Contributed By Cooley
Over the past 12 months, the blockchain ecosystem in the Hong Kong Special Administrative Region (HKSAR) has seen significant structural progress. The jurisdiction has progressively transitioned from an environment predominantly oriented towards retail cryptocurrency trading into an increasingly regulated, institutional-grade infrastructure hub. This evolution is characterised primarily by the market-pioneering tokenisation of real-world assets (RWAs), including traditional financial instruments, alongside the deep integration of distributed ledger technology (DLT) into interbank and capital market frameworks. Market practices have developed from isolated, piecemeal pilot projects into comprehensive, commercially viable deployments backed by definitive statutory frameworks.
The current use cases most commonly being explored and implemented centre on institutional financial applications. As highlighted in the March 2025 research paper of the Hong Kong Monetary Authority (HKMA), “Distributed Ledger Technology in the Financial Sector: A Study on the Opportunities and Challenges”, programmability and transparency are the primary drivers for DLT adoption among local institutions. Financial institutions are actively tokenising traditional products, including money market funds, green bonds and commercial real estate.
By creating digital representations of these assets that are tradable on-chain, market participants achieve increased settlement efficiency, fractional liquidity and reduced counterparty risk. The HKMA study specifically notes practical applications such as experimental tokenised deposit solutions for 24/7 fund transfers and deep-tier supply chain financing via stablecoin-based conditional payments. Furthermore, permissioned DLT networks are increasingly being deployed outside pure finance, specifically in supply chain logistics to enhance traceability, and in the green energy sector to track the real-time operational performance of infrastructure, such as electric vehicle charging stations.
Over the next 12 months, several critical legislative and regulatory issues are poised to impact the use of blockchain. The most significant is the sweeping expansion of the regulatory perimeter under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Chapter 615) (AMLO). Following the publication of the Consultation Conclusions on Legislative Proposal to Regulate Dealing in Virtual Assets and Further Public Consultation on Legislative Proposal to Regulate Virtual Asset Advisory Service Providers and Virtual Asset Management Service Providers and the Consultation Conclusions on Legislative Proposal to Regulate Virtual Asset Custodian Services on 24 December 2025, comprehensive draft legislation is being introduced to the Legislative Council in 2026.
This legislation will establish formal, mandatory licensing regimes for over-the-counter (OTC) virtual asset (VA) dealing, custody, advisory services and portfolio management, effectively bringing the entire digital asset value chain under the direct supervision of the Securities and Futures Commission (SFC). Additionally, the impending implementation of the Crypto-Asset Reporting Framework (CARF) of the Organisation for Economic Co-operation and Development (OECD) in 2026 will mandate exhaustive transaction-level tax reporting for service providers, significantly increasing compliance burdens.
The interaction between blockchain business and existing intellectual property (IP) laws has become increasingly harmonised, driven by proactive governmental policy. In his 2025 Policy Address, the Chief Executive of HKSAR unveiled strategic measures to transform Hong Kong into a premier regional IP trading hub, central to which is the IP financing sandbox (see 1.1.2 Regulatory Sandbox). Within the blockchain sector, this facilitates the on-chain tokenisation of IP rights and the embedding of complex licensing logic directly into smart contracts. The jurisdiction’s robust common-law foundation supports these innovations, potentially allowing creators to denominate royalties in regulated fiat-referenced stablecoins (FRS) and automate revenue-sharing distributions while navigating the complexities of legacy IP doctrines.
Hong Kong operates multiple, highly sophisticated regulatory sandboxes specifically geared towards blockchain-based projects, reflecting a co-ordinated and progressive effort among its primary financial regulators to foster innovation without compromising systemic stability.
SFC Regulatory Sandbox
Launched 19 September 2017, to provide a confined regulatory environment, the SFC expects virtual asset trading platform (VATP) operators to enter this Sandbox and be closely monitored before advanced financial technology is deployed on a fuller scale. The regulator explicitly notes that the Sandbox does not serve as a means to circumvent applicable laws or compromise investor protection requirements.
The HKMA Fintech Supervisory Sandbox (FSS)
Originally launched in September 2016, this environment allows authorised banking institutions and their partnering technology firms to conduct pilot trials of blockchain initiatives with a limited number of participating customers, operating under adapted supervisory requirements. Over the years, the FSS has undergone significant upgrades to expand its utility.
FSS 2.0, introduced in 2017, added a Fintech Supervisory Chatroom, allowed direct access for tech firms, and linked the HKMA sandbox with those of the SFC and the Insurance Authority (IA) for cross-sector trials. FSS 3.0, launched in November 2021, provided funding support of up to HKD1 million for eligible projects. Most recently, the FSS 3.1 Pilot (launched in October 2022 and expanded in November 2024 in collaboration with Cyberport) offers subsidies for projects addressing specific banking industry pain points such as central bank digital currency and interbank account data sharing. As of the end of March 2026, 388 fintech initiatives have been allowed pilot trials within the FSS.
The HKMA Stablecoin Issuer Sandbox
Launched on 12 March 2024, this specialised Sandbox facilitates two-way communication between the central bank of Hong Kong and prospective stablecoin issuers regarding proposed regulatory requirements and operational plans. On 10 April 2026, the HKMA granted the jurisdiction’s first historic stablecoin issuer licences to Sandbox participants Anchorpoint Financial and HSBC.
Project Ensemble Sandbox
Co-led by the HKMA and the SFC, this ambitious initiative is designed to build and scale a tokenisation market in Hong Kong, testing the full product cycle from on-chain primary issuance to secondary market trading and hypothecation. In November 2025, the initiative advanced into the Ensemble pilot phase. This phase facilitates the interbank settlement of tokenised deposits and RWAs directly via the local real-time gross settlement (RTGS) system, designed to significantly reduce the settlement delays and counterparty risks inherent in the legacy banking infrastructure.
