A stablecoin or digital-asset custody

A stablecoin or digital-asset custody arrangement sitting inside Hong Kong's regulatory perimeter requires a clear licensing posture under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (the principal AML statute governing virtual-asset trading platforms), engagement with the Securities and Futures Commission as the licensing authority for centralised platforms, and – where the arrangement touches fiat-referenced stablecoins – a separate licensing determination under the Hong Kong Monetary Authority's stablecoin issuer regime that commenced in 2025. The question of which regime applies, and in what combination, is the first decision the foreign principal must own.

For a group approaching Hong Kong from outside – whether from Central Asia, the Middle East, Europe or the Mainland – the licensing question rarely arrives alone. It arrives with an AML file to build, a custody structure to document, a cross-border counterparty flow to map, and a set of corporate decisions that will bind the arrangement for years. This note describes the route we run, where locally licensed Hong Kong firms join, and what the client must resolve before the first engagement.

When does a foreign principal need this, and what triggers the engagement?

The trigger is almost always regulatory exposure: a group that has operated a digital-asset business – custody, trading, issuance – in a lighter-touch environment decides to enter, or has already entered, Hong Kong's market without a clear view of its licensing obligations. The mandatory licensing regime for centralised virtual-asset trading platforms commenced 1 June 2023, and the stablecoin issuer regime followed in 2025. Late engagement is common. It is also expensive.

The specific moments that bring a matter to us vary. A foreign custodian signs an institutional client in Hong Kong and only then asks whether it needs a licence. A Mainland-facing stablecoin issuer is asked by its banking counterparty to produce a Hong Kong regulatory opinion. A fund sponsor structures a digital-asset custody arrangement through a BVI vehicle and discovers that the management function sits, in substance, in Hong Kong. Each scenario is different in its sequence; the underlying exposure is the same.

What foreign principals often misread is the perimeter. The Securities and Futures Commission licenses centralised virtual-asset trading platforms under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, but where a virtual asset qualifies as a "security" or "futures contract" under the Securities and Futures Ordinance, additional licensing obligations apply concurrently. Custody is not exempt from this analysis. A custodian holding tokenised securities is not the same thing as a custodian holding utility tokens, and the regulatory file differs accordingly.

Our desk sees this pattern regularly: a group that manages the corporate and commercial layer competently has never performed the threshold analysis that determines which regime applies and in what form. That analysis is the start of every engagement.

What are the governing instruments and which regulator actually applies?

The Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) is the primary instrument. It establishes the mandatory licensing regime for centralised virtual-asset trading platforms and gives the Securities and Futures Commission its licensing and supervisory powers over those platforms. The SFC's published licensing criteria, conditions and guidelines operate beneath the Ordinance and set the operational and governance standards a platform must meet.

Where a virtual asset is a security or futures contract, the Securities and Futures Ordinance (SFO) applies in parallel. A custody arrangement for tokenised equities or debt instruments therefore engages both the AMLO regime and the SFO licensing matrix. These do not replace each other; they run concurrently. The client that assumes one licence resolves the other is operating on a misunderstanding that the SFC will eventually correct.

For fiat-referenced stablecoin issuers, the Hong Kong Monetary Authority is the relevant licensing authority under the stablecoin regime that commenced in 2025. The HKMA and the SFC are distinct regulators. A stablecoin issuer that also operates a platform for its own stablecoin may face both regulators simultaneously, with different application processes, different reserve and governance requirements, and different ongoing reporting lines.

The United Nations Sanctions Ordinance gives domestic effect to UN-mandated sanctions measures. Hong Kong does not give domestic effect to unilateral measures of other states, but a group operating across jurisdictions must map the sanctions posture in each market its platform touches. AML obligations under the AMLO – customer due diligence, the FATF travel rule for virtual-asset transfers, transaction monitoring – apply across the platform regardless of where the client sits.

The cross-border interface: Hong Kong as hub, and the jurisdictions alongside it

A digital-asset custody arrangement seldom sits in a single jurisdiction. The most common structure our desk sees positions Hong Kong as the licensed operating entity – the regulated hub – while a BVI or Cayman Islands holding vehicle sits above it, a Mainland-facing sub-fund or client base generates the transaction flow, and a UAE or Singapore entity handles specific origination or distribution. Each layer creates a distinct legal interface.

The BVI and Cayman Islands are common-law holding centres widely used above Hong Kong operating companies. Their economic-substance regimes apply to holding and financing entities, and a passive BVI vehicle that receives management decisions taken in Hong Kong may not satisfy its own jurisdiction's substance requirements. This is a structural decision that must be taken early, not resolved retroactively.

