A fintech entity and regulatory engagement in Hong Kong

A foreign principal deciding to establish a fintech presence in Hong Kong faces a question that cannot be answered by reviewing a single statute: which regulator applies, under which instrument, and in what sequence? The answer depends on the nature of the activity – whether the entity will trade virtual assets, issue stablecoins, accept client money, or operate a payment infrastructure. Each path carries a different licensing posture, a different set of ongoing obligations, and a different timetable. Getting the entity structure right before the regulator engagement begins determines whether the process runs on a predictable footing or stalls.

A fintech entity operating in Hong Kong requires licensing or authorisation under one or more instruments – principally the Anti-Money Laundering and Counter-Terrorist Financing Ordinance for centralised virtual-asset trading platforms, the Securities and Futures Ordinance where virtual assets qualify as securities, and the Hong Kong Monetary Authority's fiat-referenced stablecoin regime commenced in 2025 – with mandatory AML and customer-due-diligence obligations running from the date the regime applies. The Securities and Futures Commission and the Hong Kong Monetary Authority are the primary licensing authorities; which one leads depends on what the entity actually does.

This note sets out when a foreign principal needs a structured engagement, the route we run, the documents and decisions the client must own, and the cross-border interface that shapes every step.

When does the window open – and when does it close?

The licensing window for a centralised virtual-asset trading platform in Hong Kong opened on 1 June 2023, when the mandatory regime under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance commenced. From that date, operating without a licence – or without an active application on file – creates direct regulatory exposure. For the fiat-referenced stablecoin issuance regime, the Hong Kong Monetary Authority commenced its licensing framework in 2025; parties should verify the current commencement date and perimeter before acting, as the regime continues to be refined.

The trigger that typically brings a foreign principal to our desk is not the first awareness of these instruments. It is a specific commercial event: a prospective Mainland Chinese or European institutional counterparty requiring proof of regulatory status before it will engage, a fund's investment committee conditioning a close on a clean licensing position, or a product launch timeline running into a regulatory deadline. Each of these events converts a known background obligation into an immediate operational problem.

In our cross-border practice, the principals who are most exposed are those who structured their entity offshore – commonly in the BVI or Cayman Islands – on the assumption that a non-Hong Kong holding entity removes Hong Kong regulatory touch. It does not. What matters is the nexus of the activity: where the platform operates, where clients are onboarded, and where the orders or transfers are processed. A Cayman-incorporated entity running operations from Hong Kong is, in substance, within scope.

The governing instruments and the regulators that apply

The primary licensing instrument for centralised virtual-asset trading platforms is the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, under which the Securities and Futures Commission is the licensing authority. Where a virtual asset constitutes a "security" or "futures contract" as defined under the Securities and Futures Ordinance, a second licensing layer applies under that Ordinance, again with the SFC as regulator. The two regimes can run concurrently; the entity and its structure must be designed to accommodate both filing tracks.

For fiat-referenced stablecoin issuers, the Hong Kong Monetary Authority administers the licensing regime. The HKMA and the SFC have coordinated their supervisory approach in the area of virtual assets, but they operate distinct licensing processes, issue distinct conditions of authorisation, and conduct distinct ongoing supervision. A fintech entity whose product sits at the boundary – a stablecoin that could also be treated as a structured product – may need to address both authorities in sequence or in parallel.

AML obligations attach across all three regimes. Virtual-asset trading platforms are subject to customer due diligence requirements and the FATF travel rule (the Financial Action Task Force's requirement that originator and beneficiary information accompany virtual-asset transfers above a defined threshold) for virtual-asset transfers. These obligations are not conditions imposed later at the licence stage. They apply from the point the regime covers the entity's activity. An entity that defers its AML programme design to the post-licence period is structuring backwards.

The sequence of the governing instruments is therefore: identify the activity, map it against each regime, determine which authority leads, and then build the entity and its compliance infrastructure in the order those authorities require.

For a preliminary read on your licensing posture and the regulatory route, email info@lockhartyip.com.

How does the cross-border structure affect the regulatory engagement?