IP Financing Sandbox
Officially launched on 22 December 2025 by the HKMA in collaboration with the Commerce and Economic Development Bureau (CEDB), this Sandbox specifically targets the technology sector, creating a collaborative, risk-controlled environment that allows innovative enterprises to leverage their intangible IP assets for credit financing, such as patents and copyrights.
The Generative Artificial Intelligence (GenA.I.) Sandbox
Originally launched by the HKMA in collaboration with Cyberport on 13 August 2024 for the banking sector, this Sandbox provided a risk-controlled environment for authorised institutions to test GenA.I. use cases, particularly focusing on risk management, anti-fraud and customer experience. Building on early successes, the initiative was significantly expanded on 5 March 2026, into the “GenA.I. Sandbox++” co-led by the HKMA, the SFC, the IA and the Mandatory Provident Fund Schemes Authority to cover more sectors.
Participants receive targeted supervisory guidance and complimentary access to graphics processing unit (GPU) computing resources at Cyberport’s AI Supercomputing Centre to accelerate responsible AI adoption, including exploring strategies to automate quality and risk checks.
The IA Sandbox
The IA launched an Insurtech Sandbox in 2017 to facilitate a pilot run of innovative insurtech applications by certain authorised insurers if they are uncertain about the compliance of initiatives that apply innovative technologies, including DLT. The IA expanded the participant scope to include licensed insurance broker companies in 2021.
The general attitude of the government and regulatory authorities towards industries based on blockchain is highly encouraging of institutional, enterprise and sustainable use cases, while simultaneously enforcing zero-tolerance policies against fraud, market manipulation and money laundering risks. The administration employs a dual-policy approach. The SFC’s ASPIRe framework (Access, Safeguards, Products, Infrastructure and Relationships), kicking off on 19 February 2025, prioritises compliance, market integrity and the bridging of traditional finance with blockchain infrastructure.
Concurrently, the “LEAP” framework of the Financial Services and the Treasury Bureau (FSTB), introduced in the Policy Statement 2.0 on the Development of Digital Assets in Hong Kong on 26 June 2025, focuses on streamlining legal structures, expanding tokenised products and embedding the Web3 ecosystem into the real economy. The issuance of tokenised traditional assets, enterprise DLT deployment and regulated stablecoin issuance are heavily encouraged. Conversely, unregulated initial coin offerings (ICOs), algorithmic stablecoins marketed to retail investors and the distribution of complex, highly leveraged derivatives to non-professional investors are strictly prohibited.
When blockchain technology is utilised independently of crypto-assets – eg, for enterprise data management, internal bank reconciliation or supply chain tracking – it is regulated under standard technology, outsourcing and data protection frameworks rather than specialised financial legislation. The HKMA provides specific guidance to authorised institutions regarding the use of DLT and cloud computing. Regulated firms outsourcing critical functions to blockchain technology-enabled solutions must ensure sufficient emphasis on cyber risk within their governance frameworks. They must holistically identify and assess vulnerabilities and maintain proper contractual agreements that allow for regular audits, penetration testing and effectiveness evaluations throughout the entire third-party management life cycle.
Data privacy laws apply rigorously to the use of blockchain-based products and services. In Hong Kong, the Personal Data (Privacy) Ordinance (Chapter 486) governs the collection, processing and handling of personal data. The inherent immutability of blockchain technology directly conflicts with core privacy principles, particularly the data minimisation principle and the conceptual “right to be forgotten”, as the retroactive alteration or deletion of stored data is technically unfeasible once recorded on a distributed ledger. The Office of the Privacy Commissioner for Personal Data (PCPD) and the HKMA explicitly advise against the direct storage of personal data on the blockchain.
Market participants are strongly encouraged to employ a bifurcated architecture: storing only cryptographic hashes of personal data on the immutable ledger while maintaining the actual substantive data in conventional, off-chain databases. This method preserves cryptographic data integrity and auditability while allowing for the deletion of the off-chain data when required. Furthermore, the Protection of Critical Infrastructures (Computer Systems) Ordinance (Chapter 653), which came into full statutory force on 1 January 2026, imposes mandatory cybersecurity governance, preventive technical safeguards and incident reporting obligations on designated infrastructure operators utilising networked technologies, including blockchain infrastructure.
Smart contracts are capable of being enforced in Hong Kong, provided they satisfy the fundamental tenets of traditional common law contract formation: offer, acceptance, valid consideration and the mutual intention to create legal relations. However, jurisprudence and regulatory guidance, including input from the technology committee of the Law Society of Hong Kong, indicate that smart contracts are frequently better characterised as automated execution mechanisms rather than comprehensive, standalone legal agreements. Smart code often lacks the linguistic nuance required to adequately capture complex representations, warranties, force majeure conditions and the full spectrum of equitable duties required in sophisticated commercial transactions.
To ensure enforceability and mitigate operational legal risks, the HKMA’s second DLT White Paper (2017) and the March 2025 research paper both recommend that smart contracts be tethered to conventional legal scaffolding. Legal rights typically emerge from separate, legally binding master agreements or terms of service that govern the overarching relationship between the parties. Under the Electronic Transactions Ordinance (Chapter 553), electronic signatures and cryptographic authentications used to execute these contracts hold the exact same validity as traditional wet-ink signatures, provided that the process is demonstrably reliable and the recipient consents to the digital format.
Regulatory bodies strongly advocate for the inclusion of pre-established governance frameworks and programmable “escape hatches” within the smart contract architecture. These predefined mechanisms allow for modifications, halts or reversals under highly stringent, multi-signature conditions to rectify programming errors or unforeseen eventualities without undermining the fundamental security and immutability of the network.
As of the date of publication (11 June 2026), there are no statutory self-regulatory organisations (SROs) endowed with formal enforcement powers representing the blockchain industry in Hong Kong. While proposals have been submitted by entities such as the Hong Kong Securities & Futures Professionals Association to establish an independent SRO to handle frontline licensing and standard-setting, formal regulatory and disciplinary authority remains exclusively vested in the SFC and the HKMA.
