The Financial Technology Law Review: Hong Kong


Benefiting from its low tax rates, the 'one country, two systems' principle and its proximity to mainland China, Hong Kong is one of the biggest international financial centres in the world, and attracts businesses from all around the world that are interested in tapping into the Chinese market and vice versa. With the rapid development of and increased appetite for technology in the financial sector, Hong Kong is well poised to take advantage of the opportunities brought about by the development of the Greater Bay Area, and continues attract businesses from all around the world that are interested in participating in the fintech sector.

As of time of writing, Hong Kong remains largely technologically neutral with regard to technological development in the financial sector. Hong Kong regulatory bodies remain cautious: they generally apply the existing regulatory framework to technological developments (e.g., to use the current legislation regarding securities to attempt to regulate cryptocurrency exchanges) and issue guidance regarding the latest hot topics from time to time (e.g., position papers and guidelines regarding the regulation of cryptocurrency, digital payments). Otherwise, Hong Kong generally welcomes technological advancements and will likely continue to adopt this attitude in the foreseeable future. Hong Kong authorities have granted multiple licences encompassing multiple facets of the fintech sector, including eight virtual bank licences, two virtual insurer licences, 18 stored value facility licences and several automated digital advising licences.


i Licensing and marketing

There are several licences that are applicable to the fintech industry, depending on the business being conducted by a corporation, but there is no one specific licence for fintech, in light of the broad spectrum of services available in this field. These include: (1) the virtual bank licence, issued by the Hong Kong Monetary Authority (HKMA), which allows the licence holder to deliver retail banking services through the internet instead of a physical branch; (2) the stored-value facility licence, also issued by the HKMA, which governs the operation of retail payment systems and stored value facilities; (3) various securities licences, issued by the Securities and Futures Commission (SFC), which allow the holder to carry out regulated activities (most likely covering services that involve securities and futures); (4) the money service operator licence (MSO), issued by the Customs and Excise Department (CED), which allows licence holders to provide money services; and (5) the money lender's licence, issued by the Hong Kong court and monitored by the Hong Kong Police (which allows a person to carry out business as a money lender in Hong Kong). With the increasing popularity of 'insurtech' (which falls under the umbrella of fintech), the Insurance Authority may also issue relevant insurance licences if the product being handled relates to an insurance product.

Depending on the exact nature and scope of regulated activities to be carried out by such a corporation, provision of an automated digital advisory service typically requires a licence from the SFC to carry out Type 1 (dealing in securities) and Type 4 (advising on securities).2 A corporation providing asset management services would typically require a licence from the SFC to carry out Type 4 (advising on securities) and Type 9 (asset management) regulated activities.3

Credit information services are generally governed by Type 10 regulated activities (providing credit ratings services) under the the Securities and Futures Ordinance (SFO), pursuant to which 'credit ratings' are defined as opinions, expressed using a defined ranking system, primarily regarding the creditworthiness of: (1) a person other than an individual; (2) debt securities; (3) preferred securities; or (4) an agreement to provide credit. Corporations carrying out such regulated activities would also be required to comply with the Code of Conduct for Persons Providing Credit Rating Services issued by the SFC in June 2011.

Under the Companies (Winding Up and Miscellaneous Provisions) Ordinance (CWUMPO), it shall not be lawful to issue any form of application for shares in or debentures of a company to the Hong Kong public unless the form is issued with a prospectus that complies with the requirements of the CWUMPO and is registered with the Registrar of Companies in Hong Kong (the Prospectus Requirements). In addition, Section 103 of the SFO prohibits a person from issuing an advertisement, invitation or document which to his knowledge is or contains an invitation to the public to deal in any 'securities' (which is widely defined under Schedule 1 to the SFO) unless the issue has been authorised by SFC (the SFC Authorisation), which will in turn require the offering document to comply with the Prospectus Requirements. There are certain exemptions to the Prospectus Requirement and the SFC Authorisation requirement, the most common of which are:

  1. professional investors exemption: offers made to professional investors only (as defined under the SFO);
  2. private placement exemption: offers made to a maximum of 50 persons in Hong Kong provided that the offering document contains a warning statement as specified under Part 3 of Schedule 18 to the CWUMPO;
  3. sophisticated investor exemption: offers where the minimum principal amount to be subscribed by any person is not less than HK$500,000 (or its foreign currency equivalent), with the appropriate specified warning statement in a prominent position of the offering document;
  4. de minimis offering exemption: offers in respect of which the total considerable payable for the offering does not exceed HK$5 million (or its foreign currency equivalent); and
  5. outside HK investors exemption: offers to persons outside Hong Kong.

