Structuring a Web3 business through Hong Kong

A founding team building a token-based platform, a digital-asset exchange, or a stablecoin issuance vehicle faces a structural question before it faces a commercial one: which jurisdiction carries the licensing exposure, and which carries the liability? For groups looking at Hong Kong, that question has a concrete answer – one that changed materially when the mandatory licensing regime for centralised virtual-asset trading platforms commenced on 1 June 2023. The choice of entity, the activity scope, and the AML posture must all be settled before the product goes live, not after.

Structuring a Web3 business through Hong Kong requires mapping the activity against the Anti-Money Laundering and Counter-Terrorist Financing Ordinance's virtual-asset trading platform licensing regime, determining whether any asset is a "security" or "futures contract" under the Securities and Futures Ordinance, and building the entity and compliance architecture in the correct sequence before regulatory engagement.

This note sets out how Lockhart & Yip runs that process for foreign principals, where locally licensed Hong Kong firms join the work, and what the client must own at each stage.

When does a foreign principal actually need this service?

The trigger is almost always regulatory exposure, and it arrives faster than founders expect. A Web3 business needs to assess its Hong Kong structuring position the moment it does any of the following: it operates or plans to operate a centralised platform offering virtual-asset trading to users in or through Hong Kong; it issues a token that a regulator might characterise as a security or a collective investment scheme interest; it holds client assets in connection with a virtual-asset activity; or it accepts institutional counterparties who themselves operate inside a licensed perimeter.

In our cross-border practice, the founding teams who come to us too late are typically those who built the product offshore – BVI, Cayman, or a non-Asian hub – and then discovered that distribution or marketing activity in or through Hong Kong triggered a licensing question they had not modelled. The BVI or Cayman holding layer does not insulate a business from Hong Kong regulatory reach if the operational activity, the platform access, or the management decisions happen here.

A second category of client is the traditional finance group – an asset manager, a fund sponsor, or a payments operator – building a Web3 layer on an existing regulated business. For these principals, the question is whether the new activity falls inside their current licence perimeter or creates a separate regulated entity. That line is not always obvious, and getting it wrong generates dual-registration exposure rather than the clean structure the group assumed it had.

The HKMA's licensing regime for fiat-referenced stablecoin issuers, which commenced in 2025, added a third category: issuers or would-be issuers of Hong Kong dollar or other fiat-backed stablecoins who need to map the HKMA perimeter alongside the SFC perimeter before deciding whether a Hong Kong issuer entity is appropriate at all. Parties relying on this regime should verify the current commencement date and regulatory perimeter before acting, as implementation details were still being confirmed at the time this note was prepared.

What does the governing regulatory regime actually cover?

The mandatory licensing regime for virtual-asset trading platforms (centralised exchanges and platforms facilitating trading between users) operates under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, with the Securities and Futures Commission as the licensing authority. A platform that meets the statutory definition of a virtual-asset trading platform and serves or is capable of serving Hong Kong investors is, in principle, required to hold a licence – or to have a credible basis for exclusion from the perimeter – before it operates.

The Securities and Futures Ordinance runs in parallel. Where a virtual asset constitutes a "security" – a share, debenture, or unit in a collective investment scheme – or a "futures contract" under that Ordinance, the full suite of SFC licence types and conduct obligations applies. A platform trading both security tokens and non-security virtual assets may therefore face dual-licensing exposure under two instruments simultaneously. The overlap is not theoretical; in our cross-border practice we regularly see structures that underestimate it.

AML and the FATF travel rule apply to virtual-asset trading platforms as a separate obligation layer. Customer due diligence, transaction monitoring, and the transfer of originator and beneficiary information with virtual-asset transfers are required. A platform that is well-structured from a corporate perspective but poorly designed from a compliance-systems perspective will fail licensing review at the AML stage, regardless of its entity architecture. The two workstreams – structure and compliance systems – must run in parallel, not sequentially.

