Fintech Regulation in Hong Kong: Payments, Lending, and Insurtech

Hong Kong has established itself as one of Asia's leading fintech hubs, with a regulatory environment that balances innovation with investor and consumer protection. The Hong Kong Monetary Authority (HKMA), the Securities and Futures Commission (SFC), and the Insurance Authority (IA) have each developed fintech-specific initiatives, including regulatory sandboxes, licensing regimes for new entrants, and open API frameworks. This guide provides an overview of the key regulatory frameworks applicable to fintech businesses in Hong Kong, covering payments, lending, and insurance technology.

The Regulatory Landscape

Unlike some jurisdictions that have enacted single "fintech" legislation, Hong Kong's fintech regulatory framework applies existing financial services laws to new technologies, supplemented by fintech-specific guidance and licensing regimes where necessary. The key regulators are:

• Hong Kong Monetary Authority (HKMA): Oversees banks, payment systems, stored value facilities, money service operators, and the licensing of virtual banks
• Securities and Futures Commission (SFC): Regulates investment-related fintech (robo-advisers, equity crowdfunding platforms, tokenised securities, virtual asset service providers)
• Insurance Authority (IA): Regulates insurtech, including online distribution of insurance products and authorisation of virtual insurers
• Customs and Excise Department (C&ED): Licenses money service operators (MSOs), including remittance and money changing services

Payments and Stored Value Facilities

Stored Value Facility (SVF) Licensing

A stored value facility (SVF) is a facility in which a monetary value is stored and used to make payments. SVFs include e-wallets, prepaid cards, and digital payment platforms. Under the Payment Systems and Stored Value Facilities Ordinance (Cap. 584) (PSSVFO), any person who issues a multi-purpose SVF (one that can be used for payments to more than one merchant) must be licensed by the HKMA.

SVF licensees include well-known names such as Alipay, WeChat Pay HK, and PayMe (HSBC). SVF licensees must meet requirements including:

• Minimum paid-up capital (HK$25 million for new applicants)
• Float (outstanding stored value) must be held in segregated accounts with authorised institutions
• Fit and proper requirements for directors and senior management
• Business continuity and cybersecurity controls
• AML/CFT compliance

Payment System Oversight

The HKMA designates certain payment systems as systemically important and oversees them under the PSSVFO. Designated systems include CHATS (Clearing House Automated Transfer System), HKICL (Hong Kong Interbank Clearing Limited), and the Faster Payment System (FPS) — a 24/7 retail payment infrastructure that enables instant transfers between banks and SVF operators.

Open API Framework

The HKMA launched its Open API Framework in 2018, requiring banks to implement open APIs in four phases covering product information, customer acquisition, account information, and transaction initiation. This framework supports fintech innovation by enabling third-party providers (TPPs) to develop applications on top of bank infrastructure (the foundation of "open banking"). Implementation across all phases has proceeded progressively, with Hong Kong's approach reflecting a market-led (rather than mandated) model compared to the EU's PSD2.

Virtual Banks

The HKMA introduced a virtual bank licensing regime in 2018, and eight virtual banks were granted licences between 2019 and 2020 (including ZA Bank, Mox, livi, WeLab Bank, and others). Virtual banks operate entirely online (no physical branches) and are subject to the same prudential requirements as traditional banks under the Banking Ordinance (Cap. 155), but with some requirements adapted for their business model (e.g., no minimum balance fees, focus on retail customers). They have accelerated competition and innovation in retail banking.

Lending and Credit

Money Lenders Ordinance

Any person who carries on a business of lending money (i.e., makes loans to at least 4 persons in a year) must be licensed under the Money Lenders Ordinance (Cap. 163) (MLO), administered by the Commissioner of Police. Key requirements:

• A money lender's licence must be obtained before carrying on the business
• Interest rates are capped at 48% per annum (effective rate)
• Certain exemptions apply for authorised institutions (banks), SVF licensees, and regulated entities

Online lending platforms (P2P lenders) that lend their own money to borrowers (balance sheet lending) are typically subject to the MLO. However, pure P2P platforms that simply match borrowers and lenders without taking principal risk are in a grey zone under the MLO — depending on structuring, they may also be regulated as collective investment schemes under the SFO if the matching arrangements constitute management of a CIS.

Buy Now Pay Later (BNPL)

BNPL products (short-term deferred payment facilities typically offered at point of sale) have grown rapidly. Hong Kong does not currently have a specific BNPL regulatory regime. Depending on the structure, BNPL may fall under the MLO (if interest is charged or fees are structured as interest) or outside it (if genuinely interest-free). The HKMA has consulted on regulating BNPL and may introduce a specific regime.

Crowdfunding

Equity crowdfunding (offering shares to the public via an online platform) requires SFC authorisation under the SFO unless an exemption applies (e.g., professional investor-only offers). Hong Kong has not introduced a specific equity crowdfunding regime for retail investors, unlike markets such as the UK or Australia. Reward-based and donation-based crowdfunding (no securities involved) are generally unregulated from a securities law perspective, though charity and data privacy laws apply.