Section 114 of the SFO also prohibits carrying on a business in a regulated activity, or holding oneself out as doing so, save for a licensed intermediary or an authorised institution. In addition, pursuant to the Code of Conduct for Persons licensed by or Registered with the Securities and Futures Commission (the SFC Code of Conduct), licensed intermediaries are required to act honestly and fairly towards customers. Paragraph 2.3 of the SFC Code of Conduct further requires licensed intermediaries to ensure that invitations and advertisements do not contain information that is false, disparaging, misleading or deceptive. The SFC has also issued guidelines including but not limited to the Advertising Guidelines Applicable to Collective Investment Schemes Authorised under the Product Codes, Guidelines on Use of Offer Awareness and Summary Disclosure Materials in Offerings of Shares and Debentures Under the Companies Ordinance and Guidelines on Marketing Materials for Listed Structured Products (collectively, the SFC Marketing Guidelines), all of which will apply to various forms of product advertisements (e.g., distribution materials, display-only materials, broadcasts and interactive systems). For illustration purposes, in the case of collective investment schemes, the material must: (1) not be false, biased, misleading or deceptive; (2) be clear, fair and present a balanced picture of the scheme with adequate risk disclosures; and (3) contain information that is timely and consistent with its offering document. The SFC Marketing Guidelines have also imposed requirements on the content of the material, such as requiring statements of opinion regarding a structured product or management company's level of performance to (1) be reasonable; (2) not contain words or phrases that may give investors the impression that they cannot lose money or that profits are guaranteed (unless the scheme has a guarantee feature); (3) not give the impression that an investor could profit without risk; and (4) not seek to denigrate competitors in such a way as might lower the reputation of the industry. There are also requirements that are specific to other medium of marketing, including radio, television, cinema or other time-limiting advertisements or broadcasts to reinforce marketing may only be conducted if there are sufficient investor protections in place.

If a corporation operates an automated digital advisory or asset management company relating to financial products or services, it may also be bound by additional guidelines issued by the SFC – the Guidelines on Online Distribution and Advisory Platforms issued in July 2019 (the SFC Online Guidelines). Among other principles, the platform operator should comply with the six core principles identified by the SFC, including (1) proper design; (2) information for clients; (3) risk management; (4) governance, capabilities and resources; (5) review and monitoring; and (6) record keeping. If such a corporation is to provide robo-advice, a service by which advice is provided directly to clients online through the direct use of technology tools by clients, Chapter 4 of the SFC Online Guidelines would apply. According to these, the robo-advisor should comply with various rules regarding the provision of sufficient information to clients, client profiling, system design and development, supervision and testing of algorithms, adequate resources and rebalancing outlined in the SFC Online Guidelines.

ii Cross-border issues

As a general rule, if a corporation deals with the general public in Hong Kong, their activities would be subject to Hong Kong law. If the services or products provided by such corporations are securities related, such services or products would be governed by the SFO. The SFO is silent on whether the regulated activities are subject to any geographical requirements, but it is generally interpreted that a foreign corporation may still be subject to Section 103 of the SFO if it has marketing activities in Hong Kong. Whether there is any active marketing in Hong Kong would be determined by the specific circumstances (for example, whether the corporation had contacted a Hong Kong investor or organised events targeting Hong Kong investors). If it is determined that a foreign corporation is marketing in Hong Kong, they may need to be licensed or registered with the SFC and may even be subject to the Prospectus Requirements and the SFC Authorisation requirement under the the Companies Ordinance and the SFO, unless one of the exemptions discussed above applies.

To the extent of fund distribution, following memoranda of understanding (MOUs) signed by Hong Kong with China, Switzerland, France, Luxembourg and the United Kingdom, a system of mutual recognition of funds is put in place between Hong Kong and the above-mentioned signing countries to allow eligible funds to be passported into Hong Kong and vice versa. The MOUs with each country differ slightly from each other on the structure of the funds and the type of funds that would be eligible for mutual recognition. For example, the MOU with France requires the fund to retain a minimum of 20 per cent of the net asset value to be attributable to Hong Kong investors, the MOU with the United Kingdom prohibits leverage over 100 per cent of the net asset value, and the MOU with Luxembourg requires the fund to be managed by a fund manager who has a minimum of HK$10 million in capital. Having said that, all foreign funds to be offered into Hong Kong will require the fund to appoint a firm in Hong Kong as representative and also engage a licensed intermediary to carry out any marketing activities of the fund in Hong Kong.

Similarly, under Section 114 of the SFO, the restriction on carrying on business in regulated activities does not make any distinction between foreign or local corporations. Therefore, corporations should obtain licences from the SFC if they provide cross-border regulated services and products targeting the Hong Kong public.