However, the industry is robustly represented by highly influential trade associations and advocacy groups, most notably the Fintech Association of Hong Kong and the Bitcoin Association of Hong Kong. These organisations serve critical quasi-regulatory and developmental roles. They actively aggregate industry data, formulate consolidated responses to government consultation papers and promote best practices in areas ranging from smart contract auditing to AML compliance. They function as vital conduits between market participants and policymakers, ensuring that the legislative trajectory remains commercially viable and internationally competitive while facilitating ecosystem networking, talent development and elevated professional standards.
Crypto-assets are recognised as a form of property under Hong Kong law. This characterisation firmly aligns the jurisdiction’s jurisprudence with other major global common law centres. The landmark decision by the Court of First Instance in Re Gatecoin Limited (in liquidation) [2023] HKCFI 914 established that cryptocurrencies fall within the legal definition of “property” and are therefore fully capable of forming the subject matter of a trust. This pivotal ruling facilitates the valid transfer, bequest and conformity of digital assets to standard corporate insolvency recovery mechanisms. Building upon this, the further decision in Re Gatecoin Limited (in liquidation) [2025] HKCFI 493 clarified the distribution of recovered crypto-assets and confirmed the return of constructive trust assets to beneficiaries, emphasising the role of contractual terms in determining insolvency priority.
As crypto-assets are recognised as property, the approach to enforcing property rights over them involves adapting established equitable and common law remedies directly to digital frameworks. Courts regularly grant interlocutory proprietary injunctions and freezing orders over cryptocurrencies. In a groundbreaking technological and judicial development, the High Court in Worldwide A-Plus Investments Ltd v A-Plus Meta Technology Ltd [HCA 2417/2024] granted leave to mint first blockchain-native tokenised injunction order globally. The court deployed a freezing order directly onto the Tron blockchain to restrict suspect wallets. This demonstrates that while the fundamental property rights are identical to those of tangible assets, the enforcement mechanisms are evolving to leverage the unique transparency and programmable nature of the technology itself.
Transfer in Ownership
The transfer in ownership of crypto-assets is determined primarily by the functional control evidenced by the exclusive possession of a private cryptographic key associated with that specific asset. The execution of a digital signature authorising a transfer, followed by the network’s verification and recording of that transaction on the distributed ledger, updates the definitive legal ownership status.
Collateral Arrangements
There are specific, complex legal and regulatory issues relating to the use of digital assets in collateral arrangements. Establishing a perfected security interest is challenging due to the intangible nature of the assets and the technical nuances of blockchain finality. Furthermore, inherent price volatility requires highly sophisticated valuation methodologies. To integrate margin trading safely into the regulated sector, the SFC issued a seminal circular on 11 February 2026 (“Circular on licensed corporations providing VA dealing services to offer financing for VA dealing and access to shared order book, and to safeguard client VAs relating to withdrawals”), permitting licensed VA brokers operating under omnibus accounts to offer VA margin financing to their securities margin clients.
To mitigate volatility and systemic risk, this framework mandates that only the most highly liquid digital assets (currently restricted to Bitcoin and Ethereum) are eligible as collateral, subject to a stringent minimum 60% valuation haircut. Brokers must implement real-time collateral monitoring systems and are strictly prohibited from engaging in the rehypothecation of client VA collateral, ensuring assets remain fully available for redemption.
There are no statutory restrictions prohibiting firms that provide crypto-asset services from partnering with general banking and payment providers in Hong Kong. The HKMA has consistently issued explicit guidance mandating that authorised institutions adopt a risk-based approach rather than enforcing wholesale de-risking policies that categorically deny services to the digital asset sector.
However, obstacles and commercial friction persist regarding access to banking services. These challenges stem predominantly from the exhaustive enhanced due diligence (EDD) required by traditional financial institutions to satisfy their internal AML/CFT obligations. Banks must forensically assess the crypto firm’s transaction monitoring systems, source of wealth verifications, blockchain analytics tools and regulatory licensing status.
Protracted delays in account opening are common as banks conduct these complex risk assessments. Nevertheless, as the SFC and the HKMA have finalised and expanded their comprehensive licensing regimes through 2025 and 2026, the resulting regulatory clarity has improved institutional banking access for fully compliant, licensed operators.
ESG and sustainable finance requirements are increasingly applicable to digital assets and the firms that operate them in Hong Kong. The Hong Kong Exchanges and Clearing has implemented sweeping new climate-related reporting requirements based on the International Sustainability Standards Board IFRS S2 standards. Starting 1 January 2026, all large-cap listed issuers are subject to mandatory disclosure requirements regarding climate-related risks and opportunities affecting their business models.
Crucially, all listed issuers are required to disclose their Scope 1 and Scope 2 greenhouse gas emissions on a mandatory basis for financial years commencing on or after 1 January 2025. For publicly listed digital asset firms, or traditional financial institutions with significant proprietary digital asset mining or transaction validation operations, these rules necessitate rigorous reporting on the environmental impact and energy consumption profiles of the specific blockchain consensus mechanisms (such as proof of work) utilised by the assets they hold or process.
Additionally, SFC-authorised investment funds with a stated ESG focus that maintain exposure to VAs must strictly comply with the SFC’s 22 December 2023 “Circular on SFC-authorised funds with exposure to virtual assets” (updated 7 April 2025). These funds are required to demonstrate precisely how the incorporation of digital assets aligns with their stated sustainability criteria and are subject to continuous periodic reporting obligations to rigorously prevent greenwashing within the asset management sector.
