Matter note: structuring a Web3 business

Structuring a Web3 business through Hong Kong requires a clear read on which regulatory regime applies, which entity sits in Hong Kong, and how the cross-border interface – typically between the Hong Kong operating entity and an offshore holding layer in the BVI or the Cayman Islands – interacts with the licensing requirements imposed by the Securities and Futures Commission and, where stablecoin issuance is in scope, the Hong Kong Monetary Authority. The governing instruments are the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, which houses the mandatory virtual-asset trading platform licensing regime that commenced on 1 June 2023, and the Securities and Futures Ordinance, which applies wherever the virtual asset in question constitutes a "security" or a "futures contract" under Hong Kong law.

This matter note describes how our desk approached a structuring mandate of this kind. All client-identifying facts have been removed. The analytical sequence and the turning points are set out because they recur – and because the structural errors our desk encounters most often in this space follow a recognisable pattern.

The situation: an operating group arriving at the wrong door

The client was a technology group with operations across two jurisdictions, deploying a centralised digital-asset exchange product and a token portfolio that included assets with characteristics placing them close to the regulatory boundary between utility and security. The group had incorporated its primary operating entity in the BVI and had been running for over a year without a licensing assessment. Its founders had relied on offshore incorporation as a proxy for regulatory distance from Hong Kong, which is a mistake our desk sees with some frequency.

The group's commercial reason for wanting Hong Kong as a hub was legitimate and well-articulated: its target institutional clients sat in the Greater Bay Area and in Singapore, the group wanted the credibility and the banking infrastructure that a Hong Kong licensed entity provides, and it wanted to access the legal system that the common-law courts and arbitration infrastructure here represent. None of those objectives were in conflict with regulatory compliance. The conflict was with the structure the group had already put in place.

The structural complexity here lay not in any single piece but in the sequence of decisions that had already been taken – entity, product, token classification, and customer base – before the licensing question had been addressed. Unwinding and re-sequencing that accumulation was the work.

What was the regulatory issue, and which instruments governed it?

The central issue was whether the group's exchange product required a licence under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance as a virtual-asset trading platform (VATP) – a centralised platform facilitating the buying and selling of virtual assets, subject to mandatory licensing by the Securities and Futures Commission under the regime that became operative on 1 June 2023. The answer turned on two questions: whether the platform was "operating in Hong Kong" within the meaning of the regime, and whether any of the assets traded constituted securities or futures contracts, which would engage the Securities and Futures Ordinance as a second, parallel licensing track.

The BVI incorporation did not resolve either question. The "operating in Hong Kong" test applies to substance and conduct, not to the jurisdiction of incorporation. A platform that actively markets to Hong Kong users, has technical infrastructure with a Hong Kong nexus, or is directed and controlled from Hong Kong can be within scope regardless of where its holding entity is registered. The group's commercial and operational reality meant it was well within scope.

On the securities question, the token portfolio required a classification exercise conducted against the Securities and Futures Ordinance's definition of a "collective investment scheme" and related concepts. Several of the tokens in the portfolio had characteristics – investor expectation of return, pooling of contributions, and management by a third party – that placed them squarely within the definition. That triggered the secondary licensing analysis.

The group had also accepted customer deposits and facilitated transfers across the platform, which engaged the customer due diligence and travel rule (the FATF requirement that virtual-asset transfers carry originator and beneficiary information) obligations imposed on VATPs under the AML/CTF framework.

How did we sequence the analysis and where was the turning point?

Our first step was a classification and scoping exercise. Before any structural recommendation could be made, the token portfolio and the platform functionality had to be mapped against the VATP licensing criteria and the Securities and Futures Ordinance definitions. That exercise produced a clear picture: the platform required VATP licensing, three of the tokens in the portfolio required a licensed entity to deal in them, and the AML obligations were already engaged.

The turning point came when that scoping exercise was placed alongside the group's existing structure. The BVI holding entity above, the operational reality in Hong Kong below, and the intention to market to institutional clients in the Greater Bay Area and Singapore created a specific cross-border configuration. The BVI layer was not wrong in principle – offshore holding above a Hong Kong operating entity is standard across this practice. The problem was that the Hong Kong operating entity had never been incorporated, its functions had been attributed to the BVI entity, and there was no compliance architecture sitting beneath the platform.

The structural recommendation was to establish a Hong Kong operating entity as the VATP applicant, re-attribute the operational and customer-facing functions to that entity, and build the compliance architecture – AML policies, travel rule procedures, customer due diligence processes, and internal controls – to the standards required by the Securities and Futures Commission's licensing conditions. The BVI entity was retained but repositioned as the holding layer only, with no operational or customer-facing role.

The cross-border dimension did not end at the Hong Kong–BVI interface. For the group's Greater Bay Area institutional clients, the question of how service agreements and client documentation would read across the Mainland–Hong Kong legal interface required separate attention. We coordinated that aspect with allied counsel admitted in the relevant Mainland jurisdiction.