Nevertheless, a temporary licence under Section 117 of the SFO could be available to foreign corporations if they are already licensed or regulated in other jurisdictions. Such temporary licence, if granted, is valid for up to three months, and the same person cannot hold a temporary licence for more than six months in any two-year period. The SFC will consider whether the foreign corporation is subject to similar regulatory requirements as imposed, monitored or enforced by the foreign corporation's local regulator and whether such local regulator would be able to take disciplinary action against the foreign corporation for their actions in Hong Kong as part of the consideration in granting the temporary licence. There are also other restrictions to the temporary licence, such as not allowing all types of regulated activities or not holding all client assets.

The restrictions relating to offering or inviting investors under Section 103 of the SFO are only relevant to invitation to investments made in Hong Kong, but there is no specific restriction under the SFO if there is a genuine enquiry made by a Hong Kong investor to the foreign corporation. Provided that the response to the enquiry made by the Hong Kong investor is bespoke and tailored to the enquiry, the foreign corporation may not be subject to the restriction under Section 103. This is a process that is commonly referred to as 'reverse enquiry'.

There are no currency exchange controls in Hong Kong, but the flows of funds in and out of Hong Kong may be prohibited or restricted by laws such as United Nation (Anti-Terrorism Measures) Ordinance, United Nations Sanctions Ordinance and other relevant laws and regulations. There is no limitation on ownership of companies by foreigners in place in Hong Kong.

Digital identity and onboarding

There are no laws and regulations in Hong Kong relating to establishing digital identity but a similar concept was introduced by the Electronic Transaction Ordinance (ETO), which allows digital certificates to be created to serve as a guaranty of identity during electronic transactions. Digital certificates can only be issued by recognised certification authorities, which to this date only include the Hongkong Post Certification Authority and Digi-Sign Certification Services Limited. Nevertheless, any person may apply to the Government Chief Information Officer to become a recognised certification authority pursuant to Section 20 of the ETO. Once issued, digital certificates can be used to identify a person in a process known as electronic authentication to verify transactions. At the moment, personal digital certificates can only be applied by individuals who possess a Hong Kong identity card (the applications do not accept other form of identification documents, such as passports). On the other hand, corporations can also apply for digital certificates and there is no restriction on the jurisdiction of the corporations as long as the corporation has obtained a business registration certificate issued by the Hong Kong government.

The ETO covers situations when electronic signature or services can be used, including transactions between private individuals or with government entities. Digital certificates are more commonly used for any applications or transactions with government entities, for example, voter registration and applications for renewal of vehicle licences. The ETO also recognises private transactions conducted by electronic means provided the parties to the transaction consent to it. Pursuant to 'Supplement V to the Mainland and Hong Kong Closer Economic Partnership Arrangement' (CEPA) and the Suggestions on the Framework for the Mutual Recognition of Electronic Signature Certificates issued by Hong Kong and Guangdong, a mutual recognition arrangement and the mutual recognition certificate policy was developed and entered into on 10 August 2012, pursuant to which digital certificates issued by the recognised certification authority in Hong Kong are mutually recognised in the Guangdong province of China and vice versa, provided that the authorisation of the recognised certification authority and its conduct observes and complies with the mutual recognition certificate policy.

Pursuant to the amended Paragraph 5.1 of the SFC Code of Conduct (which took effect on 5 July 2019), acceptable account opening methods are now set out in the SFC's website instead of in the SFC Code of Conduct. The SFC also issued the Circular to Intermediaries: Remote Onboarding of Overseas Individual Clients on 28 June 2019, along with an FAQ to address various issues regarding digital onboarding. In addition to the face-to-face approach, the SFC now permits a licensed intermediary to adopt other account opening procedures, provided that such procedures can satisfactorily ensure the identity of the client. There are several methods that are acceptable according to the SFC: (1) certification by another person (whereby a client agreement and the identity documents of the customer are being certified by another licensed person, an affiliate, a Justice of the Peace or a professional person); (2) using the certification services (when the licensed intermediary accepts an electronic signature certificate to replace actual identity documents); (3) by mail (where the customer mails a copy of the identity document and the client agreement to the intermediary together with a physical cheque bearing the same signature as the one on the client agreement); (4) online onboarding with a Hong Kong designated bank account (where the customer electronically signs the client agreement and provides a copy of the identity document, and all future deposits and withdrawals from the client's trading account must be with a bank account in Hong Kong in the customer's name); and (5) remote onboarding of overseas individual clients (where technology adhering to the international standards and best practice such as ISO/IEC 19795 (biometric performance testing and reporting) and ISO/IEC 30107 (biometric presentation attack detection) are adopted in the process of client identification together with requiring all deposits into and withdrawals from the client's trading account be with a bank account opened with a designated bank in the customer's name from an eligible jurisdiction). For point (5), there are currently 16 eligible jurisdictions, namely Australia, Austria, Belgium, Canada, Ireland, Israel, Italy, Malaysia, Norway, Portugal, Singapore, Spain, Sweden, Switzerland, the United Kingdom and the United States.

