Fintech in Hong Kong 2024

FINTECH 2024

HONG KONG

Jolyon Ellwood-Russell, Michelle Ta, Donia Chu, Galvin Chua

(Simmons & Simmons)

FINTECH LANDSCAPE AND INITIATIVES

General innovation climate

What is the general state of fintech innovation in your jurisdiction?

Hong Kong is home to more than 800 fintech companies and start-ups, covering services in the areas of payment, artificial intelligence, wealthtech, blockchain and insurtech. As is fitting for an international financial center, more than one-third of fintech founders are from other countries. Nearly half of the established fintech companies have been in operation for more than three years. Consumer fintech adoption is high and consumers have a significant desire for financial products and services, although business-to-business services remain the biggest driver of fintech development in Hong Kong. The Hong Kong government supports the sector and has strengthened cooperation with regulators in other jurisdictions to encourage cross-border fintech development.

In 2019, the Hong Kong Monetary Authority (HKMA) granted eight ‘virtual bank’ licenses to new entities, all of which have launched online-only banking services. A number of license holders have now begun developing, testing and launching new products in credit, loans, wealth and insurance.

Hong Kong’s regulators continue to examine the fintech sector and to evolve their approach on regulatory changes and sector initiatives. The Securities and Futures Commission (SFC) and the HKMA reviewed their approach on regulation for virtual asset-related activities of intermediaries and the SFC and HKMA jointly issued a revised guidance on this in January 2022 (replacing the 2018 guidance). In October 2022, the SFC set out in a circular the requirements under which the SFC would consider authorizing exchange-traded funds that obtain exposure to virtual assets primarily through futures contracts for public offering in Hong Kong.

In June 2022, the Hong Kong government gazetted the Anti-Money Laundering and Counter-Terrorist Financing (Amendment) Bill 2022, which sets out the new licensing regime that any person who seeks to carry on a business of operating a virtual asset exchange is required to apply for an SFC license. The Bill was passed by the Legislative Council of Hong Kong in December 2022 and will take effect on 1 June 2023. The SFC has issued a consultation paper on the proposed regulatory requirements for SFC-licensed virtual asset trading platform operators in Hong Kong in February 2023, with the aim of obtaining market feedback on the implementation of such licensing regime.

The HKMA’s Fintech 2025 strategy is to drive fintech development in Hong Kong and includes the agenda of encouraging all banks to fully digitalize front-end and back-end operations, exploring the use of central bank digital currencies, creating data infrastructure (including a commercial data interchange, digital corporate identity and blockchain-based credit data sharing platform) and nurturing fintech talent – in turn with the aim of building an overall appetite for fintech solutions in Hong Kong.

Government and regulatory support

Do government bodies or regulators provide any support specific to financial innovation? If so, what are the key benefits of such support?

Fintech is identified by the Hong Kong government as a priority investment area.

A range of Hong Kong government funding support programs are also available to research and development of fintechs, including the Enterprise Support Scheme (ESS) and Partnership Research Program and the R&D Cash Rebate Scheme, as well as scale-up support such as the HK$2 billion Innovation and Technology Venture Fund, SME Financing Guarantee Scheme and Technology Voucher Program (among others).

The SFC operates a Fintech Contact Point and the HKMA established a Fintech Facilitation Office, which, in each case, is intended to facilitate the fintech community’s understanding of the current regulatory regime and for the regulators to work with market participants to support the sustainable development of the fintech industry, including the Fintech Supervisory Sandbox established by the HKMA and the Regulatory Sandbox established by the SFC that permits new and existing licensed entities to carry out regulated activities within a confined regulatory environment prior to launching on a wider scale.

The HKMA is one of the founding contributors of, and the SFC has joined as a coordination group member of, the Global Financial Innovation Network. The SFC has also signed cooperation agreements with a number of overseas regulators, including the UK’s Financial Conduct Authority and the Australian Securities and Investments Commission. Pursuant to these agreements, the SFC will cooperate to share information on emerging fintech trends, developments and related regulatory issues, as well as on organizations that promote innovation in financial services.

In September 2017, the Insurance Authority launched a fast-track scheme to expedite applications by insurance companies using solely digital distribution channels as a means to promote the development of insurtech in Hong Kong, with one virtual bank offering insurance via its virtual banking platform since 2021.

FINANCIAL REGULATION

Regulatory bodies

Which bodies regulate the provision of fintech products and services?

The main regulatory bodies are the Hong Kong Monetary Authority (HKMA), Securities and Futures Commission (SFC) and the Insurance Authority.

Regulated activities

Which activities trigger a licensing requirement in your jurisdiction?

Pursuant to the Securities and Futures Ordinance, the following activities are regulated and trigger a licensing requirement:

Type 1: dealing in securities;
Type 2: dealing in futures contracts;
Type 3: leveraged foreign exchange trading;
Type 4: advising on securities;
Type 5: advising on futures contracts;
Type 6: advising on corporate finance;
Type 7: providing automated trading services;
Type 8: securities margin financing;
Type 9: asset management;
Type 10: providing credit rating services;
Type 11: dealing in OTC derivative products or advising on OTC derivative products (not yet in operation but is included under the Securities and Futures Ordinance); and
Type 12: providing client clearing services for OTC derivative transactions.