The tax regime in Hong Kong is undergoing a historic, structural update to comprehensively address the proliferation of digital assets. Historically, the Inland Revenue Department (IRD) has relied on the territorial tax principle outlined in Departmental Interpretation and Practice Notes No 39 (DIPN 39), issued 27 March 2020. This framework determines taxation based on the “badges of trade”, assessing whether the assets are held for long-term investment (generating capital gains, which are generally non-taxable in Hong Kong) or active trading (subjecting the gains to profits tax).
However, the most significant update is the implementation of the OECD’s CARF alongside sweeping amendments to the Common Reporting Standard (CRS 2.0). Following a public consultation (launched by Consultation Paper on the Implementation of the Crypto-Asset Reporting Framework and Amendments to the Common Reporting Standard in Hong Kong, December 2025) that concluded in February 2026, the government is completing the necessary legislative amendments to the Inland Revenue Ordinance (Chapter 112) within the 2026 calendar year.
This framework compels reporting crypto-asset service providers, including brokers, exchanges and operators of crypto automated teller machines (ATMs), to conduct rigorous due diligence, register on the central CARF Portal, and execute transaction-level reporting on the exchanges and transfers of covered crypto-assets. The rules will become active for data collection starting 1 January 2027, with the IRD commencing international information exchanges in 2028.
The most significant tax uncertainties currently revolve around the granular application of the new CARF rules to highly complex, decentralised protocols, and the tax treatment of novel tokenomics structures such as staking yields, airdrops and decentralised finance (DeFi) liquidity mining, which are not explicitly detailed in legacy guidance like DIPN 39. Concurrently, the 2026–27 Budget introduced proposals to formally expand the scope of tax concessions for investment funds and family offices to classify digital assets as qualifying investments, a strategic move aimed at attracting sophisticated wealth management capital to the jurisdiction.
Hong Kong approaches the winding-up and insolvency of blockchain-based businesses through a sophisticated combination of traditional corporate insolvency law and highly specialised resolution regimes for entities posing macroeconomic risks. Under the general framework provided by the Companies (Winding Up and Miscellaneous Provisions) Ordinance (Chapter 32), crypto-asset firms are liquidated similarly to regular corporations. Following the binding precedent set in Re Gatecoin Limited, customer VAs held on trust by an exchange do not form part of the general estate available to unsecured creditors, provided the terms of service explicitly establish a valid, legally recognisable trust structure. However, if the assets are commingled or the terms grant the exchange ownership in its own right, users are relegated to the status of unsecured creditors facing significant losses. To protect clients from this outcome, SFC-licensed VATPs are mandated to implement strict asset segregation, utilise cold storage heavily and maintain specific liquid capital buffers.
For digital asset firms carrying systemic macroeconomic weight, Hong Kong deploys a bespoke resolution regime governed by the Financial Institutions (Resolution) Ordinance (Chapter 628) (FIRO). With the full enactment of the Stablecoins Ordinance (Chapter 656) from August 2025, the HKMA is explicitly empowered to designate specific FRS issuers as systemic entities based on aggregate transaction volume and integration into the domestic payment ecosystem.
If a systemic stablecoin issuer faces non-viability or catastrophic failure, the HKMA can legally bypass standard, protracted court-led liquidation procedures. The central bank can invoke FIRO to assume direct operational control of the entity, enforce bail-in mechanisms, execute wind-down plans or orchestrate the compulsory transfer of reserve assets to a government-managed bridge institution. This extraordinary power ensures the continuity of critical financial infrastructure and actively prevents contagion.
As detailed in 1.1.5 Industry and Trade Bodies, there are no statutory SROs representing the crypto-asset industry. The sector relies heavily on prominent trade associations, such as the Fintech Association of Hong Kong and the Bitcoin Association of Hong Kong, which play instrumental roles in policy advocacy, the formulation of industry-wide AML/CFT compliance standards and fostering vital collaboration between digital asset natives and traditional financial institutions.
The primary regulatory bodies overseeing the blockchain and crypto-asset sectors in Hong Kong are the SFC and the HKMA. The SFC acts as the principal conduct and prudential regulator for the securities and futures markets. Its jurisdiction covers VATPs, VA fund managers and intermediaries dealing in or advising on crypto-assets. The SFC’s supervisory approach emphasises robust investor protection, strict capital adequacy, comprehensive risk management and the aggressive prevention of market abuse, enforcing these mandates through rigorous licensing gateways and ongoing monitoring.
The HKMA serves as the central banking institution and prudential supervisor for authorised institutions. Its jurisdiction extends to the regulation of payment systems and FRS issuers under the Stablecoins Ordinance. The HKMA focuses intensely on preserving financial stability, dictating stringent reserve backing requirements and managing systemic macroeconomic risks associated with digital money. Additional relevant bodies include the Companies Registry, which administers Trust or Company Service Provider licences required for VA custodians, and the Customs and Excise Department, which oversees elements of AML/CFT enforcement.
Regulators in Hong Kong have actively sought to align with and lead international regulatory approaches. The comprehensive AML/CFT framework for VAs was meticulously designed to achieve full compliance with the standards set by the Financial Action Task Force (FATF), including strict implementation of the Travel Rule for VATPs. The SFC’s expanded market abuse and investor protection frameworks draw heavily upon the policy recommendations formulated by the International Organization of Securities Commissions. Concurrently, the HKMA’s regulatory architecture for stablecoins directly reflects the prudential standards proposed by the bank for International Settlements regarding the treatment of digital money and the mitigation of bank-run risks.
Crypto-assets are characterised and classified by regulators primarily based on their economic substance and functional utility, employing a rigorous “substance over form” methodology. The principal classifications include:
Crypto-assets are subject to a dual regulatory approach. While they interface with existing regulatory frameworks – eg, the Securities and Futures Ordinance (Chapter 571) (SFO) – when a token qualifies as a security, there are also specific, purpose-built statutory frameworks for native crypto-assets. The AMLO establishes a bespoke licensing regime for non-security VAs. Centralised VATPs must be licensed under both the SFO and the AMLO to ensure comprehensive oversight, regardless of how an asset’s classification may fluidly evolve over time. Additionally, the Stablecoins Ordinance (Chapter 656) provides a dedicated framework exclusively for stablecoin issuers.