Digital markets, payment services and funding

The SFC issued the Position Paper: Regulation of Virtual Asset Trading Platform (the Position Paper) on 6 November 2019 announcing that 'some types of centralized platforms trading security and non-security tokens would be suitable to be regulated' by the SFC with the regulatory standards similar to those required of licensed automated trading service (ATS) providers or brokers.

The SFC has reiterated in the Position Paper that platform operators that trade only non-security virtual assets are not regarded as carrying out 'regulated activities' for the purposes of the SFO, and these platform operators may continue to operate in Hong Kong without applying for an SFC licence. Nevertheless, if a platform operator decides to opt in to the SFC regulatory remit, which would require the platform operator to offer at least one security token on its platform, the SFC would be empowered to grant the licences for Type 1 (dealing in securities) and Type 7 (providing ATS). The SFC will take a holistic approach to the infrastructure, core fitness and properness and conduct of all virtual assets (be they securities or not) trading activities viewed as a whole and subject to the SFC's supervision.

If the SFC decides to grant the licences (Types 1 and 7) to a platform operator, it will impose certain licensing conditions that are outlined in the terms and conditions attached to the Position Paper. The licensed platform operator is also required to comply with all other regulatory requirements as set out in the SFC Code of Conduct and Guidelines, circulars and frequently asked questions published by the SFC from time to time. It is important to note that any breach of the above could be considered 'misconduct', which may also reflect adversely on the fitness and properness of a licensed platform operator and may result in disciplinary action including licence revocation and fines. Despite the innovative approach by the SFC to virtual assets platform operators, there remain certain limitations on the SFC's regulatory power over virtual assets platform operators and their licensed platforms. For example, whether the SFC is able to take action under Parts XIII and XIV of the SFO against market misconduct on such platforms in the same way it does in the traditional securities and futures market remains to be seen.

Section 103 of the SFO prohibits the advertisement of offers and invitations to participate in a 'collective investment schemes' (CIS) unless one of the exemptions applicable to the Prospectus Requirement and SFC Authorisation, as referred to above under the Section 'Regulation', applies. A CIS is defined in Paragraph (d) of the definition of 'securities' of Schedule 1 of the SFO, which includes interests in 'collective investment schemes'. A CIS is an investment product that is collective in nature, the definition embraces and modernises the concepts of 'unit trust', 'mutual fund corporation' and 'investment arrangements'. The definition under Schedule 1 can be narrowed down to a more concise four-part test: a collective investment scheme generally requires: (1) an arrangement in respect of property; (2) that participants in the scheme do not have day-to-day control over the management of the property; (3) such property is managed as a whole by or on behalf of the person operating the arrangements, or the contribution of the participants and the profits or income from which payments are made are pooled; and (4) the purpose of the arrangement is for participants to participate in or receive profits, income or other returns from the acquisition and management of property.

Hong Kong does not have any specific laws or regulations in relation to crowdfunding. Crowdfunding activities such as peer-to-peer lending in Hong Kong and equity crowdfunding may be considered as a CIS and, if offered to the public in Hong Kong, may be subject to a number of Hong Kong regulatory provisions, for example, the Prospectus Requirement and the SFC Authorisation requirement unless an exemption applies (see Section II).

Operators of crowdfunding platforms would also be subject to Section 103 of the SFO as outlined above. If the operator of a crowdfunding platform carries on a regulated activity, it is required to obtain appropriate SFC licences4 and would also be required to comply with the SFC Code of Conduct, which contains provisions requiring licensed intermediaries to establish clients' financial situations, investment experience and ensure that investment products recommended to the clients are suitable.

In addition to the same regulatory prohibitions that may be applicable to crowdfunding as outlined above, peer-to-peer lending by individuals or businesses might constitute the carrying on of business as a money lender, which requires the person or business to be a licensed money lender under the Money Lenders Ordinance (MLO). The MLO requires anyone who wishes to carry on business as a money lender to apply to a licensing court for a licence, processed by the Companies Registry and enforced by the Commissioner of Police. The term 'money lender' is defined in Section 2 of the MLO as 'every person whose business (whether or not he carries on any other business) is that of making loans or who advertises or announces himself or holds himself out in any way as carrying on that business'. Certain persons and loans under Schedule 1 of the MLO are excluded from the definition. Peer-to-peer lenders may be able to rely on an exemption where the corporation, firm or individual making the loan does not carry out the lending of money as its ordinary business. It would, however, be difficult in the case of any individual lender to determine at what point the lender is 'carrying on a business of lending money'.