For the purposes of the above categories, ‘securities’ are very widely defined and include stocks, shares, loan stock, bonds, debentures, all rights and interests in such securities, interests in collective investment schemes and structured products. However, shares and debentures of a private Hong Kong company do not constitute securities. Hong Kong private companies are companies incorporated in Hong Kong that restrict members’ rights to transfer shares, limit the maximum number of shareholders to 50 and prohibit the making of an invitation to the public to subscribe for shares or debentures.

The licensing regime applies irrespective of whether the specified activities take place in Hong Kong or, if a person is actively marketing these activities to the public in Hong Kong, from outside Hong Kong.

The activities that are most relevant to fintech businesses are likely to be dealing in securities and advising on securities. Dealing in securities includes making or offering to make an agreement with a person, or inducing or attempting to induce another person to enter into an agreement to acquire, dispose, subscribe or underwrite securities. Advising on securities includes giving advice on whether, and the terms on which, securities should be acquired or disposed of and issuing analyses or reports for the purpose of facilitating decisions on whether to acquire or dispose of securities. It is also possible that some fintech platforms could constitute automated trading services, the operation of which requires a license.

In addition to the above licensing requirements, if a business is undertaking banking activities, such as receiving money on a current, deposit, savings or similar account or paying or collecting cheques, such a business is required to be licensed as a bank by the HKMA.

Certain other activities, such as moneylending, money exchange services, money remittance services and money broking services, also require licenses from the HKMA or the Commissioner of Customs and Excise.

The operation of stored value facilities (such as prepay cards or prepay mobile apps) or designated retail payment systems is subject to a licensing regime under the Payment Systems and Stored Value Facilities Ordinance and requires a license from the HKMA.

A new licensing regime for virtual asset trading platform operators has recently been introduced and will come into effect on 1 June 2023. The Hong Kong government gazetted the Anti-Money Laundering and Counter-Terrorist Financing (Amendment) Bill 2022, which introduced the new licensing regime, and the Bill was passed by the Legislative Council of Hong Kong in December 2022. From 1 June 2023, any centralized virtual asset trading platform operator carrying on their businesses in Hong Kong or that actively markets its service to Hong Kong investors without a valid license will commit a breach under the new Anti-Money Laundering and Counter-Terrorist Financing Ordinance irrespective of whether they provide trading services in security tokens, unless they qualify for a 12-month transition period. A platform operator that is in operation in Hong Kong immediately prior to 1 June 2023 and has a ‘meaningful and substantial presence in Hong Kong’ may be eligible for the transitional arrangements. The SFC has issued a consultation paper on the proposed regulatory requirements for SFC-licensed virtual asset trading platform operators in Hong Kong in February 2023 to obtain market feedback on the implementation of the licensing regime – consultation conclusions remain pending as at the date of writing this article.

Consumer lending

Is consumer lending regulated in your jurisdiction?

Under Hong Kong law, the offering and provision of consumer lending is not distinguished from primary lending.

Lending (consumer lending and primary lending) is a regulated activity in the jurisdiction and is governed by the Money Lenders Ordinance. The Money Lenders Ordinance requires that all loans made available in Hong Kong are by licensed moneylenders or authorized institutions (e.g, licensed banks, restricted-license banks and deposit-taking companies under the Banking Ordinance).

There are a number of exemptions that, if applicable, mean no formal license is required. The loan and lending entity would need to satisfy one of the specified categories of exempted lenders and exempted loans in Schedule 1 of the Money Lenders Ordinance. Examples of exempted loans are:

a loan made bona fide for the purchase of immovable property on the security of a mortgage of that property;
a loan made bona fide to refinance such a mortgage;
a loan made by a company, firm or individual whose ordinary business does not primarily or mainly involve the lending of money in the ordinary course of that business;
an intra-group loan; and
a loan made to a company that has a paid-up share capital of not less than HK$1 million or an equivalent amount in any other approved currency.

The Money Lenders Ordinance prohibits the adoption of excessive interest rates. With effect from 30 December 2022, the statutory interest rate cap for lending is lowered from 60 percent to 48 percent per annum. Lending at an interest rate beyond 48 percent per annum constitutes an offence and the relevant loan agreement is not enforceable. The threshold of the extortionate rate is also lowered from 48 percent to 36 percent per annum. Lending at an interest rate beyond 36 percent per annum is presumed to be extortionate and may trigger the reopening of the relevant transaction by the courts.

Secondary market loan trading

Are there restrictions on trading loans in the secondary market in your jurisdiction?

Secondary market loan trading is not a regulated activity in itself but it constitutes primary lending regardless of whether the loan has been fully drawn and, therefore, the loan and lender are subject to the restrictions of the Money Lenders Ordinance.

However, secondary market loan intermediation is not a regulated activity, provided that it does not involve any lending or deposit-taking and provided that loans are not in the form of securities.

Collective investment schemes

Describe the regulatory regime for collective investment schemes and whether fintech companies providing alternative finance products or services would fall within its scope.

Broadly, a scheme is a collective investment scheme under Hong Kong law if it has the following four elements:

it is an arrangement in respect of property;
participants do not have day-to-day control over the management of the property even if they have the right to be consulted or to give directions about the management of the property;
the property is managed as a whole by or on behalf of the person operating the arrangements or the contributions of the participants, or both, and the profits or income from which payments are made to them are pooled; and
the purpose of the arrangement is for participants to participate in or receive profits, income or other returns from the acquisition or management of the property.

A collective investment scheme can cover any property and that property does not need to be located in Hong Kong for the scheme to be a collective investment scheme. ‘Property’ in this context is not limited to real property.

