshore parent, particularly under the foreign-sourced income exemption regime. The dispute-resolution architecture is a disputes-and-arbitration question as much as a contract-drafting question.

In our cross-border practice, we approach Web3 structuring as an integrated problem. The licensing posture, the entity structure, the AML architecture, and the tax and enforcement position are designed together, not sequentially by separate advisers working in isolation. That integration is where the structural errors are avoided.

For guidance on the broader Tech & Web3 practice, or to explore how the regulatory engagement sequence applies to a specific platform or product, our desk is available. See also our related guidance on fintech entity regulatory engagement in Hong Kong and on IP licensing for technology groups expanding into Asia.

Related practices

• Sanctions & AML – AML programme design, travel-rule compliance, and sanctions-neutral contracting
• Tax Positions – territorial-source analysis, FSIE structuring, and Pillar Two modelling for cross-border groups
• Holding Structures – offshore holding-layer design above Hong Kong operating entities

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

Related

• Tech Web3
• Fintech Entity Regulatory Engagement Hong Kong
• Ip Licensing Technology Group Expanding Into Asia

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.