Matter note: a stablecoin or digital-asset custody

A fiat-referenced stablecoin custody arrangement operating through Hong Kong requires careful alignment of licensing posture, Anti-Money Laundering and Counter-Terrorist Financing Ordinance obligations, and the regulatory perimeter set by the Hong Kong Monetary Authority – a convergence of rules that became more acute as the HKMA's stablecoin issuer licensing regime moved toward commencement in 2025. This matter note describes, in fully anonymised form, how one such arrangement was re-structured after an initial posture was found inadequate. The sequence, the turning point, and the transferable lesson are set out below.

The note covers the situation and the constraint first, then the issue and the route chosen, followed by the operational sequence and the qualitative outcome. Cross-border counsel at our desk handled the international-law and structuring dimensions; locally licensed Hong Kong firms managed the regulated-activity submissions.

The Situation: a Custody Structure Without a Settled Regulatory Address

The client was a mid-market digital-asset business – incorporated offshore, with operational staff distributed across three time zones – that had developed a custody product centred on a fiat-referenced stablecoin. The product allowed institutional clients to hold, redeem, and transfer stablecoin balances, with Hong Kong designated as the settlement and operations hub. The stablecoin itself was pegged to a major fiat currency and was used as a transfer instrument between counterparties in the Asia-Pacific corridor.

The immediate pressure was not commercial. It was regulatory. The HKMA had signalled the introduction of a licensing regime for fiat-referenced stablecoin issuers, and the Securities and Futures Commission had separately confirmed that where a virtual asset constitutes a "security" or "futures contract," its handling requires SFC licensing under the Securities and Futures Ordinance. The client's existing structure had not been designed around either perimeter. It had been designed around speed to market.

The constraint was a window-closing one. The incoming stablecoin licensing perimeter – once in force – would require a licensed position or a documented basis for exclusion. Neither had been established. Meanwhile, the client's institutional counterparties were beginning to request documentation of the regulatory posture as a condition of continuing the relationship. The commercial and regulatory timelines had converged.

The Issue: Which Regime Applied, and to Whom?

The first legal question was deceptively simple: was the client an issuer of the stablecoin, a custodian of it, or both? The answer determined which regime – the HKMA's stablecoin framework, the SFC's VATP licensing regime under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, or both – applied to the Hong Kong operations.

In our cross-border practice, this question arises more often than it should. Offshore founders designing a product in a jurisdiction with no live stablecoin regime tend to draw a clean line between "issuing" and "holding." Hong Kong's incoming regulatory architecture does not draw that line in the same place. The custodial function – receiving client assets, holding wallet keys, executing redemptions – can engage the Anti-Money Laundering and Counter-Terrorist Financing Ordinance's customer due diligence requirements, and may engage the VATP licensing perimeter, independently of whether the entity formally describes itself as an issuer.

The secondary question was cross-border: the client's offshore parent entity executed certain functions that, if executed from Hong Kong, would plainly have required licensing. Did executing those functions from offshore, while directing Hong Kong operations, bring those functions within the Hong Kong regulatory perimeter? This is a real and unresolved area. Counsel on our desk regularly see offshore operators underestimate the reach of the Hong Kong regime where the client-facing activity – account opening, wallet access, redemption processing – occurs in or through Hong Kong.

The Route Chosen: Sequencing the Regulatory Analysis Before the Structural Change

The client's instinct was to restructure immediately – to move functions, reassign entities, and file a licensing application as quickly as possible. We recommended a different sequence. Before any structural change, the regulatory analysis had to be completed, because the wrong structure, filed in haste, can create a more difficult position than the original one.

The sequence we recommended was: first, a jurisdictional mapping of which functions were performed where and by which entity; second, a characterisation analysis under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance and the Securities and Futures Ordinance to determine whether the stablecoin, on its documented terms, constituted a "security" or remained outside that perimeter; third, a review of the HKMA stablecoin licensing framework to identify the likely application requirements and the substance conditions attached to a Hong Kong-based issuer.

Only after those three steps were complete did the structural question become tractable. The reason matters: a licensing application made by an entity that has already arranged its affairs around the wrong perimeter analysis will surface the error in the application process itself – at a point when the client is already committed to a structure that cannot easily be undone.

The contextual bridge here is important. The sequence above describes the analytical standard. Every client's matter turns on its own documents, its own jurisdiction mix, and the specific characterisation of its product – which is exactly where the outcome is determined.

To discuss the regulatory mapping for a stablecoin or digital-asset custody arrangement, write to us at info@lockhartyip.com.

The Turning Point: Characterisation of the Stablecoin Itself

The turning point in this matter was the characterisation analysis. The stablecoin, as originally documented, contained a feature that – on one reading of the Securities and Futures Ordinance's definition of "debenture" – could have brought it within the definition of a "security." That reading was not inevitable. It depended on how the redemption right was documented and whether the issuer's obligation was read as a debt obligation or as a technical operational undertaking.

The distinction is not academic. If the stablecoin is a "security," the entity handling it for institutional clients requires SFC authorisation under the Securities and Futures Ordinance. The VATP licensing regime under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, which the client had assumed was the only applicable regime, operates alongside the Securities and Futures Ordinance – not in substitution for it. An entity that is a virtual-asset trading platform (a centralised platform for buying and selling virtual assets) and that handles what turns out to be a "security" faces dual-regime obligations.

Working with the client's product and legal teams, the documentation was revised to remove the ambiguity. The redemption mechanics were restructured so that the instrument's character was clear on its face. This is the kind of adjustment that is far easier to make before a licensing application is filed than after, and far easier to make before institutional counterparties have formed a view of the product's legal character.

