Hong Kong Digital Asset Regulation: Trading Platforms, Stablecoins and Tax Transparency

Hong Kong now regulates digital assets through several connected but distinct regimes. A sound analysis must identify the activity, asset, client base, custody model and Hong Kong nexus before considering SFC licensing, HKMA stablecoin requirements, AML/CFT controls or IRD tax-transparency reporting. Commercial labels such as “exchange”, “utility token” or “payment project” do not replace that legal and operational assessment.

1. Introduction: digital assets are now a regulated infrastructure topic

Hong Kong’s digital-asset framework has moved beyond general policy statements and broad anti-money-laundering controls. A digital-asset business may now need to consider platform licensing, stablecoin issuer regulation, conduct obligations, asset custody, market-integrity controls and tax-transparency reporting.

This matters for digital-asset operators, investors, funds, payment projects, family offices and professional advisers. A Hong Kong company cannot assess a digital-asset proposal only by asking whether the technology is innovative or whether the asset is described as a token. The starting point is the legal and operational substance of the activity.

The key practical message is simple: digital assets in Hong Kong are no longer a single regulatory question. Trading platforms, fiat-referenced stablecoins, anti-money-laundering controls and crypto-asset reporting must be reviewed together.

2. Three regulatory tracks: SFC, HKMA and IRD

A practical analysis usually starts with three official regulatory tracks.

• The Securities and Futures Commission regulates virtual asset trading platforms and licensed intermediaries conducting virtual asset-related activities.
• The Hong Kong Monetary Authority regulates the issuance of fiat-referenced stablecoins under the Stablecoins Ordinance.
• The Inland Revenue Department is responsible for the Crypto-Asset Reporting Framework and the amended Common Reporting Standard once the relevant legislative amendments apply.

The same business model may touch more than one track. For example, a group may operate a platform, use or distribute fiat-referenced stablecoins, custody client assets and later become subject to crypto-asset reporting obligations. Professional review should therefore map the activity first, and only then decide which regulator or reporting regime is relevant.

3. Virtual asset trading platform licensing

The SFC licensing perimeter is central for businesses operating a centralised virtual asset trading platform in Hong Kong or actively marketing services to Hong Kong investors. Under the SFC framework, a platform may fall within the Securities and Futures Ordinance where security tokens are involved, and within the Anti-Money Laundering and Counter-Terrorist Financing Ordinance where non-security token trading services are provided.

The regulatory question is not answered by the label used in commercial materials. Advisers should understand whether the business operates a centralised platform, whether client orders are matched by an automated engine, whether the platform provides custody as an ancillary service, whether Hong Kong users are targeted, and whether any token may constitute a security token.

Token classification may change over time. This is one reason the SFC has emphasised the possible need to consider both the securities regime and the virtual asset service regime.

4. What VATP regulation covers in practice

A platform licence is not merely an anti-money-laundering registration. Licensed virtual asset trading platforms are subject to broad operational and conduct expectations. These include custody of client assets, client due diligence, anti-money-laundering and counter-terrorist financing controls, conflicts of interest, token admission criteria, prevention of market manipulation, accounting and audit, risk management and cybersecurity.

This is important for start-ups and overseas groups considering Hong Kong. A licensed platform must be able to show not only that it has incorporated a company, but that it has the governance, technology, risk controls, staffing, policies and operating infrastructure to conduct the regulated activity safely.

Asset custody is a particularly sensitive area. Wallet governance, private-key control, segregation of client assets, incident response and cyber resilience should be considered at the beginning of the project, not after launch.

5. Stablecoin issuer licensing

Stablecoin issuance is now a separate regulatory area in Hong Kong. Following implementation of the Stablecoins Ordinance on 1 August 2025, the business of issuing fiat-referenced stablecoins is a regulated activity in Hong Kong and a licence is required.

This should be analysed separately from platform trading. A stablecoin issuer raises questions about issuance, reserve management, redemption, stabilisation, user protection, risk management and ongoing supervision. A trading platform, by contrast, raises questions about matching orders, client onboarding, custody, token admission and market conduct.