Every fintech principal we advise on a Hong Kong regulatory engagement operates across at least two legal systems. The common configurations are: a Mainland Chinese technology group establishing a Hong Kong licensed entity to service international clients; a European or CIS-based payment operator using Hong Kong as its Asia hub, with the ultimate holding entity in the BVI or Cayman Islands; or a UAE-based virtual-asset group building out a Hong Kong presence to access Greater China capital flows. In each case, the Hong Kong regulatory engagement is not isolated from the offshore and home-jurisdiction structures – it intersects with them at the points that regulators examine most closely.

The SFC and the HKMA both look through the corporate structure to the ultimate beneficial owner and the group's wider regulatory history. A group that holds a licence revoked in another jurisdiction, or that is under active investigation elsewhere, must address that position as part of the Hong Kong application. This is not a technical filing point; it is a fit-and-proper determination that goes to the heart of whether the application proceeds. Foreign principals underestimate how directly their group's compliance history in the EU, the UAE or Mainland China bears on the Hong Kong process.

The offshore holding layer – BVI or Cayman – introduces a second dimension. The economic-substance regimes in both jurisdictions require that entities with certain activities maintain genuine substance in the jurisdiction of incorporation. A BVI holding company sitting above a Hong Kong licensed operating entity must meet BVI substance requirements for the activities it holds. That is a matter for offshore counsel; our role is to flag the interface and ensure the Hong Kong structure is designed with those requirements in view, working alongside allied counsel admitted in the relevant offshore jurisdictions.

Mainland China's regulatory posture on virtual assets adds a third layer. Mainland-connected entities, Mainland investors, or platforms that in any way service Mainland users face a specific set of restrictions under PRC law. The Hong Kong licensed entity does not cure a Mainland prohibition on virtual-asset activity. The two systems are legally distinct – one country, two systems, with different substantive rules – and a Hong Kong licence does not create any Mainland permission, exemption, or passporting right. This is a point on which foreign counsel instructed from outside Asia regularly err, and it is one of the most material risks in a cross-border fintech structure.

The route we run and where locally licensed counsel join

Our engagement on a fintech regulatory matter runs in four stages, each with a defined set of deliverables and decision points.

The first stage is the scoping review. We assess the entity's activity, the corporate structure, the jurisdiction of incorporation, and the group's existing regulatory status. We map the activity against the applicable Hong Kong regimes and identify which regulatory authority leads. We also identify the offshore-substance and cross-border issues that will need to be managed in parallel. This stage produces a written route map: which licences are required, in what order, with what pre-conditions.

The second stage is entity and structure preparation. The entity through which the Hong Kong application is made must be correctly incorporated, properly governed, and ready for regulatory scrutiny before the application goes in. Corporate constitution, shareholding structure, directorship, and the nominee or authorised representative arrangements must all be in order. For matters of Hong Kong company incorporation and governance, we work alongside locally licensed Hong Kong firms, whose instruction we coordinate. The client's task in this stage is to make the key ownership and governance decisions that we document and that locally licensed counsel execute.

The third stage is the regulatory filing and engagement. The application to the SFC or the HKMA – or both – requires a complete, accurate, and internally consistent submission. Regulators in Hong Kong are sophisticated and well-resourced. An incomplete or inconsistent application creates queries that delay the process and sometimes create a record that the applicant then carries into the substantive licensing review. We prepare the regulatory narrative, review supporting documents, and coordinate the response to queries. We do not hold ourselves out as practising Hong Kong law; the formal submission mechanics and any advocacy before the regulator that requires a Hong Kong-law position are handled with locally licensed firms.

The fourth stage is the AML programme design and ongoing compliance infrastructure. A licence application that does not include a credible AML programme – customer due diligence, transaction monitoring, travel rule compliance, governance, and escalation protocols – will not proceed. We review the AML framework, map it against the requirements of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance and the regulators' published AML guidelines, and work with the client's internal compliance function or, where one does not yet exist, with allied compliance advisers. This stage runs concurrently with stage three and carries into the post-licence period.

If an earlier filing or a prior regulatory engagement produced a stalled result or an adverse query, a second read can identify the structural error and the routes still open. Write to us at info@lockhartyip.com to discuss.

The documents and decisions the client must own

A fintech regulatory engagement in Hong Kong cannot be run by external counsel alone. There is a set of documents and decisions that must originate with the client – with the principal who owns the business, controls the entity, and will be assessed for fit and proper status.