It is an offence in Hong Kong to issue any marketing material that contains an offer to the Hong Kong public to acquire an interest or participate in a collective investment scheme unless it has been authorized by the SFC or an exemption applies. Promoting a collective investment scheme may also constitute a regulated activity for which a license is required. It is possible that certain fintech activity could constitute a collective investment scheme where the business concerned is managing assets on behalf of participants who have invested through a fintech platform (e.g, investing in real estate or debt securities). Careful analysis of the specific circumstances and the way in which the platform permits investors to participate will be required to determine whether it constitutes a collective investment scheme.

Alternative investment funds

Are managers of alternative investment funds regulated?

Management of securities or futures contracts or real estate investment schemes constitutes a regulated activity as it falls under Type 9: asset management of the Securities and Futures Ordinance. Accordingly, managers of alternative investment funds that invest in real estate or securities (which are widely defined) or futures contracts require a license to do so.

The SFC has confirmed that companies engaged in the distribution to the Hong Kong public of funds that invest in virtual assets are required to be licensed for Type 1 activity whether or not such virtual assets amount to ‘securities’. In addition, the SFC will now apply additional conditions on licensed corporations that manage or distribute funds that invest, solely or partially (more than 10 percent of the gross asset value) in, or that have a stated investment objective to invest in, virtual assets. These conditions include a restriction that such funds can only be invested in, or offered to, professional investors.

Peer-to-peer and marketplace lending

Describe any specific regulation of peer-to-peer or marketplace lending in your jurisdiction.

There are no specific regulations applicable to peer-to-peer (P2P) or marketplace lending in Hong Kong. The SFC has issued a notice reminding potential P2P businesses that activity such as P2P lending might constitute a regulated activity, but much will depend on the precise structure of the platform. For example, it is likely that a platform offering debentures or loan stocks would constitute a regulated activity of dealing in securities.

Additionally, it is an offence in Hong Kong to issue any marketing material that contains an offer to the Hong Kong public to enter into an agreement to acquire or dispose of securities, unless an exemption applies.

Crowdfunding

Describe any specific regulation of crowdfunding in your jurisdiction.

There are no specific regulations concerning crowdfunding. However, certain crowdfunding activity is likely to constitute a regulated activity. For example, equity crowdfunding is likely to constitute dealing in securities and possibly advising on securities, both of which are regulated activities in Hong Kong. As such, the operator of these platforms would need to be licensed by the SFC.

Invoice trading

Describe any specific regulation of invoice trading in your jurisdiction.

To the extent that an invoice is purchased, without risk of being re-characterized as a loan for the purposes of the Money Lenders Ordinance, with true sale there is no specific regulation on the buying and selling of invoices. This is common in factoring and invoice discounting arrangements.

However, if invoices are opened to the public and crowdfunded then the operator of the trading platform needs to follow certain regulations. It is usually the case that if a platform investor is classed as a professional investor, then much of the regulation around crowdfunded invoicing might not apply, depending on the platform structure.

Payment services

Are payment services regulated in your jurisdiction?

Payment services include a wide range of activities such as taking cash deposits, making cash withdrawals, executing payment transactions, issuing or acquiring payment instruments, issuing and administering means of payment, making payments sent through the intermediary of a telecoms, IT system or network operator, or even providing stored value cards or devices.

Payment services are regulated activities in Hong Kong and are subject to the Banking Ordinance, the Anti-Money Laundering and Counter-Terrorist Financing Ordinance and the Payment Systems and Stored Value Facilities Ordinance (as applicable).

Open banking

Are there any laws or regulations introduced to promote competition that require financial institutions to make customer or product data available to third parties?

The HKMA published the Open Application Programming Interface (Open API) Framework for the Hong Kong Banking Sector in July 2018, which encourages financial institutions to make information available through Open APIs within a staged time frame depending on the type of information but this is not a regulatory requirement. According to the HKMA, as of February 2023, of the 28 participating banks, 24 retail banks and 20 banks with corporate and SME offerings have launched Phase III (comprising deposit account availability, status, balance and transaction details). 26 out of the 28 participating banks have launched Phase IV (comprising faster payment services app-to-app payments).

The Commercial Data Interchange (CDI) was launched in October 2022 as a new data strategy of the HKMA. The CDI enables a secure and efficient data flow between banks and sources of commercial data and is part of HKMA’s Fintech 2025 strategy to improve Hong Kong’s data infrastructure. Since its launch, banks have been able to access the Commercial Credit Reference Agency database via the CDI. In February 2023, the HKMA also issued a circular encouraging banks to leverage the CDI for the digitalization of the banking process.

In relation to the use and sharing of consumer credit data, under the Multiple Credit Reference Agencies (MCRA) model, all consumer credit providers are required to connect to the Hong Kong Credit Reference Platform (CRP), which facilitates the transmission of consumer credit information in an encrypted form between the participating credit providers (such as banks and money lenders) and the credit reference agencies. This promotes a level-playing field and facilitates the development of fintech in Hong Kong in line with HKMA’s Fintech 2025 strategy. The HKMA issued a revised supervisory policy manual on consumer credit data in this regard in late 2022.

Robo-advice

Describe any specific regulation of robo-advisers or other companies that provide retail customers with automated access to investment products in your jurisdiction.

Robo-advisers will require a license from the SFC as they usually include the provision of investment advice and services for dealing in securities governed by the Securities and Futures Ordinance.