The HKMA maintains a public register of licensed stablecoin issuers. As at the current register reviewed for this article, Anchorpoint Financial Limited and The Hongkong and Shanghai Banking Corporation Limited were listed with effective licence dates of 10 April 2026.

6. Fiat-referenced stablecoins and Relevant Stablecoins

The stablecoin regime is particularly concerned with fiat-referenced stablecoins. For platform operators and licensed intermediaries, a further practical question is whether a stablecoin is a Relevant Stablecoin under SFC materials, meaning that it is issued by an entity licensed under the Stablecoins Ordinance and authorised under that licence.

The SFC’s May 2026 circular connects the HKMA stablecoin regime with the SFC framework for licensed platforms and licensed corporations. It clarifies expected standards for services involving Relevant Stablecoins, including notification and custody-related arrangements.

Before advising on a stablecoin project or transaction, professional advisers should therefore ask whether the asset is issued by a licensed issuer, what fiat currency or currencies it references, whether it is used for trading, settlement, custody or payment, and whether the service provider is subject to SFC or HKMA expectations.

7. AML/CFT obligations for digital-asset businesses

Anti-money-laundering compliance remains important, but this article should not be read as a repeat of general customer due diligence. Digital-asset businesses require additional operational controls because value can move quickly across wallets, platforms and jurisdictions.

Relevant risk areas include pseudonymous transfers, self-hosted wallets, cross-border value movement, sanctions screening, blockchain analytics, source of funds, source of wealth, wallet ownership, transaction monitoring and unusual transaction patterns.

The practical point is that digital-asset anti-money-laundering compliance is not finished once the client is onboarded. It requires transaction-level monitoring and technical understanding of how the assets move.

8. Crypto-Asset Reporting Framework

The Crypto-Asset Reporting Framework is a separate tax-transparency development. The IRD describes it as an OECD tax-transparency standard providing for automatic exchange of tax information on crypto-asset transactions. Reporting crypto-asset service providers are expected to perform due diligence and collect and report required information annually.

The IRD states that the Government has committed to conducting the first automatic exchange of tax information on crypto-asset transactions under the framework in 2028, subject to domestic legislation. The relevant 2026 amendment bill was gazetted on 22 May 2026 and introduced into the Legislative Council for first reading on 3 June 2026. Subject to passage, the crypto-asset reporting amendments are expected to apply from 1 January 2027, while amended Common Reporting Standard changes are expected from 1 January 2028.

Businesses should therefore distinguish licensing from tax reporting. A platform, broker, custodian, exchange, wallet service or other service provider may need to consider reporting duties even where the immediate commercial discussion is focused on products, investors or licensing.

9. Amended Common Reporting Standard and tax-transparency alignment

The amended Common Reporting Standard is part of the same international tax-transparency direction. Digital financial products, crypto-asset transactions and crypto-asset service providers are being brought into a more structured reporting environment.

For private wealth structures and multinational groups, this matters because digital assets can no longer be treated as outside the documentation discipline that already applies to financial accounts. Advisers should consider beneficial ownership, controlling persons, residence information, transaction records and reporting nexus at an early stage.

10. Practical questions before advising a digital-asset client

Before accepting or advising a digital-asset client, professional intermediaries should identify the exact activity rather than rely on general descriptions.

• Is there a centralised trading platform?
• Are client orders matched by an automated engine?
• Are client assets or private keys held in custody?
• Are Hong Kong users targeted or actively marketed to?
• Are security tokens involved or could token classification change?
• Is a fiat-referenced stablecoin being issued?
• Is the stablecoin issued by an HKMA-licensed issuer?
• Is the business providing payment, settlement, custody, brokerage or advisory services?
• What anti-money-laundering and sanctions controls are in place?
• Could the business be a reporting crypto-asset service provider with a Hong Kong reporting nexus?

A clear activity map is usually more useful than a long technology description. Regulators, banks, auditors and advisers need to understand what the business actually does and who bears the relevant regulatory responsibility.

11. Documentation expected by banks, auditors and advisers

A digital-asset client should not expect professional advisers or banks to rely on a white paper alone. A credible compliance file should explain the business model, the regulatory position and the controls around assets, users and transactions.