The first is the business plan. Regulators require a credible, detailed, and honest account of what the entity will do, who its clients will be, what products it will offer, and how it will manage risk. A business plan written to look good rather than to accurately describe the activity will not survive regulatory scrutiny. The client must produce a plan that reflects the actual intended operations, including the client segments that carry the highest risk.

The second is the source of funds and source of wealth documentation for the ultimate beneficial owners. The fit-and-proper assessment includes an examination of the origin of the capital being deployed into the licensed entity. This is not merely a form-filling exercise. Where the capital originates from a group with complex corporate layers, a cross-border investment history, or prior regulatory encounters, the documentation must be assembled carefully and presented in a coherent narrative.

The third is the key person appointments. The responsible officers, executive directors, and compliance function heads who will appear on the licence application must be identified, agreed, and in a position to provide the personal history, qualifications, and regulatory-clearance materials the regulators require. Where a foreign principal proposes to appoint individuals with no Hong Kong regulatory track record, additional supporting material is typically required. This decision – who leads the licensed entity – is a business decision, not a legal one, and the client must own it.

The fourth is the governance documents: the board resolutions, the constitutional documents, the internal policies (AML policy, conflicts policy, risk management framework), and the service-level arrangements between the Hong Kong entity and any group entity providing services to it. These documents create the regulatory paper trail that the SFC or the HKMA will examine both at the application stage and on an ongoing basis after the licence is granted.

A micro-scenario illustrates the sequencing risk. An Asian technology group with a BVI holding company and a proposed Hong Kong operating entity for a virtual-asset trading platform came to our desk in late 2027. The group had a complete product and a credible commercial plan, but the BVI entity's ownership structure had not been updated to reflect a change in ultimate beneficial ownership following a private equity investment two years earlier. The Hong Kong application could not proceed on the existing structure. We worked with the group to regularise the BVI layer through allied offshore counsel, then re-ran the scoping review with an accurate ownership map, and prepared the SFC application on a correct basis. The matter moved once the foundation was correct.

Common mistakes and risk points for foreign principals

The first mistake is treating the licensing process as administrative rather than substantive. Hong Kong's virtual-asset regimes were designed after careful study of failures in other jurisdictions. The SFC and the HKMA are not processing applications; they are making judgments about whether an entity and its principals are fit to operate in a systemically significant market. A foreign principal who approaches the process with a tick-box mentality will encounter a regulator who does not share that expectation.

The second mistake is timing. The regulatory engagement takes time – not because the system is slow, but because the preparation that must precede the application is substantive. A foreign principal who starts the process with a product launch date already fixed, and treats the regulatory engagement as a parallel-track formality, is creating a compressible deadline that will either be missed or met by cutting corners that the regulator will later identify.

The third mistake, noted above, is assuming that an offshore incorporation removes Hong Kong regulatory exposure. The substance of the activity determines the regulatory perimeter, not the place of incorporation. This is well-established in Hong Kong regulatory enforcement history and in the published guidance of both the SFC and the HKMA.

The fourth mistake is underestimating the AML obligations. The FATF travel rule, customer due diligence, ongoing transaction monitoring, and the suspicious-transaction reporting obligations are not light-touch. For a platform whose client base includes cross-border flows from Mainland China, CIS markets, or the Middle East, the risk segmentation and the documentation demands are material. An AML programme designed for a domestic retail client book will not meet the standard required of a cross-border virtual-asset platform in Hong Kong.

The fifth mistake is failing to coordinate the Hong Kong engagement with the entity's obligations in other jurisdictions. A Hong Kong licensed entity that is also subject to AML obligations in the EU, a registration requirement in Singapore, or a customer-access restriction in the UAE must manage those obligations as a system, not as separate files. The Hong Kong regulator will ask about the group's global compliance posture. The answer must be coherent.

Decision matrix: activity, regulator, instrument, timing, risk

A foreign principal mapping the regulatory engagement for a proposed Hong Kong fintech entity faces one of four common configurations.

Situation A: the entity will operate a centralised virtual-asset trading platform – matching buy and sell orders in virtual assets, whether or not those assets are securities. The lead regulator is the SFC. The primary instrument is the Anti-Money Laundering and Counter-Terrorist Financing Ordinance. The licensing application requires a complete submission before the entity begins operating. The principal risk is operational: commencing operations without a licence or a grandfathered application in place creates direct regulatory exposure and a public enforcement record.