The AML dimension was parallel. Under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, a virtual-asset trading platform must apply customer due diligence (the process of identifying and verifying counterparties and understanding the source of funds) and must comply with the FATF travel rule (the requirement to transmit originator and beneficiary information with virtual-asset transfers above applicable thresholds). The client's existing AML procedures had been designed for a different product in a different jurisdiction. They required material revision to meet the Hong Kong standard.

The Sequence in Practice

The matter ran in four operational phases. First, the jurisdictional and characterisation analysis – approximately six to eight weeks, involving document review, product analysis, and legal-position papers across the Hong Kong, offshore-parent, and client-facing dimensions. Second, product and documentation revision – the stablecoin terms, the custody agreement templates, and the AML policy were all rewritten to reflect the revised characterisation and the Hong Kong regulatory standard.

Third, the licensing and engagement strategy. The VATP licensing regime under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance commenced 1 June 2023, with the SFC as licensing authority. The client was not yet a licensed VATP, but had a plausible basis, on the revised characterisation, for operating in a manner that did not require VATP licensing – the product, post-revision, was not a centralised platform for buying and selling virtual assets in the ordinary sense. That basis was documented in a legal-position paper prepared for internal governance and for presentation to institutional counterparties on request.

Fourth, the HKMA stablecoin licensing track. The HKMA's fiat-referenced stablecoin licensing regime commenced in 2025 – the exact commencement date and current perimeter should be verified before acting. The client began the pre-application engagement process, documenting the entity's structure, substance in Hong Kong, and compliance arrangements. This phase was ongoing at the time of this note.

The cross-border dimension ran throughout. The offshore parent entity's role was documented to limit the footprint of regulated activity within Hong Kong to the operating entity. Cross-border data and asset flows were mapped against the AML travel-rule requirements. The engagement with locally licensed Hong Kong firms covered the regulated-activity filings and the AML compliance implementation.

If an earlier filing or regulatory engagement in a digital-asset matter has produced an uncertain or adverse result, a second read on the characterisation and structure may identify the route still available. Contact us at info@lockhartyip.com.

The Qualitative Outcome and the Transferable Lesson

The immediate outcome was that the client's institutional counterparties received a clear, documented regulatory-position paper within the quarter. The commercial relationships that had been paused pending regulatory clarity resumed. The licensing track with the HKMA was initiated in an orderly way, without the complications that an ill-structured earlier application would have created.

The transferable lesson is straightforward. Digital-asset businesses – stablecoin issuers and custodians in particular – tend to reach Hong Kong at a moment of product maturity, not at a moment of product design. By the time the Hong Kong regulatory question becomes urgent, the product is already documented, the client relationships are already in place, and the offshore structure is already operating. The cost of revision at that stage is real but manageable. The cost of revision after a licensing application has been made, or after a regulatory enquiry has been received, is substantially higher.

The cross-border element compounds this. An offshore entity directing Hong Kong operations from outside the jurisdiction does not thereby place its activity outside the Hong Kong regulatory perimeter. The question of where a function is "performed" for regulatory purposes is a factual and legal question that turns on the specifics of the arrangement – not on the location of the server or the passport of the founder. Counsel on our desk regularly see this assumption made and regularly see it corrected, at some cost, in the course of a licensing or compliance review.

What does "getting it right" look like in practice? It means: characterising the product before designing the structure; designing the structure before applying for a licence; and applying for the licence before the counterparties form a view of the regulatory position from the outside. The sequence matters because each step forecloses options that would otherwise be available.

For a preliminary assessment of a stablecoin or digital-asset custody arrangement across the relevant jurisdictions – including the Hong Kong licensing and AML position and the cross-border interface with an offshore structure – reach us at info@lockhartyip.com.

Related practices

Tech & Web3 – licensing, AML obligations, and regulatory structure for digital-asset businesses
Sanctions & AML – counterparty review, source-of-funds files, and compliance documentation

Frequently asked questions

What does the route look like for a stablecoin or digital-asset custody arrangement?

The route begins with a characterisation analysis – determining whether the stablecoin or custody product engages the VATP licensing regime under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, the stablecoin issuer licensing regime administered by the HKMA, or both. Once the applicable regime is identified, the structure, documentation, and AML procedures are aligned to that regime, and the licensing or pre-application engagement begins. The sequence matters: structural changes made before the characterisation analysis is complete tend to create further compliance complications rather than resolving them. Throughout, cross-border dimensions – offshore parent entities, international client flows, travel-rule compliance – must be addressed in parallel.

How long does a stablecoin or digital-asset custody arrangement usually take?

The analytical and documentation phase of a stablecoin or custody arrangement typically runs over several weeks to a few months, depending on the complexity of the product and the existing documentation. The licensing phase – whether VATP licensing with the SFC or stablecoin issuer licensing with the HKMA – adds further time, and the exact timeline depends on the completeness of the application, the regulator's current processing practice, and whether pre-application engagement is required. Parties should verify current processing timelines directly with the relevant regulator before acting, as these change as the regime matures.

How does the cross-border element affect a stablecoin or digital-asset custody arrangement?

The cross-border element is often the most underestimated aspect of a Hong Kong digital-asset or stablecoin matter. An offshore entity directing client-facing activity through Hong Kong does not thereby place that activity outside the Hong Kong regulatory perimeter. The Anti-Money Laundering and Counter-Terrorist Financing Ordinance and the Securities and Futures Ordinance both apply based on where regulated functions are performed, not where the parent entity is incorporated. Cross-border data and asset flows also engage the FATF travel rule, which requires originator and beneficiary information to accompany virtual-asset transfers. Mapping the full jurisdictional footprint – Hong Kong operations, offshore parent, and client-facing flows – is a prerequisite to any sound licensing or compliance strategy.

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.

Matter note: a stablecoin or digital-asset custody arrangement