Subject to whether the loans or financings would constitute securities (which is inclusive of an interest in a CIS), trading of such loans or financings may fall under the regulation of the SFO, which means only licensed corporations can conduct any secondary trading. Otherwise, transfers of loans and financings may be conducted by way of legal or equitable assignment:

  1. Legal assignment: a legal assignment is an assignment which meets the criteria set out in the Law Amendment and Reform (Consolidation) Ordinance:
    • an absolute assignment by way of sale of the assignor's entire legal interest in the receivables (e.g. loan);
    • in writing and signed by the assignor; and
    • with express written notice of the assignment (in particular the date of assignment and the identity of the assignee) given to the obligor.
  2. Equitable assignment: an equitable assignment is an assignment that has not met all the requirements as mentioned to create a legal assignment (typically, not being able to give notice to the obligor).

In Hong Kong, there are no laws specifically for securitisation other than in respect of capital treatment and disclosure requirements for 'authorised institutions' as defined in the Banking Ordinance (BO) (e.g., banks).

Any person operating a money service should be licensed with the Commissioner of Customs and Excise pursuant to the Anti-Money Laundering and Counter Terrorist Financing Ordinance (AMLO). 'Money service' includes money changing and remittance services.

If the person operating the payment service issues a facility that can store value and gives an undertaking that such facility may be used for the payments for goods or services of either the issuer or another person, the person may be required to be licensed with the stored-value facility licence (the SVF licence) pursuant to the Payment Systems and Stored Value Facilities Ordinance (PSSVFO). The 'undertaking' referred to above means an undertaking that the issuer will accept payment up to the amount of the stored value that is available for use under the rules of the facility or that the issuer will make payment to the recipient of such amount. It is noteworthy that the SVF licence also applies to a 'facilitator', which is defined to be anyone who is not the issuer and provides the issuer with valuable consideration the value of which determines the extent to which the issuer may give an undertaking (for example, by providing the reserve in some of the business model (of 'stablecoins').

Businesses in Hong Kong are subject to the Personal Data (Privacy) Ordinance (PDPO), which regulates the collection, use and handling of personal data received by corporations or persons (the data users). PDPO places restrictions on use and disclosure of personal data under Data Protection Principle 3 of the PDPO and thus data users should not make client data accessible to third parties without the consent of the client under normal circumstances.

However, the PDPO also contains exemptions to the restrictions on use and disclosure of client data under Data Protection Principle 3. Exemptions apply for any use or disclosure of client data which is (1) required or authorised by any Hong Kong law or court order; (2) required in connection with legal proceedings in Hong Kong or exercising or defending legal rights in Hong Kong; (3) for the purpose of a due diligence exercise in connection with a proposed sale or merger; and (4) for the purpose of preparing statistics or carrying out research (provided that no identifying information of any client is published).

In relation to product data, companies would need to disclose its product data if it is requested by a regulator in Hong Kong to provide such information in accordance with the provisions of a specific law in Hong Kong. There are various laws in Hong Kong that grant wide investigative powers to authorities in Hong Kong to conduct investigations, including the SFC, HKMA, the Insurance Authority and the Hong Kong Independent Commission against Corruption (ICAC).

Cryptocurrencies, initial coin offerings (ICO) and security tokens

There is no specific regulatory framework for blockchain technology in Hong Kong. Such technology and related businesses are subject to the existing body of Hong Kong financial laws and regulations. However, the HKMA and the SFC have issued a number of statements clarifying their regulatory stance.

In February 2015, HKMA stated in a press release that Bitcoin is not legal tender but a virtual commodity. Given that Bitcoin does not have any backing, either in physical form or from the issuer, it cannot be qualified as a means of payment or electronic money. The HKMA expressly stated that it does not regulate Bitcoin and other similar virtual commodities.

The SFC issued a statement on 5 September 2017 (the 2017 Statement), addressing the issue of initial coin offerings (ICO). Offering cryptocurrencies to investors in Hong Kong (as part of an ICO) may, depending on the feature of the ICO, be subject to Hong Kong's existing securities law regime. The 2017 Statement outlines specifically three types of terms and features of digital tokens in ICOs that might constitute securities:

  1. Tokens may be regarded as shares if they represent equity or ownership interests in a corporation, for example, where the token holders are given shareholders' rights, including the right to receive dividends and the right to participate in the distribution of the corporation's surplus assets upon winding up.
  2. Tokens may be regarded as debentures where the digital tokens are used to create or to acknowledge a debt or liability owed by the issuer. For example, an issuer may repay token holders the principal of their investment on a fixed date or upon redemption, with interest paid to token holders.
  3. Tokens may be regarded as an interest in a CIS if the token proceeds are managed collectively by the ICO scheme operator to invest in projects with the aim of enabling token holders to participate in a share of the returns provided by the projects. The concept of CIS has been set out under Section IV.

