DeFi protocol frontend in Hong Kong
Operates a web frontend or aggregator that interacts with permissionless smart contracts on behalf of users. May or may not screen users / restrict regions.
DeFi frontend is conditionally permitted in Hong Kong with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- If the frontend operator takes custody of user funds or executes transactions for users (i.e., provides 'dealing' services), it must comply with AMLO Part 5B VATP licensing — including customer due diligence (CDD) and ongoing monitoring per AMLO
- Suspicious Transaction Reports (STRs) must be filed with JFIU when proceeds of crime are suspected
- If the frontend merely aggregates/provides a UI without custody and without facilitating transactions (non-custodial, non-executing), AML obligations may not attach to the frontend operator, but this is legally ambiguous
- Fee-taking (e.g., frontend fees, swap fees) likely constitutes 'dealing in virtual assets' or 'providing a platform' triggering full VATP AML obligations
- Licensed VATPs must maintain records for 7 years per AMLO requirements
Key Restrictions
- If the frontend provides transaction execution (e.g., swapping, routing orders) on behalf of Hong Kong users — even via smart contracts — it likely requires a VATP license under AMLO Part 5B (Cap 615)
- Retail trading is only permitted for approved tokens on the SFC's permitted list — any frontend serving HK retail must enforce token whitelisting
- 98% cold storage requirement applies if the operator holds or has access to user funds
- Minimum paid-up capital of HKD 5M (~$640K USD) required if operating as a VATP
- Geofencing to block HK residents is the primary way to operate without a VATP license — but this must be demonstrably enforced
- A pure informational frontend aggregator that does not handle assets or execute transactions may fall outside the VATP licensing scope — but this is untested by HK regulators
Key Risks
- Regulatory ambiguity: Hong Kong has not issued specific guidance distinguishing 'DeFi frontend' operators from centralized VASPs — the SFC has stated that 'activities' rather than technology determine regulation
- Enforcement risk: If the SFC determines the frontend operator is 'providing a platform' or 'dealing in virtual assets' without a license, criminal penalties under AMLO Part 5B apply
- Jurisdictional risk: Serving HK users (even via a decentralized protocol) may be deemed regulated activity — similar to SFC's stance on overseas platforms targeting HK public
- Fee structure risk: Charging fees (transaction fees, interface fees) strongly increases the likelihood the operator is deemed a 'VASP' or conducting 'regulated activity'
- Token selection risk: Allowing trading of tokens not on the SFC-approved list while accessible to HK users exposes the operator to unlicensed dealing risk
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
SFC — licenses VA trading platforms under AMLO Part 5B (13 licensed as of 12 October 2026) and SFO Types 1/7 for security tokens; supervision and enforcement
AMLO (Cap. 615) Part 5B, inserted by the AMLO (Amendment) Ordinance 2022 (Ord. No. 15 of 2022, gazetted 16 December 2022), introduced mandatory SFC licensing of centralised virtual asset trading platforms from 1 June 2023; licensed platforms may serve both professional and retail investors, subject to SFC token-admission and investor-protection requirements.
A VATP licence from the SFC under AMLO Part 5B has been mandatory since 1 June 2023. The SFC VATP Guidelines require paid-up share capital of at least HK$5,000,000 and liquid capital of at least the higher of HK$3,000,000 and the Financial Resources Rules basic amount (paras 6.2-6.3), storage of 98% of client virtual assets in cold storage (para 10.6(c)), and large-cap index tests for retail-tradable tokens (para 7.8). The SFC list shows OSL Exchange (licensed 15/12/2020) and HashKey Exchange (09/11/2022) as the earliest licensed platforms; 13 were licensed on 12 Oct 2026.
An SFC licence under AMLO Part 5B has been required since 1 June 2023 for any centralised virtual asset exchange carrying on business in Hong Kong or actively marketing to Hong Kong investors. OTC virtual asset dealing has no dedicated licensing regime yet: the FSTB and SFC concluded their VA dealer and custodian consultation on 24 Dec 2025 and target a bill in 2026.
JFIU — Joint Financial Intelligence Unit — suspicious transaction reports
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — A DeFi protocol frontend serving Hong Kong residents is likely subject to VATP licensing under AMLO Part 5B if it executes transactions, takes fees, or has custody of user funds, but a purely informational/non-custodial aggregator with effective geofencing to block HK users may operate outside licensing scope, though the SFC has not issued specific DeFi guidance.
Questions this verdict aims to answer
- Is operating the frontend a regulated activity even if the protocol is decentralized?
- What geofencing or KYC obligations apply?
- Does fee-taking change classification?