Regulated activities in crypto-assets encompass operating a centralised trading platform, dealing in VAs, managing VA portfolios, providing VA advisory services, providing VA custody services and issuing an FRS.
Prohibited activities include the issuance or public offering of algorithmic stablecoins by unregulated entities. Crucially, the jurisdiction maintains a rigid distinction between retail and professional markets. Licensed VATPs may offer highly liquid, large-market-capitalisation spot assets to retail investors, subject to rigorous suitability assessments. However, complex products and highly leveraged instruments are strictly prohibited for retail distribution. Under the paper of policy statement regarding perpetual contracts (Perps) finalised on 11 February 2026, licensed VATPs are permitted to offer VA perpetual contracts, leveraged derivative instruments without expiry dates, but the offering of these specific products is exclusively restricted to Professional Investors.
The regulatory landscape is expanding significantly in the next 12 months. Following joint consultation conclusions by the SFC and the FSTB published in December 2025, the government is introducing comprehensive legislation to the Legislative Council to establish new mandatory licensing regimes through amendments to the AMLO. These new regulations will explicitly cover OTC VA dealing services, VA custodian services, VA advisory services and VA portfolio management, ensuring the entire digital asset value chain is brought within the formal regulatory perimeter.
The regulatory classification of the underlying asset does not change solely because of the utilisation of a legal wrapper, such as an investment fund. The SFC strictly applies the “same business, same risks, same rules” principle. Utilising a fund structure shifts the primary compliance burden from the direct investor to the fund manager and the intermediaries distributing the interests of the fund, but it does not bypass the regulatory perimeter.
For regulated firms and investment funds, exposure to crypto-assets triggers significant regulatory implications. Historically, under the SFO, a fund manager (holding a Type 9 Asset Management licence) that intended to invest more than 10% of a portfolio’s gross asset value into VAs was required to uplift its licence to a specialised “Type 9 VA” designation, accompanied by bespoke conditions outlined in the “Terms and Conditions for Licensed Corporations which Manage Portfolios that Invest in Virtual Assets” (October 2023).
However, under the proposed 2026 regulatory expansions for VA portfolio management, this 10% de minimis threshold for exemption from uplifting one’s Type 9 licence is no longer available. Consequently, if enacted, any intermediary carrying on the business of providing asset management services for a portfolio that invests in VAs, regardless of the size of the allocation, may need to obtain the appropriate VA management licensing or registration and adhere to rigorous risk management, independent auditing and custodial standards.
Intermediaries distributing these VA-wrapped products may also need to comply with the SFC’s complex product regime, ensuring appropriate access rights, conducting derivative knowledge assessments and adhering to selling restrictions tailored as to whether the fund is authorised for retail or restricted to professional investors.
Hong Kong accommodates a highly viable, institutional-grade crypto-asset issuance and token generation event industry, though it firmly rejects the unregulated ICO models prevalent in earlier market cycles.
Launching a crypto-asset or admitting one for trading on a licensed VATP requires navigating stringent token admission criteria established by the SFC June 2023 Guidelines for Virtual Asset Trading Platform Operators, which mandate the creation of an independent token admission and review committee comprising senior management members principally responsible for the platform’s key business lines, compliance, risk management and information technology functions, to assess the smart contract security and regulatory status of the token.
To foster market dynamism, the SFC issued the “Circular on expansion of products and services of virtual asset trading platforms” on 3 November 2025, which removed historical friction points. The previous mandate requiring a 12-month track record for any VA before it could be offered to investors has been formally removed for VAs offered exclusively to Professional Investors. Furthermore, this track record requirement is entirely waived for an FRS issued by entities licensed by the HKMA under the Stablecoins Ordinance, allowing for immediate retail distribution upon launch.
When selling a crypto-asset into Hong Kong, disclosure requirements vary based on the classification of such crypto-asset. If the token constitutes a “security”, traditional prospectus and whitepaper disclosure requirements under the Companies (Winding Up and Miscellaneous Provisions) Ordinance and the SFO apply in full force, absent a valid private placement exemption. For non-security tokens listed on VATPs, operators must ensure that comprehensive risk disclosure statements are prominently featured, detailing the project’s background, smart contract audit results, underlying tokenomics and the specific volatility and liquidity risks associated with the asset.
Hong Kong maintains a robust statutory framework countering market abuse and insider trading under the SFO, which the SFC actively enforces. Prohibited behaviours include insider dealing, false trading, price rigging, stock market manipulation and the disclosure of false or misleading information inducing transactions.
The market abuse framework applied to crypto-assets shares foundational principles with traditional securities but differs materially in its practical application and technical surveillance requirements, as outlined in the SFC’s 11 February 2026 paper of policy statement regarding Perps (“A high-level framework for virtual asset perpetual contracts offering by virtual asset trading platforms”).
In traditional equities, insider information typically revolves around unreleased corporate earnings, executive changes, or pending mergers and acquisitions. Insider information in the crypto market, however, encompasses undisclosed knowledge of impending smart contract upgrades, hard fork events, undetected protocol vulnerabilities or co-ordinated shifts in decentralised liquidity pool architectures. Furthermore, manipulation tactics in the digital asset space are highly specialised. The SFC mandates that licensed VATPs implement bespoke market surveillance systems designed to detect patterns unique to crypto derivatives, such as material deviations between an asset’s underlying index price and its mark price, abnormal funding rate manipulations, wash trading across fragmented blockchain networks and artificially triggered clusters of forced liquidations.