The SFC published a circular in December 2017 in relation to Bitcoin futures contracts and other cryptocurrency-related investment products, where the SFC warned that Bitcoin futures contracts traded on a futures exchange are regarded as 'future contracts' for the purposes of the SFO, even though the underlying assets of such future contracts may not be regulated under the SFO. It was noted that other cryptocurrency-related investment products may, depending on their terms and features, be regarded as 'securities' as defined under the SFO.

In November 2018, the SFC issued the Statement on Regulatory Framework for Virtual Asset Portfolios Managers, Fund Distributors and Trading Platform Operators (the 2018 Statement). The Statement introduced the concept of a new asset class called 'virtual assets', which are 'a digital representation of value'. Examples include cryptocurrencies, cryptoassets and digital tokens (such as digital currencies, utility tokens or security or asset-backed tokens) and any other virtual commodities, cryptoassets and other assets of essentially the same nature. The SFC has not made clear which tokens or coins would fall under this new asset class but has admitted that many virtual assets do not necessarily constitute securities or futures contracts for the purpose of the SFO.

The 2018 SFC issued a statement on 28 March 2019 that further confirms the SFC's approach to virtual assets which fall within the definition of 'securities' under the SFO (security tokens) and confirms that marketing and distribution of security tokens must be conducted by a person licensed and registered for Type 1 regulated activity (as further set out below) (Type 1 intermediaries). The SFC places substantial reliance on Type 1 intermediaries to comply with the existing codes of conduct, new guidance issued by the SFC and other laws and regulations, to ensure that purchasers of security tokens are fully protected. This includes restricting the offerings of security tokens to professional investors only, conducting thorough due diligence on the security tokens and the issue of such tokens, the asset backing the security tokens and all other relevant materials, and providing all information to the purchaser in a clear and easily comprehensible manner.

The SFC has emphasised the importance of compliance with the suitability requirement in Paragraph 5.2 of the SFC Code of Conduct, as well as the new requirements for 'complex products' in Paragraph 5.5 of the SFC Code of Conduct, which came into effect on 6 July 2019.

The SFC has also highlighted key requirements of its Circular to Intermediaries on the Distribution of Virtual Asset Funds dated 1 November 2018 (that would apply equally to the distribution of security tokens):

  1. Security tokens should only be offered to persons who qualify as 'professional investors' under the SFO and the Securities and Futures (Professional Investor) Rules.
  2. Intermediaries distributing security tokens need to understand the STOs and conduct proper due diligence, covering the background and financial soundness of the management, development team and issuers of the security tokens as well as the rights attached to the underlying assets of the security tokens. Intermediaries should also review the White Papers and marketing materials in respect of the STOs.
  3. Intermediaries should give clients information relating to STOs in a clear and easily comprehensible manner and should give clients prominent warning statements covering the risks associated with virtual assets. These risks include insufficient liquidity, volatility, opaque pricing, hacking and fraud.

Tokens can be linked to the underlying assets through recording the asset digitally and provide a graphically secured representation of value that can be stored and transferred within a distributed ledger.

The current system in Hong Kong requires the issuance of paper certificates and use of paper instruments of transfer for certain securities. Under Section 144 of the Companies Ordinance (CO), a company must complete and issue share certificates after an allotment of shares has been completed. Nevertheless, there have been movements toward paperless securities regime in Hong Kong over the last two decades. The Securities and Futures and Companies Legislation (Uncertificated Securities Market Amendment) Ordinance 2015 (the Amendment Ordinance) includes provisions introducing an uncertificated securities market regime (therefore paperless). However, as of the date of this article, the Amendment Ordinance is not yet in effect.

There are no laws and regulations that specifically deal with the laundering of cryptocurrencies and tokens. The Anti-Money Laundering Ordinance (AMLO) principally applies to financial institutions (including HKMA-authorised institutions (i.e., banks, SFC-licensed corporations, licensed insurance companies, stored-value facility issuers and money service operators) and designated non-financial business and professions (DNFBP) (e.g., law firms). If a corporation deals with cryptocurrencies and tokens, it is not directly subject to the provision of the AMLO, unless such corporation falls within the definition of financial institutions or DNFBPs.

In addition to the AMLO, corporations would be subject to the Drug Trafficking (Recovery of proceeds) Ordinance (DTPRO) and the Organized and Serious Crime Ordinance (ORSCO), which makes it a criminal offence for a person who knows or has reasonable grounds to believe that any 'property' (a definition that is likely to include Bitcoin, Ether and other forms of virtual commodities or virtual assets) in whole or in part represents the proceeds of drug trafficking or crime, to deal with that property. Corporations must also comply with the United Nations (Anti-Terrorism Measures) Ordinance (UNATMO) in relation to terrorism financing. In general, the DTPRO, ORSCO and UNATMO require any suspected transactions involving money laundering, terrorist financing or receipts of crime to be reported to the Joint Financial Intelligence Unit by submitting a suspicious transaction report (STR) as soon as practicable. Failure to file an STR is a criminal offence.