Situation B: the entity will trade or deal in virtual assets that constitute securities or futures contracts. The SFC leads under the Securities and Futures Ordinance, with the AMLO licensing layer running in parallel. The timing risk is significant: the analysis of whether a specific virtual asset is a security requires a considered legal assessment before the product is launched, not after. A platform that launches and then discovers its primary product is a security is in a worse position than one that never applied.

Situation C: the entity will issue fiat-referenced stablecoins. The HKMA leads under the stablecoin licensing regime commenced in 2025. The timing risk here is that the regime is still being developed; the current commencement date and perimeter should be verified before any application planning begins. The structural risk is that the entity's reserve management, redemption obligations, and governance will be examined with the same intensity as a bank's balance sheet.

Situation D: the entity will provide a payment or money-service function that is not primarily a virtual-asset activity. The regulatory route may lead to the HKMA under a different instrument, or to a combination of HKMA oversight and AML obligations under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance. This configuration often arises in cross-border remittance operations where a CIS-based or Middle Eastern group is using Hong Kong as a processing hub. The regulatory analysis must precede the entity formation, not follow it.

Across all four situations, the AML obligations attach from the point the regime applies. They are not post-licence conditions. And the cross-border interface – the group structure above the Hong Kong entity, the jurisdictions from which clients will be onboarded, the currencies and asset classes in play – must be mapped before the application is filed.

Self-assessment checklist for a Hong Kong fintech regulatory engagement

A foreign principal preparing for a regulatory engagement in Hong Kong should be able to answer the following questions before the engagement begins. Where the answer to any question is uncertain, that is the point at which external counsel adds value.

First, what is the precise activity of the proposed Hong Kong entity? Is it trading, custody, dealing, issuance, payment, or a combination? The answer determines which regulator leads and which instrument applies.

Second, who is the ultimate beneficial owner, and is the ownership structure accurately documented? Has any change in ownership occurred at any level of the group structure in the past three years?

Third, what is the group's regulatory history in other jurisdictions? Has any entity in the group held a licence that was revoked, suspended, or subject to conditions? Has any group entity been the subject of regulatory inquiry?

Fourth, does the proposed entity have an AML programme in place, or a credible plan to implement one, before the application is filed? Does that programme address the travel rule, customer due diligence for the specific client segments the entity will serve, and the cross-border transaction-monitoring obligations?

Fifth, what is the offshore structure above the Hong Kong entity? Does it meet the economic-substance requirements of the jurisdiction of incorporation? Have allied counsel in the offshore jurisdiction confirmed that position?

Sixth, if the target client base includes Mainland Chinese users, how has the group addressed the PRC's restrictions on virtual-asset activity? Is the Hong Kong entity ring-fenced from Mainland-facing operations in a way that the regulators and the group's board can document?

Seventh, what is the realistic timetable? Is the commercial plan contingent on a licence being in place by a fixed date? If so, has that date been stress-tested against the actual preparation and filing timeline?

A second micro-scenario: a European payment technology group with a UAE commercial presence and a proposed Hong Kong entity for cross-border virtual-asset settlement came to our desk in early 2028. The group's UAE entity had undergone a compliance review by its local regulator eighteen months earlier; the outcome was a conditional clearance with enhanced reporting requirements. The Hong Kong SFC application required disclosure of that history and a clear account of how the group's compliance function had addressed the conditions. We prepared the regulatory narrative, coordinated the disclosure approach with the group's internal compliance team, and worked with locally licensed Hong Kong firms on the formal submission. The application proceeded on a complete and consistent basis.

For a structured assessment of your fintech entity's regulatory position across Hong Kong and the relevant offshore jurisdictions, write to us at info@lockhartyip.com.

Related practices

• Tech & Web3 – virtual-asset licensing, AML, and cross-border compliance for fintech and Web3 entities
• Sanctions & AML – counterparty review, source-of-funds files, and sanctions-neutral contracting

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

Related

• Tech Web3
• Ip Licensing Technology Group Expanding Into Asia Matter
• Stablecoin Or Digital Asset Custody Arrangement Guide

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.