DeFi protocol frontend in Hong Kong
Operates a web frontend or aggregator that interacts with permissionless smart contracts on behalf of users. May or may not screen users / restrict regions.
DeFi frontend is conditionally permitted in Hong Kong with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- If the frontend operator takes custody of user funds or executes transactions for users (i.e., provides 'dealing' services), it must comply with AMLO Part 5B VATP licensing — including customer due diligence (CDD) and ongoing monitoring per AMLO
- Suspicious Transaction Reports (STRs) must be filed with JFIU when proceeds of crime are suspected
- If the frontend merely aggregates/provides a UI without custody and without facilitating transactions (non-custodial, non-executing), AML obligations may not attach to the frontend operator, but this is legally ambiguous
- Fee-taking (e.g., frontend fees, swap fees) likely constitutes 'dealing in virtual assets' or 'providing a platform' triggering full VATP AML obligations
- Licensed VATPs must maintain records for 7 years per AMLO requirements
Key Restrictions
- If the frontend provides transaction execution (e.g., swapping, routing orders) on behalf of Hong Kong users — even via smart contracts — it likely requires a VATP license under AMLO Part 5B (Cap 615)
- Retail trading is only permitted for approved tokens on the SFC's permitted list — any frontend serving HK retail must enforce token whitelisting
- 98% cold storage requirement applies if the operator holds or has access to user funds
- Minimum paid-up capital of HKD 5M (~$640K USD) required if operating as a VATP
- Geofencing to block HK residents is the primary way to operate without a VATP license — but this must be demonstrably enforced
- A pure informational frontend aggregator that does not handle assets or execute transactions may fall outside the VATP licensing scope — but this is untested by HK regulators
Key Risks
- Regulatory ambiguity: Hong Kong has not issued specific guidance distinguishing 'DeFi frontend' operators from centralized VASPs — the SFC has stated that 'activities' rather than technology determine regulation
- Enforcement risk: If the SFC determines the frontend operator is 'providing a platform' or 'dealing in virtual assets' without a license, criminal penalties under AMLO Part 5B apply
- Jurisdictional risk: Serving HK users (even via a decentralized protocol) may be deemed regulated activity — similar to SFC's stance on overseas platforms targeting HK public
- Fee structure risk: Charging fees (transaction fees, interface fees) strongly increases the likelihood the operator is deemed a 'VASP' or conducting 'regulated activity'
- Token selection risk: Allowing trading of tokens not on the SFC-approved list while accessible to HK users exposes the operator to unlicensed dealing risk
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
SFC — VATP licensing (AMLO Part 5B), Type 1/7 for security tokens, enforcement
AMLO Part 5B (Cap 615, amended 2023) (2023) — Mandatory VATP licensing — effective June 1, 2023. All platforms, retail + institutional.
VASP: VATP license from SFC mandatory since June 2023. HKD 5M (~$640K USD) minimum paid-up capital. SFC Type 1 (HKD 3M) / Type 7 (HKD 5M) for security tokens. 98% cold storage requirement (one of strictest globally). Retail trading allowed only for approved tokens. 12-18 month application timeline. OSL and HashKey were first licensees.
EXCHANGE: VATP license required for all centralized exchanges serving HK public. OTC desks currently unregulated but SFC signaling future regulation. Banks (HSBC, StanChart) directed by HKMA to bank licensed firms.
JFIU — Joint Financial Intelligence Unit — suspicious transaction reports
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — A DeFi protocol frontend serving Hong Kong residents is likely subject to VATP licensing under AMLO Part 5B if it executes transactions, takes fees, or has custody of user funds, but a purely informational/non-custodial aggregator with effective geofencing to block HK users may operate outside licensing scope, though the SFC has not issued specific DeFi guidance.
Questions this verdict aims to answer
- Is operating the frontend a regulated activity even if the protocol is decentralized?
- What geofencing or KYC obligations apply?
- Does fee-taking change classification?