In July 2019, the SFC issued the Guidelines on Online Distribution and Advisory Platforms (the Guidelines). The Guidelines set out requirements through the application of core principles concerning the proper design of the platform, clear disclosure of information, risk management, governance, capabilities and resources, review and monitoring of activities on the platform and record-keeping. Specific guidance is also given concerning robo-advisers in respect of client profiling, system design and development, supervision and testing of algorithms and technology and staff resource requirements.

Insurance products

Do fintech companies that sell or market insurance products in your jurisdiction need to be regulated?

Yes, both insurance companies and insurance intermediaries (such as agents) need to be authorized or registered, or both, with the Insurance Authority in Hong Kong under the Insurance Ordinance.

Credit references

Are there any restrictions on providing credit references or credit information services in your jurisdiction?

The provision of credit ratings (opinions regarding the creditworthiness of entities other than an individual, securities and agreements to provide credit) is regulated under the Securities and Futures Ordinance as a Type 10 regulated activity, but the gathering, collating, dissemination or distribution of information concerning the indebtedness or credit history of any person is not regulated by any dedicated legislation (except under data protection law); instead, consumer credit data is subject to industry codes of practice issued by the Hong Kong Privacy Commissioner together with HKMA supervisory requirements.

Against a major data breach incident of the sole consumer credit reference agency in Hong Kong in 2018, the Hong Kong government commenced a review of this area, and as a result, the Hong Kong CRP launched in November 2022. Under the MCRA model, all consumer credit providers are required to connect to the CRP, which facilitates the transmission of consumer credit information in an encrypted form between the participating credit providers (such as banks and money lenders) and the credit reference agencies that promotes a level-playing field and facilitates the development of fintech in Hong Kong in line with the Fintech 2025 strategy. The HKMA issued a revised supervisory policy manual on consumer credit data in late 2022.

CROSS-BORDER REGULATION

Passporting

Can regulated activities be passported into your jurisdiction?

No. There are no arrangements in place that enable a financial services provider to conduct any regulated activity in Hong Kong without directly holding the relevant license for the regulated activity, or by operating through a licensed financial institution.

Requirement for a local presence

Can fintech companies obtain a license to provide financial services in your jurisdiction without establishing a local presence?

It is unlikely that the Securities and Futures Commission would grant a license for regulated activities to an entity that did not have a local presence. Equally, the Hong Kong Monetary Authority is unlikely to provide a banking license to an entity that does not have a presence in Hong Kong as it would be difficult to see how such an entity could comply with the obligations to which it would be subject as a bank.

SALES AND MARKETING

Restrictions

What restrictions apply to the sales and marketing of financial services and products in your jurisdiction?

The issuance of any marketing materials that contain an offer to the Hong Kong public to enter into an agreement to acquire or dispose of securities must be authorized by the Securities and Futures Commission, unless an exemption applies.

The active marketing (whether from within or outside Hong Kong) to the public in Hong Kong of activities that constitute regulated financial services in Hong Kong is prohibited unless carried out by an entity that holds a license to carry out such services in Hong Kong.

CRYPTOASSETS AND TOKENS

Distributed ledger technology

Are there rules or regulations governing the use of distributed ledger technology or blockchains?

There are no specific regulations or guidelines regarding the use of distributed ledger technologies.

Cryptoassets

Are there rules or regulations governing the promotion or use of cryptoassets, including digital currencies, stablecoins, utility tokens and non-fungible tokens (NFTs)?

In respect of common ‘digital currencies’, such as bitcoin, the Hong Kong government considers that these are virtual assets and do not qualify as digital currencies with regard to their nature and circulation in Hong Kong. In this regard, Hong Kong does not currently have any specific regulatory measures in respect of the use of virtual assets, but the existing laws provide for protection against unlawful activities in general (e.g, anti-money laundering, fraud and terrorist financing).

In relation to virtual asset exchanges, the Hong Kong government gazetted the Anti-Money Laundering and Counter-Terrorist Financing (Amendment) Bill 2022, which introduces a new licensing regime for virtual asset trading platform operators. The Bill sets out that any person who seeks to carry on a business of operating a virtual asset exchange (including cryptocurrencies) is required to apply for a Securities and Futures Commission (SFC) license, and was passed by the Legislative Council in Hong Kong in December 2022. Under the Bill, virtual asset trading platform operators would also have to carry out customer due diligence in respect of anyone trading on the exchange. The new licensing and anti-money laundering regime will take effect on 1 June 2023.

Financial institutions dealing with virtual assets are required to comply with regulations from time to time by the relevant financial regulators, the Hong Kong Monetary Authority and the Securities and Futures Commission. Additional requirements apply to companies engaged in distribution of funds that invest in virtual assets and intermediaries that carry out virtual asset-related activities.

The active marketing and sale or trading of cryptoassets that constitute securities as defined under the Securities and Futures Ordinance (which include derivatives or futures contracts relating to non-securities virtual assets such as bitcoin) is a regulated activity and requires a license.

