Matter note: a fintech entity and regulatory

A fintech operation that sits at the intersection of payments, digital assets and cross-border money flows does not choose its regulators. The regulators are determined by what the business does, the licences it holds, and the jurisdictions in which it touches customers or assets. That is the starting point our desk takes on every mandate of this kind.

This matter note describes, in anonymised form, a regulatory engagement we handled for a fintech entity operating through Hong Kong. The core instruments were the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (the principal AML and licensing statute) and the Securities and Futures Ordinance, with the Securities and Futures Commission and the Hong Kong Monetary Authority as the two principal bodies in view. The engagement moved from a licensing-posture review through a regulatory dialogue to a resolved structural position. No names, no identifying facts, no figures beyond what the verified record supports.

The sections below set out the situation, the issue, the sequence, and the lesson that transfers to comparable mandates.

What was the situation, and what made it structurally difficult?

The client was a fintech entity incorporated in a common-law offshore centre, operating a platform that combined payment-settlement functionality with exposure to virtual-asset flows. The entity had chosen Hong Kong as its principal operating hub, with customer-facing activity running through a locally incorporated subsidiary and treasury operations maintained partly offshore.

On paper, the structure looked familiar. A holding entity in a recognised offshore centre, a Hong Kong opco, clean intercompany agreements. In practice, the position was more exposed than it appeared. The virtual-asset component of the platform had grown materially since the entity was originally structured. What had been a minor feature of the product had become a significant revenue line. That change had not been matched by a corresponding review of the licensing position.

The exposure ran in two directions. First, the Hong Kong VATP (virtual-asset trading platform) licensing regime – the mandatory licensing framework for centralised virtual-asset trading platforms under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, with the Securities and Futures Commission as the licensing authority – had commenced on 1 June 2023. The entity's platform activities potentially engaged that regime. Second, certain of the virtual assets handled by the platform raised the question of whether they constituted "securities" or "futures contracts" under the Securities and Futures Ordinance, which would layer a further SFC licensing requirement on top of the VATP analysis.

Neither question had been formally considered at the time the client engaged us. The gap between the platform's current activities and its documented regulatory posture was the central structural difficulty.

What was the cross-border dimension, and why did it matter here?

A fintech entity operating through Hong Kong rarely sits in one jurisdiction only. This one was no exception. The offshore holding structure, the Hong Kong subsidiary, and the customer base spread across multiple markets meant that three legal systems were in play simultaneously: the law of the offshore incorporation jurisdiction, Hong Kong law as applied to the subsidiary and its licensing obligations, and the regulatory perimeters of the markets from which the platform drew customers.

The offshore holding entity was relevant for two reasons. First, its own economic-substance position required review. The economic-substance regime applicable to BVI and Cayman entities – the requirement that relevant activities be substantively managed and directed from the jurisdiction of incorporation – is not merely a compliance formality. It bears directly on how a structure is characterised by Hong Kong and other tax authorities. Second, the direction of the group's treasury flows between the offshore entity and the Hong Kong subsidiary engaged potential FSIE (foreign-sourced income exemption) analysis under Hong Kong's territorial profits tax regime.

In our cross-border practice, the mistake we see most often at this stage is treating the licensing question as purely a Hong Kong regulatory matter and the tax question as purely a structuring matter. The two interact. A licensing determination changes the permitted activities of the Hong Kong entity. That change can shift income characterisation, substance requirements, and the entity's exposure to the Hong Kong profits tax regime on income that would otherwise have been handled differently.

For this entity, the cross-border interface required a coordinated read – licensing posture in Hong Kong, substance analysis at the offshore holding level, and a clear picture of which regulatory body was the primary interlocutor. The two bodies whose perimeters were potentially engaged – the SFC and the HKMA – have distinct mandates and distinct expectations. Getting the sequencing of the dialogue wrong risks creating a regulatory record that constrains the options available later.

What was the sequence, and where was the turning point?

The engagement ran in four stages. The first was a licensing-posture audit: a structured review of the platform's activities against the VATP regime and the Securities and Futures Ordinance, producing a documented position on what licences the entity required, what licences it held (or did not hold), and what the gap represented in regulatory terms.

The second stage was an AML-position review. The Anti-Money Laundering and Counter-Terrorist Financing Ordinance imposes customer due diligence obligations, the FATF travel rule (the Financial Action Task Force requirement that originator and beneficiary information accompany virtual-asset transfers above the applicable threshold) and ongoing monitoring requirements on licensed entities. Because the entity had not previously gone through a formal VATP analysis, its AML policies and procedures had been drafted against a more general financial-services template rather than against the specific requirements that apply to virtual-asset businesses. The gap was material. The policies required substantial revision before any regulatory engagement could begin.

The third stage – the turning point – was the decision on how to approach the SFC. There were two options. The entity could submit a formal licence application and let the process run its course. Or, in advance of a formal application, it could seek a structured preliminary engagement with the regulator to clarify the scope of the platform's activities, the applicable licensing category, and the conditions it would need to meet. We recommended the second route, and the client accepted it.