The Mainland dimension is material for many of our clients. Hong Kong implements the one country, two systems framework; the legal systems are distinct. A Hong Kong-licensed custodian does not automatically have permission to solicit or serve Mainland retail clients, and the custody of virtual assets has its own regulatory treatment on the Mainland that differs sharply from the Hong Kong position. Cross-border flows – whether of assets, of client funds, or of data – must be mapped against both legal systems before the arrangement goes live.

The UAE is a common second jurisdiction in the corridors our clients use. For a group operating from Abu Dhabi or Dubai alongside a Hong Kong hub, the licensing analysis runs in both directions. We advise on the international and cross-border layer; for in-scope UAE regulatory matters, allied counsel admitted in the relevant jurisdiction join the team. The same coordination model applies for Singapore, the United Kingdom, and Cyprus, each of which appears regularly in the structures we advise on.

Enforcement is the test of the structure. If a custody arrangement is challenged – by a regulator, a counterparty, or a receiver in insolvency – the question is whether the legal architecture holds across all the jurisdictions where assets or obligations sit. That analysis is harder to perform after the challenge arrives than before. See also our work on a digital-asset fund structured through Hong Kong and the UAE, which raises a parallel enforcement-and-structure question.

The sequence of steps decides the outcome. A foreign principal that builds the cross-border analysis into the initial structuring phase has a fundamentally different risk profile from one that treats it as a post-launch compliance exercise.

How does the route run, step by step?

The first step is a licensing and perimeter review. We identify which activities are in scope under the AMLO, the SFO, and – where stablecoins are involved – the HKMA regime. This review produces a written position on the applicable licensing obligations, the regulatory authority or authorities involved, and the interaction between regimes. It is the document the client needs before any application or restructuring step begins.

The second step is a structural review. We assess the existing corporate architecture – the Hong Kong entity, the offshore holding layer, any Mainland or UAE presence – against the licensing and substance requirements of each jurisdiction. Where the structure does not support the intended licensing posture, we model the restructuring options. This step involves parallel input from locally licensed Hong Kong firms with whom we work, because the entity-level steps – incorporation, registration, board composition – require Hong Kong-law advice.

The third step is the AML and compliance file. Every licensed platform in Hong Kong must maintain customer due diligence procedures, a risk-based AML programme, travel rule compliance for virtual-asset transfers, and an ongoing transaction-monitoring function. We review the client's existing procedures against the SFC's and HKMA's published requirements and prepare the gap analysis. The client owns the decision on remediation; we document the standard and the steps.

The fourth step is the custody documentation. A custody arrangement involves a custodian agreement, a safekeeping deed, instructions on the segregation of client assets, a key-management protocol, and – for institutional arrangements – a set of representations regarding the client's own regulatory status and jurisdiction of operation. We draft or review these documents from a cross-border perspective, working with locally licensed counsel on Hong Kong-specific legal requirements and with allied counsel on any additional jurisdiction.

The fifth step, where an application is being made, is regulatory engagement preparation. We do not act as Hong Kong-admitted solicitors in the application process; locally licensed Hong Kong firms carry that role. We prepare the international and cross-border components: the description of the group structure, the cross-border client flow analysis, the sanctions and AML framework document, the governance narrative for multi-jurisdictional operations. These are the components that a regulator reviewing a cross-border custody arrangement will scrutinise most closely.

Throughout, the client receives a live decision log. Licensing and structuring produce a series of binding choices – the identity of the licensed entity, the governance model, the client perimeter, the asset segregation approach. Each choice made early constrains the options available later. We track those choices and their downstream consequences in real time.

What does the micro-scenario look like in practice?

A Central Asian digital-asset group had been operating a custody service for institutional clients from a Cayman-incorporated vehicle. In late 2025, two of its largest clients – both Hong Kong-based family offices – asked the group to bring the custody function into a Hong Kong entity to meet their own internal governance requirements. The group had not previously engaged the AMLO regime and had no view on whether its proposed Hong Kong entity would constitute a centralised virtual-asset trading platform under the Ordinance.

We ran the perimeter analysis across three instruments: the AMLO, the SFO (because several of the assets under custody were tokenised debt instruments), and the HKMA stablecoin regime (the group held a small position in a fiat-referenced stablecoin on behalf of one client). The analysis confirmed that the proposed Hong Kong entity would be in scope under the AMLO and the SFO simultaneously. The Cayman holding vehicle required a substance assessment before the restructuring step.

The client owned the decision to proceed with a Hong Kong entity and instructed locally licensed Hong Kong counsel to carry the incorporation and application steps. We prepared the cross-border components of the regulatory submission, drafted the custodian agreement and safekeeping documentation, and coordinated the AML gap analysis. The matter completed within one application cycle. The client's institutional clients confirmed their internal governance requirement had been satisfied.

