Hong Kong

The more consequential development in this module is prospective rather than settled. The FSTB and SFC are targeting 2026 for the introduction to LegCo of legislative proposals establishing AMLO-based licensing regimes for virtual asset dealing and custodial services, following a public consultation that drew more than 190 responses. A parallel track targets a bill establishing AMLO-based licensing for virtual asset advisory and management services, following consultation conclusions published this cycle. Neither has yet been formally tabled, and both remain classified as proposed rather than enacted. The advisory/management track carries an emerging capital-adequacy architecture: baseline financial-resources requirements are proposed at HKD 100,000 minimum liquid capital for firms that do not hold client assets, rising to as much as HKD 5,000,000 in paid-up capital plus HKD 3,000,000 in liquid capital for firms that do hold client assets. These thresholds are themselves still proposed, not in force, and could be revised before any bill is tabled.

Read together, these two tracks represent a deliberate second wave of perimeter expansion beyond the existing VATP and stablecoin licensing regimes — extending statutory coverage to categories of virtual-asset intermediary (dealers, custodians, advisers, managers) that currently sit outside any dedicated Hong Kong licensing requirement. This sequencing mirrors a broader pattern in Hong Kong's approach: core, high-materiality activities (exchange trading, stablecoin issuance) are brought into force first, with secondary categories of intermediary activity following via a slower consultation-to-bill pipeline. For counterparties assessing Hong Kong risk, this matters: the presence of a mature core regime does not imply equivalent certainty for firms whose primary business lies in dealing, custody, advisory or management services falling outside the current VATP and stablecoin scope.

Outlook

The immediate open questions are procedural rather than substantive: whether the dealer/custodian bill and the advisory/management bill are in fact introduced to LegCo within 2026 as targeted, and what effective dates and final capital-requirement schedules they carry once tabled. Until introduction occurs, firms conducting dealing, custody, advisory or management activity involving virtual assets outside the current VATP and stablecoin perimeters continue to operate in a regulatory grey zone that the SFC and FSTB have signalled an intent, but not yet a binding requirement, to close. The pace of VATP registry growth — a single new licensee in the eight months to February 2026 — suggests the existing licensing pathway, while mandatory, is not attracting rapid new entry, a data point worth tracking alongside the second-wave legislative timeline as an indicator of overall market appetite for Hong Kong's licensed perimeter.

Retail-facing token eligibility is governed by a separate, but related, rule set: since the VATP licensing regime commenced in June 2023, licensed platforms may only offer retail investors tokens meeting 'eligible large-cap virtual asset' criteria, which require listing on at least two acceptable indices alongside a minimum track record. This functions as a de facto retail-suitability filter layered on top of the security/non-security distinction, restricting retail access to a defined subset of larger, more established virtual assets regardless of their formal classification.

What remains genuinely unresolved is the treatment of the residual category: non-security utility tokens and NFTs. Hong Kong has not published a comprehensive statutory taxonomy for these instruments, and classification continues to proceed case-by-case against the Securities and Futures Ordinance's securities definition. This is treated as a legitimate, sourced finding of absence rather than a sourcing gap — the case-by-case approach is itself the current state of the regime, not a placeholder pending forthcoming guidance. That said, no citable index of specific SFC classification precedents (concrete determinations linking particular tokens to security or non-security outcomes) was located this cycle, which limits the ability to forecast how future case-by-case determinations are likely to land for any given non-security instrument.

Outlook

Absent a stated legislative timeline for a comprehensive utility-token or NFT taxonomy, the case-by-case model is likely to persist as the operative classification mechanism for the foreseeable future. The near-term monitoring priority is whether the SFC publishes, or can be shown via primary-source research to maintain, any internal precedent register linking specific classification determinations to outcomes — content that would materially improve predictability for market participants navigating the boundary between security and non-security virtual assets. Given the reliance this cycle on secondary reporting rather than direct SFC primary-source retrieval, this module's findings should be treated as provisionally reliable pending future confirmation against SFC.hk primary materials.

Both developments sit within the existing VATP licensing perimeter — they expand what a licensed platform may offer, rather than creating new categories of licensee. Outside that perimeter, however, Hong Kong continues to have no dedicated licensing or supervisory regime for DeFi lending protocols, crypto mining, or independent node or validator operation. This is treated as a negative finding capturing a genuine coverage gap that sits alongside, and increasingly in contrast with, the now-regulated staking and derivatives pathways: as adjacent on-chain activities have been formalised, the absence of any regulatory touchpoint for DeFi lending, mining or validator operation has become more conspicuous by comparison, even though no imminent legislative move to address it has been identified this cycle.

Outlook

The direction of travel in this module is toward incremental extension of the existing VATP-centred licensing perimeter to cover additional on-chain activities (staking, then derivatives), rather than toward a freestanding DeFi, mining or validator regime. Whether Hong Kong eventually addresses the DeFi/mining/validator gap through a dedicated framework, folds it into the pending dealer/custodian or advisory/management licensing tracks, or leaves it unaddressed indefinitely remains an open question with no current signal either way. Market participants operating DeFi lending protocols, mining operations or validator infrastructure targeting Hong Kong should treat the absence of a regime as a current-state fact rather than a gap likely to close imminently.

The defining development of this cycle is the HKMA's issuance of the jurisdiction's first two FRS issuer licences, to HSBC and to Anchorpoint Financial — a joint venture led by Standard Chartered together with Animoca Brands and HKT — both effective 10 April 2026. These two licensees were selected from a pool of 36 applicants, with the HKMA's stated approach in this first tranche prioritising note-issuing banks over other categories of applicant. This is treated here as a decision-level fact rather than a binding rule change in itself, but it is the clearest evidence available this cycle that the Cap. 656 licensing regime is now fully operational rather than merely enacted: applications have been processed, a selection methodology has been applied, and licences have issued and taken effect.