That recommendation was grounded in experience. A formal licence application that arrives before the applicant's house is in order produces a regulatory record that is difficult to correct. The SFC's licensing process involves detailed scrutiny of the applicant's fitness and properness, its internal controls, its compliance function, and its AML and risk-management framework. An application submitted with deficiencies in any of those areas does not simply pause while the deficiencies are remedied. It moves forward, and the deficiencies become part of the record. The preliminary engagement route allowed the entity to understand the regulator's expectations precisely, revise its documents accordingly, and submit an application that was positioned to succeed.

The AML documentation was revised. The travel-rule implementation was documented. The substance and governance arrangements at the offshore holding level were reviewed and adjusted. The preliminary engagement produced a clearer picture of the licensing category that applied and the conditions that would attach. The formal application was submitted from a position of preparation rather than of catch-up.

What was the qualitative outcome, and what transfers?

The engagement concluded with the entity in a documented, defensible licensing posture: a formal application on file, revised AML and compliance documentation meeting the regulator's stated expectations, and a structural position at the offshore holding level that had been reviewed against the relevant substance requirements. No adverse regulatory finding was made in the period we were engaged. The matter moved from an unresolved exposure to a managed position.

Three things transfer from this engagement to comparable mandates.

First, the timing of the review matters more than most principals appreciate. The VATP licensing regime has been in effect since 1 June 2023. An entity that deferred its licensing analysis while its virtual-asset activities grew was operating in a gap between its regulatory posture and its actual activities. That gap compounds over time. It affects not only the licensing position but the AML record, the substance analysis, and the entity's standing if a regulatory enquiry arrives before the self-initiated review does.

Second, the choice of interlocutor determines the regulatory record. The SFC and the HKMA have overlapping but distinct perimeters for fintech and virtual-asset businesses. Where both bodies are potentially engaged – because the platform combines payment functionality with virtual-asset exposure – the entity needs a clear position on which body is the primary licensing authority for which activity, and in what order the engagements run. Getting that sequencing wrong can produce a fragmented regulatory record that is harder to present coherently later.

Third, cross-border structure and regulatory posture are not separate workstreams. The offshore holding entity's substance position, the intercompany flows, and the Hong Kong subsidiary's licensing status interact. A licensing determination that changes the permitted activities of the Hong Kong entity can have downstream implications for how income is characterised and how the group's tax position is defended. These questions are easier to address before the licensing application is filed than after it has produced a result that constrains the structural options.

If an earlier review, application or engagement has produced an unresolved position, a second read can identify the routes still open and the sequence that best preserves the entity's options. We regularly act on cross-border fintech mandates of this kind, working alongside locally licensed Hong Kong firms on matters that engage Hong Kong law directly.

For a structured assessment of your entity's licensing posture, AML obligations and cross-border structure, write to us at info@lockhartyip.com.

Related practices

Tech & Web3 – licensing, AML and regulatory structure for digital-asset and fintech businesses
Sanctions & AML – compliance file preparation and counterparty due diligence across jurisdictions

For further background on digital-asset structures through Hong Kong, see our guides on structuring a digital-asset fund through Hong Kong and the Mainland and the principal options for a digital-asset fund in the Hong Kong–Mainland corridor. For the full scope of our Tech & Web3 practice, see our practice page.

Frequently asked questions

Which jurisdiction's law applies to a fintech entity and regulatory engagement in Hong Kong?

The primary regulatory instruments are Hong Kong statutes: the Anti-Money Laundering and Counter-Terrorist Financing Ordinance and, where virtual assets engage the definitions of "securities" or "futures contracts", the Securities and Futures Ordinance. The licensing authority is the Securities and Futures Commission for VATP and securities activity, and the Hong Kong Monetary Authority for payment and stablecoin-related activity. Where the entity also has an offshore holding structure – BVI, Cayman or equivalent – the laws of that jurisdiction apply to the holding entity, including its economic-substance obligations. International law and the FATF travel rule apply to cross-border virtual-asset transfers. A coherent regulatory engagement requires all three layers to be addressed in sequence rather than separately.

Do I need a Hong Kong adviser for a fintech entity and regulatory engagement in Hong Kong?

Regulatory engagement with the SFC or HKMA requires an understanding of the specific expectations, documentation standards and procedural conventions that apply to applications and preliminary engagements in Hong Kong. Counsel who advises on international and foreign law can structure the engagement, review the licensing posture, and coordinate the AML and cross-border structural analysis. Matters of Hong Kong law specifically – including the formal submission of licence applications and dialogue with the regulator on points of Hong Kong statutory interpretation – are handled together with locally licensed Hong Kong firms. The two workstreams run in parallel rather than sequentially.

How long does a fintech entity and regulatory engagement in Hong Kong usually take?

The duration depends on the gap between the entity's current position and the standard the regulator applies, and on the complexity of the cross-border structure. A preliminary engagement to clarify the applicable licensing category and the regulator's expectations is typically the first step, followed by document preparation and a formal application. The SFC's licensing process for virtual-asset trading platforms involves detailed scrutiny of fitness and properness, internal controls and AML framework; the timeline varies with the quality and completeness of the application. Entities that have already revised their AML documentation and resolved their structural questions before submitting typically move through the process more efficiently. Parties should verify the current processing timelines with the SFC directly before planning.

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.

Matter note: a fintech entity and regulatory engagement in Hong Kong