Firms that fail to comply with regulatory requirements face severe enforcement actions, as Hong Kong regulators enforce the rules with aggressive zero-tolerance policies towards fraud and unauthorised operations. Providing VA services without the requisite SFC or HKMA licences constitutes a criminal offence. Penalties include fines of up to HKD5 million and imprisonment for seven years, with continuing offences subject to recurring daily fines. Fraudulently or recklessly inducing others to invest in VAs carries maximum penalties of HKD10 million and ten years’ imprisonment under the AMLO.
Notable enforcement actions underscore this posture. The SFC has consistently issued public warnings and initiated investigations against major unlicensed entities, resulting in criminal referrals to the Hong Kong Police Force. In the high-profile JPEX cryptocurrency exchange fraud case, where losses exceeded USD200 million, authorities arrested numerous influencers and operators on charges of conspiracy to defraud; criminal proceedings have advanced into 2026. The Market Misconduct Tribunal also actively pursues disqualification and compensation orders against directors failing to maintain internal controls or co-operate with investigations, including the recent life bans and financial penalties against individuals for insider dealing and false trading.
Regulators pursue cross-border breaches with equal vigour. The SFC routinely co-ordinates with overseas regulators and has demonstrated its capacity to obtain worldwide freezing orders and injunctions to secure assets belonging to suspected market manipulators domiciled offshore.
The attitude of regulators is expected to remain bifurcated over the next 12 months. While enforcement against unlicensed, fraudulent or non-compliant actors are expected to only intensify, regulators are simultaneously rewarding fully compliant, licensed firms with unprecedented market access. The recent approvals allowing licensed platforms to offer leveraged derivatives, engage affiliated market makers and tap into shared global liquidity pools demonstrate a strategic shift towards fostering a highly competitive, yet strictly supervised, ecosystem.
The primary trigger for requiring a licence to operate a blockchain or crypto-asset business in Hong Kong is “carrying on a business” in a “regulated activity” or “actively marketing” such services to the public in Hong Kong (governed by Section 115 of the SFO and Section 53ZRB of the AMLO). Currently, operating a VATP or issuing an FRS can trigger mandatory licensing. The expansive 2026 proposed amendments to the AMLO introduce new triggers covering any person who, in the course of business:
A draft bill to implement these changes under the AMLO is expected to be introduced to the Legislative Council at a later stage in 2026.
There are strict territorial limits. A licence obtained from the SFC or the HKMA grants the right to operate only within Hong Kong. However, the regulatory perimeter has significant extraterritorial reach. An entity located entirely outside of Hong Kong is nevertheless required to obtain a local licence if it “actively markets” its VA services to the Hong Kong public, or if it issues a stablecoin that references the Hong Kong dollar, regardless of where the entity is domiciled.
When new licensing requirements are introduced, regulators typically implement grandfathering or transitional provisions to prevent market disruption for established players. For example, under the Stablecoins Ordinance, pre-existing issuers were granted a transitional period allowing continued operations provided they submitted a complete licence application to the HKMA by a specified deadline. Similarly, the incoming 2026 AMLO amendments are expected to offer expedited approval processes for existing regulated intermediaries, and for banks already providing dealing and custody services under existing SFC/HKMA guidance. However, the proposals for VA advisory and management notably lack broad transitional arrangements, requiring market participants to engage early with the SFC to ensure continuous compliance.
Obtaining a licence in Hong Kong requires navigating a rigorous, multi-layered application process designed to ensure institutional-grade operational resilience. The core requirement is the “fit and proper” test, wherein the SFC or the HKMA evaluates the financial status, educational qualifications, industry experience and character of the applicant corporation, its ultimate beneficial owners and its executive management.
Applicants must possess significant corporate substance. They must be either a Hong Kong-incorporated company or a registered non-Hong Kong company under the Companies Ordinance, maintaining a permanent physical place of business locally. Local personnel requirements mandate the appointment of at least two responsible officers, who must be physically available in Hong Kong to directly supervise the regulated activities.
Prudential requirements are exceptionally strict. Licensed VATPs and VA managers must maintain substantial paid-up share capital (eg, HKD5 million for advisory and management, HKD10 million for custodians) and maintain continuous liquid capital buffers ranging from HKD100,000 to HKD3 million depending on whether they hold client assets. Furthermore, applicants must submit exhaustive independent assessment reports covering their smart contract architecture, cybersecurity infrastructure, AML/CFT transaction monitoring systems and custody wallet management protocols before approval is granted.
Hong Kong enforces stringent change-of-control requirements to prevent bad actors from bypassing the rigorous licensing gateway through corporate acquisitions. Under Section 132 of the SFO (and the parallel AMLO provisions), for any licensed VATP or regulated VA service provider, the SFC must be notified in writing and grant prior approval before any person becomes a “substantial shareholder” (typically defined as holding 10% or more of the voting rights or issued shares) or an ultimate owner of the entity.
The acquiring entities, new corporate controllers and any newly appointed directors are subjected to the exact same exhaustive ft and proper assessments as the original licence applicants. The SFC also requires detailed notifications within seven business days regarding significant changes in the capital structure, ultimate beneficial ownership, scope of business activities or material alterations to the firm’s internal controls and business plans. If corporate authority is found to be lacking or circumvented during material changes, courts have demonstrated a willingness to nullify agreements entirely, as seen in the recent LT v RV [2026] HKCFI 1280 decision, where a crypto-arbitration settlement agreement was declared void because the signatory director lacked the authority required by a court-approved scheme of arrangement.
Hong Kong does not participate in any regulatory passporting regimes for financial, securities or digital asset licences. The framework is strictly localised. A licence obtained from the SFC or the HKMA cannot be passported into other jurisdictions, and foreign entities holding equivalent licences from sophisticated overseas regulators (such as the UK Financial Conduct Authority or the Monetary Authority of Singapore) cannot passport those permissions into Hong Kong. They must establish local corporate substance, meet all capital thresholds and undergo the full, independent domestic application process to service the Hong Kong market.