For stablecoin issuance, the HKMA regime adds a further perimeter. Fiat-referenced stablecoin issuers who issue or offer in Hong Kong, or who issue Hong Kong dollar-referenced instruments anywhere, are within the intended scope. The intersection of the HKMA and SFC regimes – where an instrument might be both a stablecoin and a security – is one of the more complex open points in the current environment, and it is one that structuring decisions must address explicitly.

How does the cross-border element change the structure?

Almost every Web3 business operating through Hong Kong has a cross-border dimension: a Cayman or BVI holding entity above the Hong Kong operating company, users or counterparties on the Mainland, a development team in a third jurisdiction, or a token issued under a law that is not Hong Kong law. Each of those interfaces creates a separate layer of structuring work.

The holding-layer question is the most common. A Cayman Islands exempted company or a BVI business company above a Hong Kong operating entity is a familiar structure in both traditional finance and Web3. It is generally effective for investor access, token issuance in non-Hong Kong markets, and internal group lending or IP holding. What it does not do is insulate the operating entity from Hong Kong regulatory obligations. The licence is held at the operating level, and the licensing authority looks through the holding layer when assessing management, control, and the beneficial-ownership position. Economic-substance requirements in the offshore holding jurisdiction are a further constraint: a BVI or Cayman holding company that performs no genuine function in that jurisdiction carries substance risk under the applicable economic-substance regime.

The Mainland interface is a distinct issue. A Web3 business operating in Hong Kong may have Mainland Chinese shareholders, Mainland-based technical staff, or Mainland users who access the platform through the open Hong Kong environment. Each of these creates a question about whether Mainland regulatory rules – which take a fundamentally different approach to virtual assets than Hong Kong's licensed-exchange model – apply alongside or instead of the Hong Kong regime. Our desk regularly advises on this interface, which requires a clear understanding of what the Hong Kong business does and what it does not do, documented at the structuring stage, not after a regulatory enquiry arrives.

The sanctions position is a third cross-border consideration. Hong Kong implements United Nations sanctions and does not give domestic effect to unilateral measures of other states. A Web3 business operating through Hong Kong must build its sanctions-screening and AML systems against that baseline – screening against UN lists as the primary obligation – and should document clearly how it approaches the jurisdictional position where its counterparties or users are located in a jurisdiction subject only to unilateral measures. This is a compliance architecture question, not a circumvention question, and it must be answered in the AML policies before licensing review.

For a worked comparison: a Central Asian digital-asset fund sponsor approached our desk in late 2026 seeking to relocate its investment manager to Hong Kong and list its feeder vehicles on a Hong Kong-licensed platform. The sponsor had an existing Cayman fund structure and BVI management entities. The cross-border work involved re-mapping the management-and-control facts to confirm where the fund was tax-resident, assessing the interaction between the HKMA stablecoin regime and the SFC fund-regime for the proposed product, and redesigning the distribution chain so that the Cayman layer served a genuine holding function with adequate substance. The entity work, the AML design, and the regulatory engagement ran in parallel over two planning cycles. The outcome was a structure the sponsor could take into licensing review with a coherent factual and compliance record.

For a more targeted illustration: a South-East Asian payments group with an existing money-service operator licence in a third jurisdiction came to us in early 2027 wanting to add a stablecoin issuance capability through a Hong Kong entity. The group assumed its existing AML infrastructure would transfer directly. In practice, the HKMA stablecoin perimeter and the SFC overlap on the reserve-asset and redemption mechanics required a separate compliance design for the Hong Kong issuer entity, distinct from the group's existing AML programme. Mapping those differences – and building a bridge between the group programme and the HK-specific requirements – was the core of the engagement before any regulatory submission was made.

See also our analysis on digital-asset fund structures through Hong Kong and Singapore for the fund-manager angle on this same cross-border interface.

What is the step-by-step route, and where does locally licensed counsel join?

The engagement runs in four defined phases, and the sequencing matters as much as the content of each phase. Getting the sequence wrong – typically by incorporating the operating entity before the activity analysis is complete – creates remediation work that costs more than doing it correctly the first time.