In general, there is no capital gains tax, withholding tax or value added tax (VAT) payable in Hong Kong. That being said, any Hong Kong-sourced income from frequently known cryptocurrencies (e.g., Bitcoin and Ether, which are generally considered virtual commodities in Hong Kong) trading in the ordinary course of business may be treated as income in the case of individual clients, and profits in the case of corporations, and may be subject to income tax and profits tax respectively regardless of whether the trading is done exclusively in cryptocurrency or fiat-to-cryptocurrency exchanges. According to a press release dated 3 April 2019, the Inland Revenue Department of Hong Kong (IRD) states that it does not maintain statistics specifically on tax payable by persons carrying out virtual asset-related activities and that each case should be assessed on the basis of its own individual facts and circumstances. The IRD would also, if necessary, seek relevant information from other tax authorities through the exchange of information mechanism under tax treaties to assess the situation. The IRD has provided further guidance on its treatment of cryptocurrencies in its Departmental Interpretation and Practice Notes dated March 2020. In particular, the IRD makes a distinction between security tokens and utility tokens, as utility tokens would be considered as a prepayment for future goods or services and may be chargeable under profits tax. Furthermore, the IRD clarifies its position that all Hong Kong-sourced profits from cryptocurrency business are chargeable to profits tax, and that broad guiding principles will be applied to determine whether such profits are generated from Hong Kong. In addition, any cryptocurrency that is (1) attained in the process of business transactions; and (2) received as employment income will be taxable, with the value of the cryptocurrency to be determined at the time of accrual.

To the extent where security tokens are concerned, stamp duty is imposed on the transfer of interests in land and certain transfers of stock, and the hokder of any token that is linked to such property should be aware of the potential stamp duty payable for the transfer.

Any person who markets and distributes security tokens (whether in Hong Kong or targeting Hong Kong investors) is required to be licensed or registered for Type 1 regulated activity under the SFO.

Digital assets

Other new business models

There is no law that regulates self-executed contracts. As long as the execution can comply with the applicable regulatory regime, a self-executed contract would be recognised. For instance, as long as the contract is validly entered into, any automatic transfer of funds or digital assets would be deemed validly made. However, any specific assets that require registration with local authorities (for example transfer of Hong Kong property or shares in a Hong Kong company) would not be recognised unless the necessary transfer procedure is followed and all necessary filings are made with the government authorities.

Mediation and arbitration are recognised and acceptable methods of alternative dispute resolution in Hong Kong. Under Hong Kong law, parties to a private transaction are at liberty to require any disputes to be resolved through mediation or arbitration instead of court proceedings, provided that the parties clearly record such arrangement in the agreement bewteen them.

It is currently unclear whether a fully automated investment process (i.e., dealing in securities without any human intervention) would be permitted. According to the SFC Online Guideline, robo-advice refers to the provision of financial advice in an online environment using algorithms and other technology tools (which the SFC notes in the SFC Online Guidelines include fully automated investment advice via an online platform with no human intervention) but this does not seem to cover situations where an investment process can be made automatic.

The increasing interest in Hong Kong for blockchain technology has sparked the creation of different business models and even introduced a new industry. One notable business model is the issuance of 'stablecoins', which are pegged to the value of a certain currency, for example, the Hong Kong dollar. Such a business model is also influenced by the introduction of the coin to be issued by Facebook, Libra. However, regulators have concerns over the use of stablecoins as they expose the market to significant risks, such as AML issues, banking and financial industry risks, and state-specific treasury policies etc. While there are currently no specific laws in Hong Kong that deal with, prohibit or regulate stablecoins, the PSSVFO is most relevant to the operation and issuance of stablecoins. PSSVFO regulates stored-value facilities that are used for payment for goods and services, whose functions are similar to stablecoins by virtue of storing monetary value and assisting payment using the stored monetary value. Any corporation that wishes to issue a stored-value facility must apply for a SVF licence from the HKMA.

There is also a regulatory requirement on companies that facilitate the issuance of a stored-value facility, which addresses companies that provide the valuable consideration for the issuer.

Intellectual property and data protection

Codes, programs, source codes or related software are generally protected under the Copyright Ordinance by way of copyright. Copyright arises automatically as long as the work is original and recorded in a material form. Software is usually covered under the category of 'literary works' under the Copyright Ordinance. However, mere ideas are not protected and therefore business models may not be protected. There is no regime of registration for copyright in Hong Kong but the Copyright Ordinance grants copyright owners exclusive rights to carry out certain acts in relation to the works, including (but not limited to) distributing the work to the public and copying the work.