Selling blockchain and crypto-asset services cross-border into Hong Kong is subject to severe restrictions. Under both the SFO and the AMLO, it is a criminal offence for unlicensed offshore entities to “actively market” regulated digital asset services or unauthorised investment products to the Hong Kong public. The SFC’s FAQ on this defines the term broadly, encompassing internet activities targeting Hong Kong investors, mass media campaigns and frequently calling on Hong Kong residents.
Permitted marketing by licensed entities is governed by strict advertising standards. Communications must be fair, not misleading and must prominently feature comprehensive risk disclosure statements explaining the volatility, liquidity constraints and cybersecurity risks inherent to the digital assets being offered. Complex products, including overseas non-derivative VA exchange-traded funds, face strict selling restrictions and may only be offered to professional investors following a rigorous assessment of the client’s derivative knowledge.
Firms can theoretically rely on the exemption of “reverse solicitation”, where a Hong Kong resident independently approaches an unlicensed overseas firm for services entirely of their own volition, without any prior marketing, inducement or advertising by that firm. However, this exemption is construed incredibly narrowly by the SFC. Overseas platforms cannot systematically rely on it to build a local client base. Regulators actively investigate platforms attempting to disguise targeted marketing algorithms as reverse solicitation, and firms must maintain meticulous forensic records proving the client initiated the relationship autonomously.
External firms and traditional financial institutions can utilise white-label solutions to sell into Hong Kong by leveraging the complex regulatory licences and trading infrastructure of already-existing, SFC-licensed entities. Institutional liquidity providers and licensed VATPs actively offer API-driven brokerage and custody modules. This architecture enables domestic banks and intermediaries to offer crypto services to their retail clients under their own branding, while the licensed VATP partner executes the transactions and manages the technical custody and regulatory compliance on the back end.
Furthermore, the SFC significantly enhanced these capabilities through two major developments. The “Circular on shared liquidity by VA trading platforms”, issued on 3 November 2025, permitted licensed VATP operators to integrate their order books with affiliated overseas VATPs through a shared liquidity pool. Building on this, the “Circular on licensed corporations providing virtual asset dealing services to offer financing for virtual asset dealing and access to shared order book, and to safeguard client virtual assets relating to withdrawals”, issued on 11 February 2026, permitted licensed VA brokers operating omnibus accounts to tap into these shared order books.
This allows local entities to leverage the deeper shared liquidity pools of global parent companies, provided the offshore affiliate is domiciled in a FATF-compliant jurisdiction and the arrangement incorporates robust conflict-of-interest controls to ensure local client orders receive execution priority.
DeFi
DeFi is conceptually permitted in Hong Kong, as the regulatory framework is fundamentally technology-neutral. However, it is not exempt from rigorous oversight. The SFC applies the principle of “same business, same risks, same rules”. If a DeFi activity structurally mirrors a traditional financial service regulated under the SFO, it falls entirely within the SFC’s regulatory purview.
Centralised Finance (CeFi)
CeFi firms and licensed intermediaries are permitted to utilise DeFi protocols in connection with providing products within the jurisdiction, provided they satisfy stringent risk management obligations. Following the “Circular on staking services provided by virtual asset trading platforms” and the “Circular on SFC-authorised funds with exposure to virtual assets” (both issued on 7 April 2025), licensed VATPs and authorised VA funds must obtain the SFC’s prior written approval before engaging in DeFi interactions, such as staking services or yield-generation protocols. They must address profound concerns regarding smart contract vulnerabilities, liquidity risks and the effective safeguarding of staked client assets. Consequently, authorised funds are generally restricted to staking their VA holdings only through licensed VATPs and authorised institutions, subject to strict concentration caps.
The corporate structures commonly used to operate DeFi globally, such as decentralised autonomous organisations (DAOs), face significant legal friction in Hong Kong due to their lack of recognised legal personality. Operating a pure DAO without a legal wrapper severely complicates contract enforcement, property ownership and the allocation of liability.
To navigate this, participants setting up DeFi structures targeting the jurisdiction typically deploy specialised legal wrappers, such as foundation companies or special purpose vehicles established in offshore jurisdictions. These legal entities hold the IP and interact with centralised service providers. Regardless of the corporate veil, the SFC evaluates the actual operational substance rather than the label of decentralisation.
If a small group of developers retains substantial control over protocol upgrades or administrative keys, regulators will treat the entity as a centralised operator subject to standard substance, capital and licensing requirements. Furthermore, protocols offering liquidity pooling that generate returns are highly likely to be classified as collective investment schemes under the SFO, requiring formal authorisation and prospectus registration.
Hong Kong judges and regulators approach the concepts of accountability and liability in DeFi by piercing the veil of decentralisation to identify the actors exercising functional control. The landmark Court of First Instance ruling in Mantra DAO Inc. v John Patrick Mullin and Others [2024] HKCFI 2099 set a crucial precedent. Despite the entity operating under a decentralised governance model where token holders ostensibly possessed ultimate decision-making power, the court recognised that the specific individuals acting as “councillors” maintained functional control over the operational legal entities.
The court ruled that these individuals owed explicit fiduciary duties to the token holders, including the obligation to keep proper accounts of the cryptocurrency trading business and to disclose financial records. This decision firmly establishes that developers and councillors cannot utilise a DAO structure to evade traditional fiduciary and legal liabilities if their actions cause financial harm or constitute mismanagement. Similarly, regulators actively pursue enforcement actions against the identifiable administrators of non-compliant DeFi protocols, utilising worldwide freezing orders and tokenised injunctions to trace and seize assets regardless of the protocol’s distributed architecture.
Payments in crypto-assets are technically permitted in Hong Kong, but they are not recognised as legal tender for fiat currency. The FSTB and the HKMA have consistently maintained that highly volatile cryptocurrencies, such as Bitcoin, lack the reliability necessary to perform standard monetary functions. Businesses are free to accept them for commercial transactions, but they do so entirely at their own risk.