Phase one: activity mapping and regulatory characterisation. Before any entity is formed, the client's proposed activity must be mapped against the statutory definitions in the Anti-Money Laundering and Counter-Terrorist Financing Ordinance and the Securities and Futures Ordinance. What does the platform actually do? Does it hold client assets? Does it facilitate trading between users, or does it act as principal? Is any asset it proposes to list a security? Is the stablecoin instrument a fiat-referenced stablecoin within the HKMA perimeter? These questions are answered at the international and foreign-law layer first. Locally licensed Hong Kong counsel join at this phase to confirm the specific regulatory-characterisation conclusions under Hong Kong law.

Phase two: entity design and offshore-layer planning. Once the activity is characterised, the entity architecture is designed. The typical structure involves a Hong Kong operating company (the licensed entity or the licence applicant), an offshore holding vehicle (Cayman or BVI, depending on the investor base and token-issuance needs), and potentially a separate IP or treasury entity. The holding structure, the intercompany arrangements, and the substance position in the offshore layer are designed at this phase. Locally licensed Hong Kong firms confirm the Companies Ordinance mechanics for the Hong Kong entities; allied counsel in the relevant offshore centre confirm the offshore-layer substance and economic-substance position.

Phase three: AML and compliance-systems architecture. This phase runs in parallel with phase two, not after it. The AML programme – covering customer due diligence, beneficial-ownership verification, transaction monitoring, the FATF travel rule implementation, and the sanctions-screening baseline – must be designed before the licensing application is filed. The SFC and HKMA both review the AML and compliance systems as part of the licensing process. A well-designed entity that arrives in front of the regulator with an underdeveloped compliance programme will not proceed. Locally licensed Hong Kong compliance specialists review the AML manual and system design against the SFC's published AML guidelines.

Phase four: regulatory engagement and documentation. The licensing application, the management vetting submissions, and the regulatory dialogue are managed with locally licensed Hong Kong counsel in the lead, with our desk providing the international structuring and cross-border context. The client must own the factual record – the business plan, the technology description, the key-personnel profiles, and the beneficial-ownership chart – because the regulator's enquiries will be directed to the business, not to its advisers.

The sequence described above applies to a business seeking a new Hong Kong licence from the outset. For a business acquiring or merging with an existing licensed entity, the due-diligence and change-of-control steps replace phases one and two, and the AML-systems review becomes a gap analysis against the existing programme.

The sequence above describes the standard position. Your matter turns on the specific activity, the jurisdictions engaged, and the timing of the regulatory filing – which is where the route is won or lost. For a structured assessment of your Web3 business's regulatory position across the relevant jurisdictions, write to us at info@lockhartyip.com.

What documents and decisions must the client own?

A structuring and licensing process generates a defined set of documents, and the client must control the core ones rather than delegating their production entirely to advisers. The regulator assesses the business, not the advisers, and the quality of the client-owned documents reflects on the quality of the management team.

The business plan is the most important document the client produces. It must explain, in plain language accessible to a non-technical regulator, what the platform does, how it generates revenue, who its users are, and how it manages risk. A business plan that reads as a marketing document rather than an operational description will draw requests for further information that slow the process. The client writes the first draft; advisers review and position it for regulatory submission.

The beneficial-ownership chart must be complete and current. The SFC requires a clear record of the ownership chain up to the ultimate beneficial owner, with supporting documentation at each level. In a multi-jurisdictional structure – Hong Kong operating company, Cayman holding entity, BVI intermediate, individual founders above – that chain involves several layers and several sets of constitutional documents. The client must maintain the chart and update it whenever the ownership position changes, because an outdated beneficial-ownership record is a material deficiency in any licence application or ongoing compliance review.

Key-personnel decisions are structural decisions. The licensing regime requires fit-and-proper management, and the designated senior management who appear in the licensing application are individually assessed. A founder who has a regulatory history in another jurisdiction – or a gap in their professional record – must expect the regulator to enquire. Those questions are better answered proactively in the application than reactively in a subsequent regulatory enquiry. Choosing who appears in the licensed entity's management structure is, therefore, as much a structuring decision as a personnel one.