A second pattern: a European stablecoin issuer approached our desk in early 2026 after its banking correspondent raised a query about its Hong Kong client-acquisition activities. The issuer had not analysed whether those activities placed it within the HKMA's stablecoin issuer perimeter. We produced the perimeter analysis and confirmed that the issuer's Hong Kong activities, taken as a whole, were in scope. The issuer restructured its Hong Kong-facing operations before the banking correspondent's review concluded. The restructuring avoided a disclosure that would have been materially adverse.

What documents and decisions does the client own?

The client must own five categories of decision. No adviser can resolve them on the client's behalf, and the consequences of getting them wrong fall on the client, not on counsel.

First: the licensed entity decision. Which entity in the group will be the licensed operator? This determines the jurisdiction of incorporation, the governance requirements, the capital and reserve obligations, and the ultimate ownership structure that the regulator will review. It is also the entity that carries the regulatory liability if something goes wrong.

Second: the client perimeter decision. Which clients will the Hong Kong-licensed entity serve? Retail versus institutional treatment differs under the AMLO regime. Mainland clients raise additional cross-border questions. Clients from sanctions-sensitive jurisdictions require enhanced due diligence under the AML programme. These are commercial and risk decisions that the client must take in writing before the AML programme is built around them.

Third: the asset segregation model. How are client virtual assets held, segregated, and documented? A custodian that commingles client assets with its own – even temporarily – faces both a licensing condition breach and a potential civil liability under the custody agreement. The key-management protocol is part of this decision: who holds the private keys, in what custody, under what conditions of access.

Fourth: the governance model. The SFC and HKMA both review the governance of licensed entities closely. The board composition, the responsible officer appointments, the internal control framework, and the conflict-of-interest policy are each a decision the client makes and owns. Advisers can describe the standard; the client must populate it with real people and real procedures.

Fifth: the cross-border client flow. How does the licensed Hong Kong entity interact with clients, assets, and counterparties in other jurisdictions? Specifically: does it rely on an exemption, a passporting arrangement, or a separate licence in each market? This decision shapes the legal architecture of the entire arrangement. It cannot be made after the application is filed.

The contextual point is this: the documents we draft and the regulatory analysis we produce are tools the client uses to execute these decisions. The decisions themselves require board-level engagement. A custody arrangement where the client has not made these five choices in writing is not ready for a licensing application.

Where do locally licensed Hong Kong firms join?

There is a defined boundary in every engagement of this kind. Lockhart & Yip advises on international and foreign law; matters of Hong Kong law are handled together with locally licensed firms. For a stablecoin or digital-asset custody arrangement, that boundary runs through a predictable set of steps.

Locally licensed firms carry the Hong Kong company formation, the registered-office and directorial requirements under the Companies Ordinance (Cap. 622), the Significant Controllers Register obligations (in force since 1 March 2018), and the formal elements of the licensing application under the AMLO and, where applicable, the SFO. They also carry the Hong Kong-law analysis of the custody documentation: the legal nature of the custodian's interest in the client assets under Hong Kong property law, the trust or agency characterisation of the custody arrangement, and the enforceability of the key contractual provisions before the Hong Kong courts.

We prepare everything that surrounds and connects that Hong Kong-law core: the cross-border structure, the group governance documents, the AML and sanctions framework, the custody agreement from a cross-border drafting perspective, the international components of the regulatory submission, and the legal analysis of the arrangement's posture under the laws of any non-Hong Kong jurisdiction where the group operates. We also coordinate the full team and hold the matter together across jurisdictions.

The coordination model matters because regulators reviewing a cross-border custody arrangement look at the whole group, not just the Hong Kong entity. An application that presents a coherent, integrated picture of the group's regulatory posture across jurisdictions is more likely to proceed smoothly than one that treats Hong Kong in isolation.

For guidance on related cross-border technology and data-agreement matters, see our note on a cross-border SaaS or data agreement touching the UAE, which illustrates the coordination model in a different Tech & Web3 context.

Decision matrix: situation, instrument, route, timing, risk

The practical read of a stablecoin or digital-asset custody arrangement runs through four scenarios. These are not exhaustive, but they describe the most common positions our desk encounters.

Situation A: a foreign custodian, no Hong Kong entity, institutional clients in Hong Kong. The analysis begins with whether the custodian is "actively marketing to" or "serving" persons in Hong Kong within the meaning of the AMLO regime. If yes, a Hong Kong presence and licensing posture are likely required. Route: perimeter analysis, followed by structural decision on the licensed entity, followed by application preparation with locally licensed Hong Kong counsel. Timing: measured in months, not weeks. Risk: operating without a licence in this scenario carries regulatory consequences that are not easily unwound.