One limitation persists alongside this operational maturity: the HKMA has not published any systemic-designation framework for stablecoin issuers that goes beyond the core Cap. 656 licensing regime. Whether or how the HKMA intends to apply enhanced prudential treatment to issuers that become systemically significant — a question increasingly relevant as licensed issuance scales — remains unaddressed in publicly available guidance as of this cycle.

Outlook

With the first licensing tranche complete and effective, the near-term question is the pace and composition of subsequent batches: whether the HKMA continues prioritising note-issuing banks, opens further slots to non-bank applicants from the remaining pool of 36, and on what timeline. The absence of a published systemic-designation framework is also worth monitoring, particularly if licensed stablecoin issuance scales toward volumes that would typically attract enhanced prudential attention in comparable jurisdictions. More broadly, Hong Kong's stablecoin regime is likely to remain a reference point for other jurisdictions assessing FRS licensing design, given its combination of enacted statute, substantive prudential requirements, and now-live licensees — a combination that few peer jurisdictions have yet achieved in full.

These baseline protections were reinforced in August 2025 by a dedicated SFC custody circular that took effect immediately and raised expectations across several dimensions: senior-management responsibility for custody outcomes, cold-wallet infrastructure standards, oversight of third-party wallet providers, and real-time threat monitoring. This circular does not replace the original 2023 custody-segregation and compensation requirements but adds a further, more granular layer of operational expectation on top of them, consistent with a broader tightening trajectory in this module. Staking-specific consumer protection was addressed separately in April 2025: licensed VATPs and authorized virtual-asset funds offering staking must clearly disclose the associated risks to clients and implement safeguards protecting staked client assets, mirroring the risk-disclosure logic applied elsewhere in the consumer-protection framework.

Outlook

The consumer-protection module's trajectory has been consistently tightening rather than static, with each expansion of permitted retail-facing activity (staking, and by extension the professional-investor derivatives framework) accompanied by a corresponding disclosure or safeguard requirement. The open question going forward is how — or whether — equivalent consumer protections will be extended to the second-wave licensing perimeter (dealer, custodian, advisory, management services) once those bills are introduced; the current consumer-protection architecture is built specifically around the VATP licensing structure, and its applicability to intermediary categories that fall outside that structure is not yet defined. Firms and their clients operating in the gap between the current VATP perimeter and the pending second-wave regimes should treat the existing suitability, custody, compensation and marketing protections as not yet automatically extending to those adjacent categories of activity.

The one area of active change is international tax-transparency reporting. The Hong Kong government's 2026-27 Budget commits to amending the Inland Revenue Ordinance over the next two years to implement the OECD's Crypto-Asset Reporting Framework (CARF) and an updated Common Reporting Standard (CRS). This is a planning-stage commitment rather than enacted legislation, and no specific amendment text, timeline milestone, or implementation date beyond the general two-year budget commitment has been identified this cycle. Separately, no IRD-specific published guidance addressing the tax characterisation of staking rewards, mining income, or airdrops — as distinct from the general profits-tax principles described above — was located this cycle, leaving a practical gap in guidance for taxpayers engaged in these specific activities even though the underlying general tax principles are settled.

Outlook

The CARF/CRS commitment signals a clear direction of travel toward international tax-transparency alignment, but implementing legislation remains at least two budget cycles away on the government's own stated timeline, and the specific reporting mechanics (what data is captured, from whom, and on what schedule) are not yet defined in public materials. In the interim, taxpayers relying on general profits-tax principles to characterise staking, mining or airdrop income should note that no crypto-specific IRD guidance exists to resolve edge cases, a gap that becomes more consequential as staking and other yield-generating activities become more widely available through the licensed VATP channel described elsewhere in this record.

Separately, Hong Kong imposes no general outbound restriction on cross-border crypto-asset transfers. Rather than restricting flows, the HKMA is developing its EnsembleTX wholesale CBDC pilot specifically to explore cross-border tokenised-settlement interoperability, a forward-looking infrastructure project distinct from, and not a substitute for, the AML/Travel Rule compliance framework described above. More broadly, the FATF Travel Rule framework as applied in Hong Kong is understood to enable financial institutions and VASPs to conduct sanctions screening and detect suspicious cross-border virtual-asset transactions, though the specific operational and enforcement mechanics of that capability in the Hong Kong context — beyond this general statement — fall within the remit of financial-integrity's AML/CFT coverage rather than this module.

Outlook

Two open items dominate this module's near-term research agenda. First, direct confirmation against the primary HKMA AML/CFT guideline text is needed to resolve definitively whether the stablecoin Travel Rule threshold operates as a zero-threshold, tiered-identity-element regime, as specialist analysis suggests, or as the simpler above/below-HK$8,000 switch implied by initial press coverage; this distinction has real compliance consequences for stablecoin issuers and their transfer counterparties. Second, the precise AMLO Travel Rule de minimis thresholds applicable to non-stablecoin VASP transfers — distinct from the stablecoin-specific HK$8,000 figure — have not yet been located and require direct research against SFC/AMLO guidance; this is flagged as part of a broader, estate-wide pattern in which cross-border transfer content tends to be structurally under-indexed relative to other modules. Both items should be treated as priorities for the next primary-source research pass.