The AML policy suite – the AML and KYC manual, the transaction-monitoring policy, the sanctions-screening policy, and the travel-rule implementation procedures – is client-owned documentation. Advisers and locally licensed compliance specialists assist in drafting and review, but the policies must be adopted by the board of the licensed entity, understood by the compliance officer, and capable of being operated by the platform's own team. A compliance programme that exists only on paper fails both the licensing review and, more importantly, the real-world test that comes when a suspicious transaction or a regulator's on-site visit arrives.

What do foreign principals typically get wrong?

The most common structural error is building the entity and the product in parallel without resolving the regulatory-characterisation question first. A platform that goes live in soft-launch mode, accepts the first users, and then discovers it needs a licence is in a materially worse position than a platform that resolves the licensing question before launch. The retroactive licensing process involves an application that must describe a platform that already has users and operational history, which creates compliance gaps that must be remediated – usually at cost and delay.

The second error is treating the offshore holding entity as if it carries the operational substance. Founders who have used Cayman or BVI structures in other contexts sometimes assume that the Hong Kong operating company is merely a registration formality and that the "real" business sits offshore. The SFC does not see it that way. The licensed entity is assessed as a Hong Kong business. Its management, its operations, its AML systems, and its key personnel must have genuine presence and function. A shell company with a nominal director and an empty office does not obtain a licence.

The third error is underestimating the AML workstream. Groups with experience in traditional regulated industries sometimes assume that their existing AML programme – designed for bank transfers or securities transactions – transfers to a virtual-asset context with minor modifications. The FATF travel rule for virtual-asset transfers, the blockchain-analytics dimension of transaction monitoring, and the specific customer due diligence requirements for virtual-asset clients are all distinct from traditional finance AML obligations. The compliance programme must be redesigned, not adapted.

Foreign counsel – particularly US or European counsel who advise on their own jurisdiction's crypto-asset rules – sometimes advise clients that Hong Kong requirements are broadly equivalent to those at home. In our cross-border experience, that assumption regularly produces misfiled applications and structural arrangements that are compliant in the home jurisdiction but materially non-compliant in Hong Kong. The two-regulator overlap (SFC and HKMA), the specific travel-rule implementation requirements, and the beneficial-ownership depth required in the licensing application are all features that require Hong Kong-specific design, not a general crypto-compliance approach imported from elsewhere.

If an earlier structuring attempt, an incomplete application, or a stalled regulatory engagement has produced an adverse result, a second read of the factual record can identify the strategic gap and the routes still open. Contact us at info@lockhartyip.com to discuss the position.

Self-assessment: is a Hong Kong Web3 structure appropriate for your business?

Not every Web3 business belongs in Hong Kong. The licensing regime imposes real operational costs, management requirements, and AML obligations. A business that cannot credibly satisfy those requirements – or that serves markets where Hong Kong licensing adds no meaningful commercial benefit – may be better served by a different structuring choice. The following questions help map the fit.

Does your platform operate a centralised model in which it holds client assets or facilitates trading between users? If the answer is yes and any of those users are in or through Hong Kong, the licensing analysis is unavoidable. If the answer is no – if the platform is genuinely non-custodial and purely peer-to-peer – the analysis is different, though the securities characterisation of listed assets remains relevant.

Do your institutional counterparties or investors require a licensed Hong Kong counterparty? Many institutional investors in the Asia-Pacific region will not place assets with an unlicensed or unregulated entity. A Hong Kong licence is, for some investor bases, a prerequisite rather than an advantage. If that is the case for your business, the cost-benefit calculation changes substantially.

Can your management team satisfy the SFC's fit-and-proper requirement? If key personnel have regulatory history, professional disqualification, or criminal records in any jurisdiction, the licensing path may be blocked or significantly complicated. That assessment should be made before the entity is incorporated and before personnel commitments are made.