Further, the Hong Kong Monetary Authority (HKMA), in its consultation conclusions to the discussion paper on crypto-assets and stablecoins in January 2023 (Consultation Conclusions), proposed to bring certain activities relating to stablecoins into the HKMA’s regulatory perimeter, to help address the potential financial stability risks posed by stablecoins and to promote the orderly and sustainable development of the industry. The HKMA indicated that in drawing up the specific regulatory arrangements, they will consider industry feedback, the latest market developments and international discussions, with the aim to implement regulatory arrangements in 2023–2024. The Consultation Conclusions set out the key parameters of the proposed regime, including the regulatory scope and key regulatory requirements. As there may be some potential overlaps between the HKMA’s proposed regulatory arrangements and the SFC’s licensing regime for virtual asset trading platform operators, fintechs should keep a close eye on developments as to how the Hong Kong regulators will approach any potential regulatory overlap.

Token issuance

Are there rules or regulations governing the issuance of tokens, including security token offerings (STOs), initial coin offerings (ICOs) and other token generation events?

The regulation of tokens issued in STOs, ICOs or otherwise depends on the nature of the tokens offered.

Utility tokens that only provide membership or access to a service or payment tokens that are only used as a means of payment for goods or services (such as bitcoin) are not regulated.

However, tokens that comprise securities under Hong Kong regulations (in particular, under the Securities and Futures Ordinance) are regulated. For example, tokens that represent an asset such as a debt or a claim on the issuer’s assets (such as a share in future earnings) or that amount to a collective investment scheme are securities. Where the tokens being issued fall within the definition of securities, issuing, dealing in or advising on these tokens, or managing or marketing a fund investing in them, may constitute a regulated activity. Persons engaging in a regulated activity targeting the Hong Kong public are required to be licensed by or registered with the SFC, irrespective of where they are located. In addition, investment products linked to any tokens (whether securities or not), such as futures or derivatives, are considered to be securities and offering, trading or advising on these products is a regulated activity.

ARTIFICIAL INTELLIGENCE

Artificial intelligence

Are there rules or regulations governing the use of artificial intelligence, including in relation to robo-advice?

The provision of investment advice is a regulated activity irrespective of the method of delivery of the advice. There are no specific regulations governing the use of artificial intelligence and the provision of robo-advice. However, the Securities and Futures Commission (SFC) has issued the Guidelines on Online Distribution and Advisory Platforms. The guidelines identify six core principles that must be complied with by operators of online advice platforms and provide additional requirements for robo-advisers.

The Hong Kong Monetary Authority (HKMA) has also issued guidance on the use of artificial intelligence in its circular on High-level Principles on Artificial Intelligence, which sets out 12 high-level principles that should be complied with by banks in a manner proportionate to the nature of the artificial intelligence application and the level of risk, as well as guiding principles on Consumer Protection in respect of Use of Big Data Analytics and Artificial Intelligence. In April 2022, the HKMA also published the ‘Regtech Adoption Practice Guide – Issue #6: Artificial Intelligence-based Regtech Solutions’, which among other things, provides practical implementation guidance to banks on the adoption of artificial intelligence-based Regtech solutions.

The Hong Kong Privacy Commissioner has also issued the Guidance on the Ethical Development and Use of Artificial Intelligence, which facilitates the development and use of artificial intelligence in Hong Kong and assists organizations in complying with the provisions of the Personal Data (Privacy) Ordinance in the process of doing so.

CHANGE OF CONTROL

Notification and consent

Describe any rules relating to notification or consent requirements if a regulated business changes control.

Different consent requirements apply to the acquisition of different types of regulated businesses. In general, where a person is to become a holder of a specified percentage of a regulated entity or will control a specified percentage of voting rights of that entity, prior consent must be obtained from the relevant regulatory authority. For banks or entities that hold a license for regulated activity, before a person acquires a holding of more than 10 percent of the issued shares, or prior to them controlling, alone or with other associates, more than 10 percent of the voting rights in the bank or regulated entity, consent must be sought from the Hong Kong Monetary Authority or Securities and Futures Commission respectively. Additional rules apply to persons becoming majority holders of banks and to the acquisition of indirect shareholdings in regulated entities. For corporations holding a money service operator’s license, prior approval from the Commissioner of Customs and Excise is required under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance before any person can become an ultimate owner (generally defined to mean an individual who directly or indirectly owns or controls more than 25 percent of the issued share capital of the corporation) of the corporate licensee. Failure to obtain consent is a criminal offence. In all cases, advice should be sought as to the applicable requirements and the process for obtaining consent.

FINANCIAL CRIME

Anti-bribery and anti-money laundering procedures

Are fintech companies required by law or regulation to have procedures to combat bribery or money laundering?

If the relevant entity is licensed for regulated activities, is licensed as a bank, operates a money service or provides trust or company incorporation services, it needs to comply with the Hong Kong legislation in relation to anti-money laundering and counter-terrorist financing, including establishing policies and procedures to identify clients and combat money laundering and terrorist financing.

For virtual asset trading platform operators, the Anti-Money Laundering and Counter-Terrorist Financing (Amendment) Bill 2022 was gazetted by the Hong Kong government (and passed by the Legislative Council of Hong Kong in December 2022) to enhance Hong Kong’s regulatory regime for combating money laundering and terrorist financing. The new regime sets out that any person who seeks to carry on the business of operating a virtual asset exchange (including cryptocurrencies) is required to apply for a Securities and Futures Commission license, and that such virtual asset trading platform operator would also be subject to obligations of carrying out customer due diligence in respect of anyone trading on the exchange. The new licensing regime together with the anti-money laundering obligations will come into effect on 1 June 2023.

The Hong Kong legislation in relation to the prevention of bribery would also apply, and licensed companies should have in place policies and procedures to prevent bribery.