Situation B: a Hong Kong entity already incorporated, custody activities commenced, no formal licence obtained. The analysis begins with the gap between what the entity is doing and what the AMLO regime requires. Route: immediate gap analysis, a self-assessment against the licensing conditions, and a considered decision – ideally with locally licensed counsel – on whether to apply, restructure, or wind down the relevant activity. Risk: the longer the unlicensed period, the more material the disclosure obligation in any subsequent application.

Situation C: a stablecoin issuer seeking to launch in Hong Kong. The HKMA stablecoin issuer regime applies. The route begins with the perimeter analysis under the HKMA regime, then the assessment of whether the issuance or distribution activity also engages the AMLO or SFO. Reserve requirements, governance standards, and client-disclosure obligations differ from the AMLO custody framework. Timing and conditions should be verified against the current position before any step is taken, as the HKMA regime was in its early phase at the time of writing. Risk: a stablecoin issuer that also operates a platform touches two regulators simultaneously.

Situation D: a licensed platform adding a custody function. This is an expansion of the existing licence perimeter. Route: review of the existing licence conditions, assessment of whether the custody function is within scope or requires an extension or additional authorisation, preparation of the variation submission with locally licensed counsel. Risk: treating the custody function as automatically covered by an existing licence without a formal assessment is the most common error our desk encounters in this scenario.

The next move

If you are a foreign principal assessing a stablecoin or digital-asset custody arrangement from outside Hong Kong – or inside it without a clear regulatory position – the first step is the perimeter analysis. That analysis determines which regime or regimes apply, who the relevant regulators are, and what the licensing route looks like. It also determines whether the current structure requires adjustment before any application is made.

We run that analysis across the instruments, coordinate with locally licensed Hong Kong firms for the entity-level steps, and prepare the cross-border components of the regulatory submission. The perimeter analysis is the document that makes every subsequent decision faster and more reliable.

For a full picture of our Tech & Web3 practice, including the range of licensing, structuring and compliance matters we handle across Hong Kong and the principal offshore and regional centres, see our Tech & Web3 practice page.

The sequence of steps in a custody arrangement is set before the application is filed. Getting the sequence right at the outset is the difference between an arrangement that holds and one that is restructured under regulatory pressure.

If an earlier licensing attempt, structural decision, or AML review produced an adverse or stalled result, a second read can identify the strategic error and the routes still open. We regularly act on engagements where a prior attempt has created additional complexity; it does not foreclose the options, but it changes the sequence.

Related practices

Sanctions & AML – cross-border AML compliance, sanctions screening, and source-of-funds file preparation for virtual-asset businesses
Holding Structures – BVI, Cayman and Hong Kong holding architecture above licensed operating entities
Corporate Counsel – ongoing governance, Significant Controllers Register, and cross-border compliance for Hong Kong entities

Frequently asked questions

What are the main risks in a stablecoin or digital-asset custody arrangement?

The primary risks are regulatory exposure – operating without the required licence under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance or the Hong Kong Monetary Authority's stablecoin regime – and AML non-compliance, including failure to implement customer due diligence, transaction monitoring, and the FATF travel rule for virtual-asset transfers. A second layer of risk arises from the cross-border structure: a holding vehicle that does not satisfy its own jurisdiction's substance requirements, or a custody arrangement that does not correctly characterise the legal nature of the custodian's interest in client assets, creates structural vulnerability that a licensing application or a counterparty dispute will expose. Parties should verify the current regulatory position in each jurisdiction before acting.

What does the route look like for a stablecoin or digital-asset custody arrangement?

The route begins with a perimeter analysis that determines which licensing regime or regimes apply – the AMLO platform licence, the SFO where virtual assets are securities, and the HKMA stablecoin issuer regime where fiat-referenced stablecoins are involved. A structural review of the existing corporate architecture follows, then an AML compliance gap analysis, then documentation: the custody agreement, safekeeping deed, key-management protocol, and client-facing representations. Where a formal application is required, locally licensed Hong Kong firms carry the Hong Kong-law elements; we prepare and coordinate the international and cross-border components. The sequence is sequential and cannot safely be run in reverse.

What documents are needed for a stablecoin or digital-asset custody arrangement?

The core set comprises a custodian agreement or safekeeping deed, a key-management and asset-segregation protocol, a written AML and customer due diligence programme compliant with the Anti-Money Laundering and Counter-Terrorist Financing Ordinance and the SFC's published guidelines, a travel-rule compliance procedure for virtual-asset transfers, and a set of client representations addressing the client's own regulatory status and jurisdiction of operation. Where the arrangement involves institutional clients, a separate institutional-client agreement addressing liability, indemnity and the governing law is standard. Where a formal licensing application is being made, the group governance documents and a cross-border corporate structure memorandum form part of the regulatory submission. Each document reflects decisions the client has already made; the documentation follows the decisions, not the other way around.

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.