Is your AML and compliance team resourced to maintain a Hong Kong-standard programme on an ongoing basis? Licensing is not a one-time event. The ongoing compliance obligations – regular AML reporting, annual audits, regulatory returns, and the management of suspicious-transaction reports – require a dedicated compliance function. A business that cannot sustain that function should not seek a Hong Kong licence.

For the business that answers these questions positively, Hong Kong offers a tested common-law system, a courts infrastructure built for commercial dispute resolution, a regulator that engages with the industry on licensing questions, and a geographic position at the intersection of Greater China capital flows and international institutional investment. Those are genuine advantages. But they are advantages available only to a business that has structured correctly and complied genuinely.

See our broader Tech & Web3 practice overview for the full scope of how we assist digital-asset and technology businesses operating through Hong Kong and across the principal offshore centres.

Decision matrix: situation, route, and risk

The following describes the principal structuring routes and their risk profiles. It is a practitioner's read, not a definitive regulatory position; the facts of the specific business determine the correct route.

Situation A – a new centralised virtual-asset trading platform wanting to serve Hong Kong investors: The route is a Hong Kong operating entity, licensed under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance with the SFC as licensing authority. A Cayman or BVI holding entity above is standard. The AML programme and compliance systems must be SFC-ready before filing. The risk is timing: the licensing process is not instantaneous, and a platform that launches without a licence or a credible basis for exclusion carries immediate enforcement exposure.

Situation B – an offshore fund manager wanting to offer digital-asset exposure to investors through a Hong Kong feeder: The route typically involves an SFC Type 9 licence (asset management) for the fund-management entity, combined with an assessment of whether any underlying digital assets are securities under the Securities and Futures Ordinance. The fund layer sits in the Cayman Islands in most cases; the manager entity is in Hong Kong. The AML obligations apply at the manager level. The risk is the securities-characterisation question: if the underlying assets are securities tokens, the licensing and conduct-of-business obligations are more demanding than for non-security virtual assets.

Situation C – a stablecoin issuer wanting to issue a fiat-referenced instrument in or through Hong Kong: The route requires engagement with the HKMA licensing regime, with an assessment of whether the stablecoin also constitutes a security (adding the SFC to the regulatory picture). The issuer entity should be a Hong Kong company with genuine management presence. Reserve-asset management and redemption mechanics are scrutinised. The risk is dual-regulator exposure and the evolving implementation of the HKMA regime – parties should verify the current perimeter and requirements before filing.

Situation D – an existing Web2 technology business adding a token or digital-asset feature: The route begins with activity characterisation: does the token constitute a security, a utility token outside the regulatory perimeter, or something in between? The answer determines whether an additional licence is required or whether the existing business can accommodate the new feature within its current legal architecture. The risk is the characterisation itself – a token designed as a utility instrument that is economically structured as a security creates regulatory exposure that the "utility" label does not resolve.

For an assessment of which situation matches your business and what the next structural step is, write to us at info@lockhartyip.com.

Related practices and the next move

Related practices

• Tech & Web3 – virtual-asset licensing, entity structuring, AML compliance and regulatory engagement
• Sanctions & AML – sanctions-screening design, source-of-funds analysis and compliance documentation for cross-border digital-asset businesses

Also see our related insight on cross-border SaaS and data agreements touching the BVI for the contractual and data-governance dimension of Web3 businesses with offshore holding layers.

The structuring work for a Hong Kong Web3 business is not a single document or a single registration step. It is a sequence of decisions – activity characterisation, entity design, AML architecture, and regulatory engagement – that must be made in the right order and documented correctly before licensing review begins. The principal who arrives at the regulator's door with a complete, coherent, and factually accurate file is in a materially different position from the principal who arrives with a well-incorporated company and an undeveloped compliance record.

Lockhart & Yip runs the international structuring and cross-border coordination layer of that process, working alongside locally licensed Hong Kong counsel on the regulatory filing and the Hong Kong-law mechanics. To map the structure and the licensing route for your Web3 business, write to us at info@lockhartyip.com.

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.