Guidance

Is there regulatory or industry anti-financial crime guidance for fintech companies?

There is no specific guidance for fintech companies, but there is guidance for licensed corporations and banks that would apply to fintech businesses that are licensed accordingly.

DATA PROTECTION AND CYBERSECURITY

Data protection

What rules and regulations govern the processing and transfer (domestic and cross-border) of data relating to fintech products and services?

There are no specific regulations governing the processing and transfer of data relating to fintech products and services in Hong Kong, but fintech companies are required to comply with the Personal Data (Privacy) Ordinance (PDPO) when collecting or using the personal data of individuals. Personal data is information that relates to a living person and can be used to identify that person, where the data is in a form in which access or processing is practicable. Organizations that collect and use personal data must comply with, among other things, six data protection principles, which include the following:

personal data can only be collected for a purpose directly related to a function and activity of the data user in a lawful and fair manner, and the amount of data to be collected must not be excessive. Data subjects have to be informed of the purpose of the collection of data and how it will be used;
data users must take all practicable steps to ensure personal data remains accurate and is deleted after the purpose of collecting this data is fulfilled;
unless the data subject has given prior consent, personal data can only be used for the purpose for which it was originally collected or a directly related purpose;
data users must take all practicable steps to ensure that personal data is protected against unauthorized or accidental accessing, processing, loss or erasure;
data users should stipulate, publish and implement policies in relation to personal data that can generally be achieved by having a data privacy policy in place; and
individuals have rights of access to and correction of their personal data. Data users should comply with data access or data correction requests within the requisite time limit, unless reasons for rejection prescribed in the PDPO are applicable.

The Hong Kong Privacy Commissioner issued an information leaflet – ‘Tips for Using Fintech’ – in March 2019 explaining the privacy implications and risks of fintech applications. The publication also recommends good practices in relation to data privacy for fintech operators.

The Hong Kong Privacy Commissioner has also published an information leaflet – ‘Matching Procedure: Some Common Questions’ – that emphasizes the importance of obtaining consent from all individual data subjects or the Privacy Commissioner if the process of aggregation of personal data for commercial gain constitutes a matching procedure under the PDPO, to ensure that the risk of potential harm to the relevant data subjects is minimized. It also issued the ‘Guidance on the Proper Handling of Customers’ Personal Data for the Banking Industry’ and a circular to banks in 2019 on consumer protection in the use of big data analytics and artificial intelligence, which specify high-level principles of accountability, fairness, transparency and data protection.

Cybersecurity

What cybersecurity regulations or standards apply to fintech businesses?

There are no cybersecurity regulations or standards specifically addressing fintech businesses in Hong Kong. Cybersecurity is covered under various laws and regulations, such as the Personal Data Privacy Ordinance and the Crimes Ordinance.

The Hong Kong Monetary Authority’s (HKMA) Supervisory Policy Manual sets out the key regulatory standards that the HKMA expects authorized institutions to follow in relation to technology security and has issued a number of requirements and circulars on cybersecurity risk management in recent years, requiring industry players to establish appropriate governance frameworks. Several frameworks were launched by HKMA to strengthen cyber resilience in the banking sector, including the Cybersecurity Fortification Initiative and Cyber Resilience Assessment Framework, as well as the HKMA’s supervisory policy manual chapter on e-banking (TM-E-1 Risk Management of E-banking), which is of particular relevance to the virtual bank licensee.

The Securities and Futures Commission has issued the Guidelines for Reducing and Mitigating Hacking Risks Associated with Inter n et Trading, and the Circular to All Licensed Corporations on Cybersecurity, setting out areas that licensed corporations should pay close attention to when reviewing and mitigating their cybersecurity risks, as well as certain controls that these corporations should consider implementing where applicable.

The Insurance Authority has issued the Guideline on Cybersecurity, which sets the minimum standard for cybersecurity that authorized insurers are expected to have in place and the guiding principles in assessing the effectiveness of an insurer’s cybersecurity framework.

OUTSOURCING AND CLOUD COMPUTING

Outsourcing

Are there legal requirements or regulatory guidance with respect to the outsourcing by a financial services company of a material aspect of its business?

The Securities and Futures Commission (SFC) has endorsed the Principles on Outsourcing of Financial Services for Market Intermediaries published by the International Organization of Securities Commission (the IOSCO Principles) but there are no specific regulations or guidance issued by the SFC on outsourcing. There are specific requirements that regulated entities must comply with, such as record-keeping requirements, which are relevant to decisions to outsource parts of the business.

The Hong Kong Monetary Authority (HKMA), which regulates authorized institutions, such as banks, includes in its supervisory policy manual a chapter on outsourcing. The HKMA expects authorized institutions to be aware of their legal obligations to meet the minimum authorization criteria under the Banking Ordinance in relation to outsourcing plans. In particular, authorized institutions need to have adequate accounting systems and systems of control and to conduct their business with integrity, competence and in a manner not detrimental to the interests of depositors.

Cloud computing

Are there legal requirements or regulatory guidance with respect to the use of cloud computing in the financial services industry?

The Hong Kong Privacy Commissioner, the HKMA and the SFC have published guidelines on outsourcing and data privacy in connection with cloud computing.

The Hong Kong Privacy Commissioner has published various guidelines, circulars and information leaflets providing guidance on measures and best-recommended practices that are pertinent to cloud services. These include having contractual arrangements between providers and customers of cloud services, to address the Privacy Commissioner’s key concerns relating to loss of control, and the use, retention or erasure and security, of personal data when it is stored in the cloud.

