Matter note: a digital-asset fund structured through Hong Kong and Cyprus

The question arrived in early 2027. A founder-led group managing third-party capital in digital assets had been operating under a light-touch arrangement that worked — until it did not. Their holding entity sat in Cyprus. Their fund manager operated from Hong Kong. Their investors were spread across three continents. The commercial model was coherent. The regulatory position was not.

A digital-asset fund structured through Hong Kong and Cyprus engages at least two licensing regimes simultaneously: the Securities and Futures Commission mandatory licensing framework for virtual-asset trading platforms under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, which commenced on 1 June 2023, and the Cyprus Investment Firm regulatory perimeter administered by the Cyprus Securities and Exchange Commission. The structure works when these two layers are mapped against each other from the outset; it fails when each is addressed in isolation.

This note sets out the cross-border problem, the route chosen, the sequence of steps, and the lesson that transfers to similar structures.

The situation: two jurisdictions, one unresolved question

The group had not ignored regulation. Far from it. They had sought advice — but separately in each jurisdiction. Their Cyprus counsel had assessed the fund-manager entity under EU law. Their Hong Kong advisers had reviewed the trading-platform question in isolation. Neither set of advice addressed the interface between the two systems.

The result was a structural gap. The Cyprus entity held the management agreement and carried the regulatory registration. The Hong Kong entity executed trades on behalf of the fund and interfaced with counterparties. Whether the Hong Kong entity needed its own licensing position under the Hong Kong regime had not been answered with any certainty.

When a prospective institutional investor began its due diligence process in mid-2027, the gap became visible. The investor's counsel raised a direct question: which entity carries the regulated activity in Hong Kong, and on what basis? The group could not answer it cleanly. The transaction stalled.

In our cross-border practice, this pattern is more common than it should be. A structure that looks coherent from each side of a border can carry a material fault line at the interface. The fault line only becomes apparent under pressure — a due-diligence process, a regulatory inquiry, or an enforcement event.

The cross-border issue: where each regime's perimeter actually sits

The core legal question was jurisdictional: did the activities conducted from Hong Kong fall within the mandatory virtual-asset trading platform licensing regime, and if so, could the Cyprus registration displace that requirement?

The answer to the first limb was, on a careful reading of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, likely yes. Virtual-asset trading platforms operating in Hong Kong or actively marketing to Hong Kong investors are within the licensing perimeter. The Securities and Futures Commission is the licensing authority. The group's Hong Kong entity was not a passive conduit — it executed activity that fell, at minimum, close to the statutory boundary.

The answer to the second limb was clearly no. A Cyprus Investment Firm authorisation, granted by the Cyprus Securities and Exchange Commission under EU directives, does not satisfy Hong Kong's own licensing requirements for virtual-asset service providers. The two regimes share a common policy heritage — both draw from FATF (the Financial Action Task Force, the international standard-setter for anti-money laundering and counter-terrorist financing) guidance — but they are administered independently by separate regulators and carry different authorisation conditions.

There was an additional layer. Where a virtual asset constitutes a "security" or "futures contract" under Hong Kong law, the Securities and Futures Ordinance licensing regime also engages. For this group, a portion of the fund's portfolio included tokens that, on a substantive analysis, carried characteristics placing them in or near the securities definition. That overlap had not been mapped.

The AML obligations compounded the analysis. Both jurisdictions impose customer due diligence requirements and, for transfers involving virtual assets, the FATF travel rule — requiring originator and beneficiary information to accompany transfers. The group's operational procedures had been designed around the Cyprus compliance framework. Their applicability to Hong Kong-administered transfers was uncertain.

The sequence: mapping the gap before it became a breach

The engagement began with a structured mapping exercise. We identified every point of regulatory engagement — activity type, executing entity, investor geography, asset classification — and assessed each against the Hong Kong regime and the Cyprus regime in parallel, not in sequence.

The first step was asset classification. Working through the fund's portfolio, we categorised each token class against the Hong Kong definition of a security and the definition of a futures contract. That exercise produced three categories: assets clearly outside both definitions; assets that were, on balance, within the securities definition; and a middle band requiring a documented position to be established and maintained.

The second step was entity mapping. We assessed whether the Hong Kong entity's activities constituted operation of a virtual-asset trading platform, provision of dealing services in securities, or a combination. The conclusion was that a licensing application to the Securities and Futures Commission was the correct path. Attempting to argue the activity fell entirely outside the perimeter was not, in our assessment, a defensible long-term position.

The third step was the Cyprus-side review. We coordinated with locally licensed Cyprus counsel — allied counsel admitted in the relevant jurisdiction — to assess whether the Cyprus entity's authorisation scope covered the management activity attributed to it, or whether amendments were required. A Cyprus Investment Firm licence carries defined permitted activities; the question was whether the group had structured the attribution correctly.

The fourth step was AML procedures. We prepared a gap analysis against Hong Kong's AML/CTF (anti-money laundering and counter-terrorist financing) guidelines issued by the Securities and Futures Commission. The group's existing procedures were adapted to cover Hong Kong-administered transfers and the travel-rule obligations applicable to those transfers.

The turning point in the matter came at the third step. The Cyprus entity held an authorisation that, on its terms, was narrower than the activity the group had attributed to it. Correcting that — extending the permitted activity scope through the Cyprus Securities and Exchange Commission — was a procedural step but a material one. Without it, the Hong Kong licensing application would have presented an inconsistent regulatory picture to the Securities and Futures Commission.

The outcome and the transferable lesson

The investor's due diligence resumed once the regulatory position had been documented and the licensing application in Hong Kong filed. The group did not wait for the licence to be granted before re-engaging — the application itself, supported by a clear compliance posture and documented gap remediation, was sufficient to satisfy the institutional investor's counsel that the regulatory risk was being managed rather than ignored.

The qualitative outcome: a structure that had been assembled over several years without a cross-border regulatory audit was brought into a defensible position within a defined timeline. No enforcement event occurred. The transaction proceeded.

The transferable lesson is a simple one, though we see it violated regularly. A digital-asset fund that touches two jurisdictions must be reviewed at the interface, not at each endpoint separately. Regulatory perimeters do not align by default. The FATF framework creates a common policy floor, but each jurisdiction implements it through its own instruments, administered by its own regulator, with its own procedural requirements.

For a group that operates across Hong Kong and Cyprus — or any other EU-regulated centre — the structural question is not "are we licensed?" but "are we licensed for each activity in the jurisdiction where that activity is regulated?" The second question is harder to answer. It is also the only one that matters when a counterparty's counsel is reviewing the position under due-diligence conditions.

A secondary lesson relates to timing. The group in this matter was fortunate that the gap was identified during a commercial process rather than in response to a regulatory inquiry. The window for proactive remediation is materially wider than the window for reactive response. That asymmetry is the principal reason the trigger for this kind of structural audit should be the first sign of institutional investor interest, not the first sign of regulatory attention.

The sequence above describes the standard position. Your matter turns on the documents, the jurisdictions actually engaged, and the order of steps — which is where the route is won or lost. For a structured assessment of your digital-asset fund's regulatory position across the relevant jurisdictions, write to us at info@lockhartyip.com.

Related practices

• Tech & Web3 – licensing, AML compliance and cross-border structuring for digital-asset businesses
• Sanctions & AML – counterparty review, source-of-funds files and compliance documentation

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

Related

• Tech Web3
• Cross Border Saas Or Data Agreement Touching Cyprus 3
• Digital Asset Fund Structured Through Hong Kong Cayman 5

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.