• business model and activity flowchart;
• token or asset classification analysis;
• customer and jurisdiction profile;
• licence, exemption or no-licence analysis;
• custody model and wallet control policy;
• transaction-monitoring and sanctions-screening arrangements;
• source-of-funds and source-of-wealth evidence;
• governance and risk-management policies;
• tax-reporting analysis, including crypto-asset reporting and amended CRS where relevant.
• cybersecurity and incident-response procedures;

A clear activity map is usually more useful than a long technology description. Regulators, banks, auditors and advisers need to understand what the business actually does and who bears the relevant regulatory responsibility.

11. Documentation expected by banks, auditors and advisers

A digital-asset client should not expect professional advisers or banks to rely on a white paper alone. A credible compliance file should explain the business model, the regulatory position and the controls around assets, users and transactions.

• business model and activity flowchart;
• token or asset classification analysis;
• customer and jurisdiction profile;
• licence, exemption or no-licence analysis;
• custody model and wallet control policy;
• transaction-monitoring and sanctions-screening arrangements;
• source-of-funds and source-of-wealth evidence;
• governance and risk-management policies;
• cybersecurity and incident-response procedures;
• tax-reporting analysis, including crypto-asset reporting and amended CRS where relevant.

The aim is not to create paperwork for its own sake. The aim is to make the regulated activity, operating model and reporting position understandable and verifiable.

12. Common misconceptions

Several misconceptions regularly arise in digital-asset discussions.

• A Hong Kong company can operate a crypto exchange without licensing if the server is offshore.
• Stablecoins are only payment products and do not create licensing questions.
• Only exchanges need to consider digital-asset regulation.
• Anti-money-laundering controls are complete once the user is onboarded.
• Crypto-asset reporting is only a foreign issue.
• If an asset is called a utility token, no regulatory analysis is needed.
• Incorporating in Hong Kong is enough to make banking straightforward.

13. Conclusion: digital assets require multi-regulator analysis

Hong Kong’s digital-asset framework now requires structured review across SFC licensing, HKMA stablecoin regulation, anti-money-laundering systems and IRD reporting obligations. For operators, investors and professional advisers, the key question is no longer simply whether the activity is innovative. The question is whether the business model is licensed where necessary, controlled properly, documented clearly and ready for tax-transparency reporting.

Digital assets are therefore not just a technology topic. They are a regulatory infrastructure topic requiring legal, compliance, tax, accounting and operational review.

‍

‍Frequently asked questions :-

Does every Hong Kong digital-asset business require an SFC licence?

No. The answer depends on the precise activity, assets, custody model, location and marketing. Operating a centralised virtual asset trading platform in Hong Kong, or actively marketing relevant services to Hong Kong investors, may engage the SFC regimes. A documented perimeter analysis is essential.

Can an offshore platform serve Hong Kong users without considering Hong Kong licensing?

An offshore server or entity does not, by itself, remove Hong Kong regulatory risk. Active marketing, the location of operations and users, the services provided and the nature of the assets must be examined.

Is a VATP licence merely an AML registration?

No. Licensed platforms face requirements concerning governance, client assets, custody, token admission, market integrity, conflicts, risk management, cybersecurity, accounting, audit and AML/CFT controls.

Who may issue a fiat-referenced stablecoin in Hong Kong?

A person must not carry on, or hold itself out as carrying on, a regulated stablecoin activity unless licensed for that activity under the Stablecoins Ordinance. The precise perimeter and any exclusions should be checked against the Ordinance and HKMA guidance.

How can a business verify a Hong Kong stablecoin issuer?

It should consult the current HKMA register of licensees under the Stablecoins Ordinance and verify the licence, issuer and authorised activity rather than relying on marketing statements.

Is crypto-asset tax reporting the same as licensing?

No. CARF and amended CRS are tax-transparency regimes. A business may have due-diligence, data-collection and reporting issues even where its immediate regulatory discussion concerns a licence, product or custody arrangement.

What should a digital-asset client prepare for banks and advisers?

At minimum, an activity map, regulatory-perimeter analysis, ownership and governance records, asset classification, customer and jurisdiction profile, custody and wallet controls, transaction monitoring, sanctions controls, source-of-funds evidence, cybersecurity procedures and tax-reporting analysis.