The sequence and the compliance architecture

The implementation sequence ran as follows. First, the Hong Kong operating entity was incorporated under the Companies Ordinance (Cap. 622), with its Significant Controllers Register established from inception as required under that statute – a step that VATP applicants cannot afford to have outstanding when they engage with the Securities and Futures Commission. Second, the substance and control analysis was conducted to confirm that the operational management of the platform was genuinely Hong Kong-seated, which is a licensing condition, not merely a structural preference. Third, the AML compliance programme was designed and documented: this included a customer due diligence policy, transaction monitoring procedures, a travel rule protocol for cross-border virtual-asset transfers, and a sanctions screening procedure aligned with Hong Kong's United Nations sanctions obligations.

Hong Kong implements United Nations sanctions and does not give domestic effect to unilateral measures of other states. For a group with institutional clients across multiple jurisdictions, that distinction has practical consequences for the sanctions screening design. The programme documented both the scope of what Hong Kong law required and the group's own risk-based decisions above that floor.

Fourth, the token classification work was formalised in a legal opinion that could be presented to the Securities and Futures Commission as part of the licensing file. That opinion addressed each asset class in the portfolio and drew the line between assets that were and were not within the Ordinance's scope. Where an asset was borderline, the opinion documented the analysis rather than simply asserting a conclusion – regulators respond better to reasoned analysis than to bare conclusions.

Fifth, the client documentation and service agreements were reviewed and revised to reflect the licensed entity structure and to comply with the disclosure requirements that apply to licensed VATPs.

For a note on how stablecoin-related activities and digital-asset custody arrangements interact with this structure, see our guidance on stablecoin and digital-asset custody. Cross-border data and commercial agreements touching the Mainland raise a distinct set of issues addressed in our analysis of cross-border SaaS and data agreements.

The outcome and the transferable lessons

The group entered the licensing process with a compliant operating structure, a documented compliance architecture, and a token classification opinion on file. The qualitative outcome – a defensible licensing position, a clean entity structure, and a compliance programme that addressed both the VATP regime and the Securities and Futures Ordinance parallel track – reflected the investment in sequencing the analysis correctly before the licensing engagement began.

Three lessons from this matter recur across the Web3 structuring work our desk handles.

First, offshore incorporation is not a licensing answer. The "operating in Hong Kong" test is a conduct and substance test, not a registration test. A group that markets to Hong Kong users or is directed from Hong Kong is within scope of the VATP regime regardless of where its entities are registered. Founders who assume otherwise arrive at the licensing question late and with a structure that needs re-engineering before it can be used.

Second, token classification is not a one-time exercise. A portfolio that today contains only utility tokens may, as the product evolves, acquire assets with security characteristics. A licensing programme that does not build in an ongoing classification review creates regulatory exposure at the point when the portfolio changes.

Third, the cross-border interface requires explicit attention. A Hong Kong-licensed VATP serving Greater Bay Area institutional clients operates across two distinct legal systems: the common-law system in Hong Kong and the Mainland legal system governing the clients, their agreements, and any Mainland-side regulatory implications. Those two systems do not resolve into a single answer by default. The group that treats structuring as a purely Hong Kong question will encounter the cross-border dimension later, at a point when it is harder to address.

For a broader account of the Tech & Web3 practice and the structuring, licensing, and AML work our desk undertakes, visit our Tech & Web3 practice page.

Related practices

Sanctions & AML – AML programme design, travel rule compliance, and counterparty due diligence
Holding Structures – offshore and onshore entity positioning for operating groups

Frequently asked questions

Which jurisdiction's law applies to structuring a Web3 business through Hong Kong?

The primary regulatory regime is Hong Kong law: the Anti-Money Laundering and Counter-Terrorist Financing Ordinance governs VATP licensing, and the Securities and Futures Ordinance applies where virtual assets meet the definition of a security or futures contract. The offshore holding layer – typically BVI or Cayman – is subject to its own substance requirements. Where clients or counterparties are Mainland-based, Mainland law governs that relationship, requiring coordination across both systems. There is no single governing law; the structuring exercise maps which law applies to which function.

What is the first step in structuring a Web3 business through Hong Kong?

The first step is a classification and scoping exercise: identifying whether the platform and its token portfolio require VATP licensing under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, whether any asset constitutes a security or futures contract under the Securities and Futures Ordinance, and whether the AML and travel rule obligations are already engaged. That exercise determines the licensing track, the entity structure, and the compliance architecture that the group needs before it can engage with the Securities and Futures Commission as a licensing applicant.

What are the main risks in structuring a Web3 business through Hong Kong?

The principal risks are misclassifying the licensing trigger – assuming offshore incorporation removes Hong Kong regulatory exposure when the conduct test says otherwise – underestimating the parallel Securities and Futures Ordinance track where tokens have security characteristics, and building a compliance architecture that addresses only the initial product rather than the evolving portfolio. The cross-border dimension adds a further layer: groups serving Greater Bay Area or multi-jurisdiction clients must manage the interface between Hong Kong's common-law system and the legal systems governing their clients, which requires coordination beyond a purely Hong Kong-focused structuring exercise.

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.

Matter note: structuring a Web3 business through Hong Kong