The HKMA’s Supervisory Policy Manual sets out the key regulatory standards that the HKMA expects authorized institutions to follow, or else be prepared to justify non-compliance, for managing technology risks and cybersecurity, covering topics such as:

IT governance and oversight, system development and change management;
information processing;
communication network management; and
management of technology service providers.

The SFC has endorsed the IOSCO Principles in relation to ‘licensed corporations’ outsourcing their activities. The SFC also issued guidelines that require licensed corporations to establish policies and procedures to ensure the integrity, security, availability, reliability and thoroughness of all information relevant to the licensed corporation’s business, which extends to situations where data is stored in the cloud. Other best-recommended practices relevant to cloud computing include:

reviewing policies and procedures to manage, identify and assess cybersecurity threats and IT security controls;
considering the cybersecurity controls of third-party service providers; and
ensuring continuity of critical activities and systems.

In 2019, the SFC issued a circular on the use of external electronic data storage by licensed corporations. The circular sets out various requirements in relation to licensed corporations’ use of external data storage providers (EDSPs). These include requirements to obtain undertakings from EDSPs in favor of the SFC in certain circumstances and requirements regarding the management of risks and security with regard to the use of EDSPs. The SFC has also issued guidance in the form of FAQs as to how similar requirements are to apply to the use of electronic data storage provided by intragroup affiliates.

INTELLECTUAL PROPERTY RIGHTS

IP protection for software

Which intellectual property rights are available to protect software, and how do you obtain those rights?

Computer programs (and preparatory design materials for computer programs) are protected by copyright as literary works under the Copyright Ordinance. Copyright arises automatically as soon as the computer program is recorded. Registration of copyright is not required and is not possible in Hong Kong.

If the software code has been kept confidential, it may also be protected as confidential information. No registration is required.

Programs for computers, and schemes, rules or methods of doing business ‘as such’, are expressly excluded from patentability under the Patents Ordinance.

Notwithstanding these exclusions, it is possible to obtain patents for computer programs and business methods if it can be shown that the underlying invention makes a ‘technical contribution’ over and above that provided by the computer program or business method itself, such as an improvement in the working of the computer. Accordingly, a well-drafted patent may be able to bring a computer-based software or business method invention within this requirement, but this may be difficult to do and will not always be possible. Registration formalities must be followed to obtain protection.

In particular, ‘standard’ patents are based on patents applied for and granted by one of three designated patent offices, namely, in China, the United Kingdom and the European Patent Office (where the United Kingdom is designated). They have a maximum period of protection of 20 years from the filing date of the designated application.

IP developed by employees and contractors

Who owns new intellectual property developed by an employee during the course of employment? Do the same rules apply to new intellectual property developed by contractors or consultants?

Copyright created by an employee in the course of his or her employment is automatically owned by the employer unless otherwise agreed as provided under the Copyright Ordinance.

An invention made by an employee belongs to the employer if it was made in the course of:

the normal duties of the employee or in the course of duties falling outside his or her normal duties, but specifically assigned to him or her, and the circumstances, in either case, were such that an invention might reasonably be expected to result from the carrying out of his or her duties; or
the duties of the employee and, at the time of making the invention, because of the nature of his or her duties and the particular responsibilities arising from the nature of his or her duties, he or she had a special obligation to further the interests of the employer’s undertaking.

Copyright or inventions created by contractors or consultants in the course of their duties are owned by the contractor or consultant unless otherwise agreed in writing. However, the person who commissions a copyrighted work has an exclusive license to exploit the commissioned work for all purposes that could reasonably have been contemplated by the author and the person who commissioned the work at the time the work was commissioned, and the power to restrain any exploitation of the commissioned work for any purpose against which he or she could reasonably take objection.

Joint ownership

Are there any restrictions on a joint owner of intellectual property’s right to use, license, charge or assign its right in intellectual property?

If copyright is jointly owned (e.g, copyright in respect of a computer program that has been co-written by two people) then all joint owners must consent to any act restricted by copyright (such as its use, licensing and assignment) under the Copyright Ordinance. As a result, the commercialization of jointly owned copyright can be a challenge unless all owners consent to its use. It is advisable for the joint owners to enter into an agreement setting out how these rights should be exercised.

In respect of patents, each co-owner is entitled to an equal undivided share in the patent and can do anything in respect of the invention for his or her own benefit without the consent or need to account to the other under the Patents Ordinance (in each case, subject to any other agreement reached between the co-owners).

Trade secrets

How are trade secrets protected? Are trade secrets kept confidential during court proceedings?

Confidential information can be protected against misuse, provided the information in question has the necessary quality of confidence, is subject to an express or implied duty of confidence, and that no registration is necessary (or possible).

Confidential information can be kept confidential during civil proceedings with the permission of the court.

Branding

What intellectual property rights are available to protect branding and how do you obtain those rights? How can fintech businesses ensure they do not infringe existing brands?

Brands can be protected as registered trademarks in Hong Kong. A brand can also be protected under the common law tort of passing off if it has acquired sufficient goodwill. Certain branding, such as logos and stylized marks, can also be protected by design rights and may also be protected by copyright as artistic works.

The HK Registry trademark database can be searched to identify potentially problematic trademarks that have been registered or applied for. It is highly advisable for fintech businesses to conduct trademark searches to check whether earlier registrations exist that are identical or similar to their proposed brand names. It may also be advisable to conduct searches on the internet for any unregistered trademark rights that may prevent the use of the proposed mark.