Any infringement of an owner's copyright would give rise to civil liability that the owner can take action on. Depending on the action taken by the infringing party, there may also be criminal liability (for example if the infringing party makes the copyright work for sale or for hire).

In addition to copyright, any invention that is new and involves an inventive step can be patented in Hong Kong via registration as long as it is susceptible of industrial application and does not belong to the excluded classes of inventions through the Patents Ordinance and the Patents (General) Rules. Patents are generally separated into two types, being standard and short-term. Standard patents can last up to 20 years while short-term patents can last up to eight years. However, standard patents are registered based on the registration of a patent granted by one of the designated patent offices – the State Intellectual Property Office in China, the European Patent Office or the United Kingdom Patent Office. Whether a software-related invention used in a fintech business model is capable of being patented will depend on whether the invention is new, involves an inventive step and solves a technical problem, which would be determined on a case-by-case basis. For blockchain corporations, this may be difficult unless they can prove that the software-related invention that relies on blockchain satisfies the requirements set out by the patent office.

It is standard practice for employees or contractors to agree in their employment contracts that all works created by them for the purpose of the employer or client's business would be considered works created by the employer or client. It is also standard practice for parties to agree that the employee or contractor will sign any documents or do anything necessary to give effect to the transfer of the intellectual property of the works created during the employment.

The PDPO establishes a principle-based regime that regulates the collection, holding, processing and use of personal data of clients in Hong Kong.

Businesses in Hong Kong that are 'data users' (defined as persons who control the collection, holding and processing or use of personal data) are regulated by the PDPO. The principles which data users must observe mainly relate to notification requirements at the time of collection of personal data, security and access to personal data and accuracy and duration of retention of personal data. There are also particular restrictions regarding the use of client lists to market products.

Under the PDPO, clients do not have a general right to object to processing (including digital profiling) but clients may opt out from direct marketing activities.

Year in review

i Launch of virtual banks and insurers

In 2019, the HKMA granted a total of eight virtual banking licences to advance its Smart Banking initiative and to promote fintech and innovation in Hong Kong. Certain virtual banks in Hong Kong have already started their trial operation within the HKMA's Fintech Supervisory Sandbox, and it is currently expected that a number of virtual banks will fully launch operations during 2020, with the first being ZA Bank, which is co-owned by mainland online insurer Zhong An Online P&C Insurance and Sirolink Group, and that virtual banks will be supervised by the HKMA.

The Insurance Authority is also taking steps to encourage greater use of technology by Hong Kong's insurers. In December 2018, the Insurance Authority granted a virtual life insurer licence to Bowtie Insurance and subsequently in October 2019 granted the first virtual general insurer licence to Avo Insurance, a local insurtech company that offers life, travel and health-related products. These virtual insurers will sell their products online without the use of agents or brokers.

ii Guidelines for financial services advisory

As mentioned above, the SFC published its Guidelines on Online Distribution and Advisory Platforms in July 2019. The SFC governs the operation of licensed or registered persons (online platforms) when conducting their regulated activities on the online distribution and advisory platforms for investment products.

iii Regulation of virtual asset trading platforms

The SFC issued a Position Paper in November 2019 to set out a robust regulatory framework for virtual assets trading platforms operating in Hong Kong that provide various trading, clearing or settlement services for virtual assets. It is expected that it will grant the first licence to a virtual asset trading platform in 2020.

Outlook and conclusions

The SFC recognised the developments of the fintech market by regulating the virtual asset trading platform. However, it is anticipated that regulators in Hong Kong will remain cautious about virtual assets and will continue to adopt a wait-and-see approach.

The virtual asset trading platform framework is only applicable to platforms where at least one virtual asset or token that is available for trading falls under the definition of a security under the SFO. However, there are still regulatory gaps in the Position Paper that may need to be addressed through further legislative amendments.

The new framework enables the SFC to closely supervise virtual assets trading platforms, which is regarded as one of the fastest developing areas in the recent fintech space. Interactions with the platforms would place the SFC in a better position to design and implement a future regulatory strategy for virtual assets, perhaps including the regulation of virtual assets that do not fall within the current scope of regulation.


1 Yu Pui Hang (Henry Yu) is the principal partner at Henry Yu & Associates, in association with L & Y Law Office.

2 e.g., Chloe by 8 Securities Limited and Aqumon by Magnum Research Limited, both of which have obtained Type 1 (dealing in securities) and Type 4 (advising on securities) licences.

3 e.g., Kristal.AI by Kristal Advisors (HK) Limited, has obtained Type 4 (advising on securities) and Type 9 (assessment management) licences.

4 e.g., AngelHub Limited is normally known as the first equity crowdfunding platform in Hong Kong to be granted licences by the SFC, and obtained Type 1 (dealing in securities) and Type 4 (advising on securities) licences on 1 April 2019: see

Get unlimited access to all The Law Reviews content