Robo-Advisory and AI-Driven Investment

Robo-advisers are algorithm-driven platforms that provide automated investment advice and portfolio management. In Hong Kong, a robo-adviser that provides investment advice on securities is carrying on a Type 4 (advising on securities) or Type 9 (asset management) regulated activity and must be licensed accordingly. The SFC has issued guidance on robo-advisory services, requiring:

• Adequate assessment of clients' investment objectives and risk tolerance (suitability requirements)
• Disclosure of the nature of the automated service and its limitations
• Robust algorithms with adequate internal controls and backtesting
• Human oversight and escalation mechanisms for complex or unusual situations

Insurtech

Insurance Authority Oversight

Insurtech businesses offering or distributing insurance products in Hong Kong must comply with the Insurance Ordinance (Cap. 41). Key considerations:

• Insurance intermediaries (agents and brokers) who sell insurance products must be registered with the IA
• Online distribution of insurance products is permitted, but the IA has specific guidance on digital channels requiring appropriate suitability and disclosure standards
• Purely technology service providers to insurers (e.g., SaaS platforms for underwriting or claims processing) are generally not themselves required to be licensed as insurers or intermediaries

Virtual Insurers

The IA introduced a Pilot Scheme to encourage the establishment of "Insurtech-focused" authorised insurers that distribute products entirely through digital channels. Four virtual insurers were authorised under this scheme between 2020 and 2022, focused on areas including health, general, and life insurance. Virtual insurers are subject to the same capital and solvency requirements as traditional insurers but benefit from a more streamlined supervisory approach for their initial establishment.

Parametric Insurance and Smart Contracts

Parametric insurance products (where payouts are triggered automatically based on objective data, e.g., flight delay insurance triggered by real-time flight data) and smart contract-based insurance products have attracted interest in Hong Kong. These products raise questions about the legal characterisation of smart contract payouts (are they insurance?) and the regulatory treatment of the automated claims process. Legal analysis is required on a case-by-case basis.

Regulatory Sandboxes

Hong Kong's three main financial regulators each operate a regulatory sandbox to facilitate testing of innovative fintech solutions:

• HKMA Fintech Supervisory Sandbox (FSS): Allows banks and SVF licensees to test new technologies with a limited number of customers before full rollout, with appropriate risk controls
• SFC Regulatory Sandbox: Allows fintech firms operating in the securities and investment management space to engage with the SFC on licensing questions and to pilot new business models under close supervision
• IA Insurtech Sandbox: Allows insurers and intermediaries to test innovative insurance products and distribution methods before seeking formal regulatory approval

The sandboxes provide a valuable dialogue channel between regulators and innovators, allowing regulators to understand new business models and allowing businesses to get regulatory feedback before committing to full compliance infrastructure.

Cross-Border Fintech and RegTech

The HKMA has entered into cooperation agreements with overseas regulators (including the UK FCA, Singapore MAS, Thailand BOT, and others) to facilitate cross-border fintech collaboration and regulatory referrals. The Global Financial Innovation Network (GFIN), of which the HKMA is a member, allows fintech firms to test innovations across multiple jurisdictions simultaneously.

RegTech (regulatory technology) solutions — including AML/CFT compliance automation, digital onboarding, and regulatory reporting tools — do not themselves require licensing in Hong Kong (as they are typically provided to regulated entities as B2B services rather than directly to consumers). However, regulated entities using RegTech solutions remain responsible for their own compliance obligations.

Practical Considerations for Fintech Businesses

• Early regulatory engagement: Engage with the relevant regulator (HKMA, SFC, or IA) early in the product development process, ideally through the appropriate sandbox programme
• Legal structuring: Carefully structure the business model to understand which activities trigger licensing requirements and which can be conducted without a licence
• AML/CFT compliance from day one: Build AML/CFT compliance into the product design, not as an afterthought
• Data privacy: Ensure PDPO compliance for the collection and use of customer personal data, and develop a Privacy Policy Notice before going live
• Cybersecurity: Implement robust cybersecurity controls from the outset — a data breach or security incident can have existential consequences for a fintech start-up

Conclusion

Hong Kong's fintech regulatory environment is sophisticated, proactive, and generally supportive of innovation — provided businesses engage with the framework rather than trying to operate in grey zones. The HKMA, SFC, and IA have each demonstrated willingness to work constructively with innovative businesses through their sandbox programmes. Early legal advice to map the regulatory perimeter for a new fintech product or business model is invariably a worthwhile investment.

Alan Wong LLP advises fintech businesses, virtual banks, virtual insurers, payment platforms, and start-ups on regulatory licensing, structuring, and compliance in Hong Kong. Contact us to discuss your fintech regulatory questions.