The courts will not treat debts denominated in VAs as standard fiat debts, placing the full burden of managing the associated foreign exchange, taxation and AML/CFT compliance risks directly on the accepting merchants. Conversely, the government actively supports the use of regulated stablecoins and tokenised commercial bank deposits to address pain points in cross-border settlements and payment efficiencies.
Hong Kong law enforces a rigid and statutory distinction between fiat-backed stablecoins and algorithmic stablecoins. FRS are defined as digital representations of value that purport to maintain a stable value with reference to one or more official fiat currencies. Algorithmic stablecoins utilise complex smart contract algorithms and incentive mechanisms to maintain their peg through dynamic expansion and contraction of token supply, without relying on fully backed physical reserves.
Due to their inherent susceptibility to death spirals and bank-run risks, algorithmic stablecoins do not qualify for issuance under the licensing regime, effectively excluding them from the regulated local payment ecosystem.
Fiat-backed stablecoins are heavily regulated in Hong Kong. Rather than retrofitting stablecoins into the pre-existing Payment Systems and Stored Value Facilities Ordinance, the government enacted a bespoke, purpose-built framework, the Stablecoins Ordinance, which became fully operational on 1 August 2025.
This bespoke framework establishes a comprehensive licensing regime administered exclusively by the HKMA. It captures any person issuing an FRS in Hong Kong, issuing an HKD-referenced stablecoin anywhere globally or actively marketing an FRS to the Hong Kong public.
The framework is significantly more stringent than legacy payment regulations, as it imposes rigorous capital requirements, continuous reporting obligations and strict limits on the types of institutions permitted to distribute the assets. Legally, only permitted offerors, namely licensed stablecoin issuers, authorised banking institutions, SFC-licensed VATPs and licensed securities brokers, are allowed to offer specified stablecoins to the retail public in Hong Kong.
Targeting to significantly mitigate the risk of insolvency and systemic runs, the HKMA imposes exacting requirements on backing assets for fiat-backed stablecoins. Licensed issuers must maintain eligible, highly liquid reserve assets whose value equals or exceeds the par value of the stablecoins in circulation at all times. The composition of these reserves is strictly limited to high-quality assets, predominantly fiat currency deposits and short-term sovereign debt denominated in the exact referenced currency.
These backing assets must be fully segregated from the issuer’s proprietary funds and held in bankruptcy-remote structures. The HKMA strongly mandates that a licensed bank in Hong Kong acts as the primary custodian of these reserve assets to ensure immediate accessibility. Furthermore, to ensure the stablecoin functions strictly as a medium of exchange rather than a yield-bearing collective investment scheme, Section 15 of Schedule 2 to the Stablecoins Ordinance heavily restricts the ability of the issuer to pay interest or yield derived from the reserve assets directly to the stablecoin holders.
Stablecoin arrangements that achieve massive public adoption may pose unique macroeconomic threats to the jurisdiction. To address this, the HKMA is granted extraordinary statutory power under the Stablecoins Ordinance to designate specific stablecoin networks as carrying “systemic risk”. This designation is based on factors such as aggregate transaction volume, the number of users and the stablecoin’s level of integration into the broader domestic payment and settlement ecosystem.
Systemic stablecoin issuers are subject to thorough regulatory oversight, most notably exemplified by their inclusion under the FIRO (Chapter 628). By bringing systemic stablecoins under the FIRO, the HKMA ensures that if a major issuer faces catastrophic failure, the central bank can legally bypass traditional, protracted insolvency proceedings. The HKMA can assume direct operational control of the entity, enforce wind-down plans, execute bail-in mechanisms or execute stabilisation options – eg, transferring the reserve assets and critical operations to a government-managed bridge institution – to immediately halt financial contagion and preserve the stability of broader Hong Kong financial markets.
In Hong Kong, tokenised assets and RWAs are regulated using a strict look-through approach, comparing them directly with their non-blockchain equivalents. The SFC defines tokenised securities as traditional financial instruments (such as stocks, bonds or mutual fund units) that utilise DLT. The regulatory philosophy is that the utilisation of a blockchain wrapper does not fundamentally alter the economic substance or legal rights attached to the asset.
Consequently, tokenised securities are expressly excluded from the definition of VAs under the AMLO and are instead fully governed by the traditional SFO. Issuers of tokenised RWAs like tokenised real estate funds or fractionalised equity must comply with the exact same prospectus requirements, continuous financial disclosures and professional investor restrictions as traditional securities issuers. Intermediaries distributing or advising on tokenised RWAs must hold the corresponding Type 1 (Dealing) or Type 4 (Advising) securities licences.
However, the SFC does impose additional requirements specific to the technological medium. Managers and distributors of tokenised assets must conduct rigorous technical due diligence on the underlying smart contracts, assess the cybersecurity resilience of the chosen blockchain network, and implement robust private key management and contingency protocols that go beyond standard traditional securities operations. This ensures that while the economic regulation remains consistent with traditional markets, the unique technological risks inherent to DLT are effectively mitigated.
Furthermore, expanding on this framework, the SFC issued the “Circular on secondary trading of tokenised SFC-authorised investment products” on 20 April 2026, which sets out the requirements for allowing the secondary market trading of these tokenised products by the retail public in Hong Kong. To ensure market scalability and investor protection, this circular mandates that subscriptions and redemptions must account for liquidity risk management tools and forward pricing considerations. It also introduces the role of “connecting brokers” – entities tasked with directing clients’ secondary trading orders to SFC-licensed VATPs – and requires robust contingency plans to manage potential trading halts in the secondary market if primary dealing is suspended.
35th Floor
Two Exchange Square
8 Connaught Place Central
Hong Kong
+852 3758 1200
+852 3014 7818
cooleyasiamarketing@cooley.com www.cooley.com