Remedies for infringement of IP

What remedies are available to individuals or companies whose intellectual property rights have been infringed?

Remedies include:

preliminary and final injunctions;
damages or an account of profits;
delivery up or destruction of infringing products;
disclosure orders; and
costs.

COMPETITION

Sector-specific issues

Are there any specific competition issues that exist with respect to fintech companies in your jurisdiction?

There is a competition regime under the Competition Ordinance in Hong Kong that applies to all entities carrying out business in Hong Kong. There are no particular aspects of this regime that would affect fintech businesses disproportionately to other businesses.

TAX

Incentives

Are there any tax incentives available for fintech companies and investors to encourage innovation and investment in the fintech sector in your jurisdiction?

There are no specific tax incentives applicable to fintech companies.

Increased tax burden

Are there any new or proposed tax laws or guidance that could significantly increase tax or administrative costs for fintech companies in your jurisdiction?

No.

IMMIGRATION

Sector-specific schemes

What immigration schemes are available for fintech businesses to recruit skilled staff from abroad? Are there any special regimes specific to the technology or financial sectors?

The Hong Kong government launched different schemes to recruit skilled staff in areas including the technology and financial sectors.

The Talent List of Hong Kong was promulgated to attract people around the world who specialize in the 13 professions most needed for Hong Kong’s economic development, including ‘Experienced professionals in Fintech’, ‘Experienced data scientists and cyber security specialists’ and ‘Innovation and technology experts’. These candidates are potentially eligible for immigration via the Quality Migrant Admission Scheme, which does not require them to have secured an offer of local employment for settlement in Hong Kong.

The Innovation and Technology Commission introduced and launched the Technology Talent Admission Scheme in 2018, a scheme that provides a fast-track arrangement for admission of overseas and mainland research and development talent. Eligible technology companies and institutes, including those engaged in the areas of fintech, artificial intelligence and cybersecurity, may be granted quotas to sponsor eligible persons to apply for employment visas or entry permits. In December 2022, the Innovation and Technology Commission further introduced enhancement measures to the scheme, which lifted the local employment requirement, extended the quota validity period and expanded the coverage to more emerging technology areas.

UPDATE AND TRENDS IN FINTECH IN HONG KONG

Current developments

Are there any other current developments or emerging trends to note?

During FinTech Week 2022, the Hong Kong government and regulators – the Hong Kong Monetary Authority (HKMA) and the Securities and Futures Commission (SFC) – signaled their sentiment to embrace fintech adoption, digital ledger technology and their applications (including in the areas of cryptocurrencies, non-fungible tokens and metaverses). Hand in hand with this, regulators emphasized the importance of creating a robust and balanced legal and regulatory framework to maintain public trust and the overarching guiding principle of ‘same activity, same risks, same regulation’. The regulators also encouraged the financial sector in Hong Kong to adopt a radical open-mindedness to fintech innovation.

The Hong Kong government has introduced legislation to regulate cryptocurrency exchanges and virtual asset trading platform operators, which is due to come into effect on 1 June 2023.

The HKMA, in its consultation conclusions to the discussion paper on crypto-assets and stablecoins in January 2023 (Consultation Conclusions), proposed to bring certain activities relating to stablecoins into the regulatory perimeter. The HKMA expects to implement the regulatory arrangements in 2023–2024.

In October 2022, the SFC also announced in a circular regarding the requirements under which the SFC would consider authorizing exchange-traded funds that obtain exposure to virtual assets primarily through futures contracts for public offering in Hong Kong.

The HKMA also expressed, in April 2023, encouragement for banks to support the Tiered Account Services initiative (which was introduced in 2019) and to facilitate the ease of offering banking services to small and medium-sized enterprises and start-ups (which has long been one of the more difficult tasks in setting up new businesses in Hong Kong).

The HKMA has been seeking to explore the use of central bank digital currencies to ease cross-border trade settlement, in particular the testing of e-renminbi and e-Hong Kong dollar. The HKMA issued a discussion paper to gather feedback on the feasibility of a retail e-Hong Kong dollar in April 2022 and a policy stance on e-Hong Kong dollar outlining its next steps in September 2022.

The Hong Kong government has sought to establish qualifications and competency standards for the fintech sector. It was announced in the Hong Kong government’s 2022–2023 budget that the development of recognized professional qualification standards for sector practitioners under the Qualifications Framework for Fintech was underway.

* The information in this chapter was accurate as of May 2023.

If you need more consulting, please Contact Us at TNHH NT International Law Firm (ntpartnerlawfirm.com)

You can also download the .docx version here.

Rate this post

“The article’s content refers to the regulations that were applicable at the time of its creation and is intended solely for reference purposes. To obtain accurate information, it is advisable to seek the guidance of a consulting lawyer.”

LEGAL CONSULTING SERVICES

090.252.4567

HÃY CLICK ĐỂ LẠI SĐT CHÚNG TÔI SẼ GỌI NGAY CHO BẠN MIỄN PHÍ

NT INTERNATIONAL LAW FIRM

Email: info@ntpartnerlawfirm.com – luatsu.toannguyen@gmail.com
Phone: 090 252 4567
Address: B23 Nam Long Residential Area, Phu Thuan Ward, District 7, Ho Chi Minh City, Vietnam