Digital Assets & Virtual Assets
Cryptocurrency Exchange Licensing in Hong Kong: The VASP Regime Explained
A detailed guide to the legal and regulatory framework for real world asset (RWA) tokenisation in Hong Kong, covering SFC circulars, Project Ensemble, structuring options, security token treatment, and compliance requirements.
Real World Asset (RWA) tokenisation — the process of creating digital tokens on a blockchain that represent ownership of, or rights in, real-world assets such as real estate, bonds, private equity interests, commodities, or infrastructure — has moved from a niche concept to one of the most actively pursued applications of distributed ledger technology in the financial services industry.
Global financial institutions, sovereign wealth funds, and central banks are actively exploring or piloting RWA tokenisation. In Hong Kong, the government and regulators — the SFC, HKMA, and the Innovation and Technology Commission — have been active proponents of tokenisation as a component of Hong Kong’s digital asset strategy.
The commercial rationale for RWA tokenisation is compelling:
Hong Kong does not yet have RWA-specific legislation. The legal and regulatory framework applicable to a tokenised asset depends on the nature of the underlying asset and the rights conferred by the token.
If an RWA token constitutes a “security” under the Securities and Futures Ordinance (SFO) — most commonly as an interest in a collective investment scheme (CIS) or as a debenture — the full weight of Hong Kong securities law applies. The offering of security tokens to the public requires SFC authorisation (or an exemption, such as the professional investor private placement exemption). Dealing, advising, and managing security tokens requires SFC licensing.
The SFC has published its “Statement on Security Token Offerings” and subsequent guidance indicating that it applies the same regulatory framework to STOs as to conventional securities offerings — the technology does not change the regulatory treatment.
The HKMA’s Project Ensemble sandbox (launched 2024) is exploring the use of tokenised money (wCBDC) for settling tokenised asset transactions. Participating institutions are piloting tokenisation of bonds, funds, carbon credits, and trade finance assets. Project Ensemble represents the Hong Kong government’s active engagement with RWA tokenisation at the institutional level.
The SFC issued a circular in November 2023 providing guidance on the tokenisation of SFC-authorised investment products (i.e., retail funds and investment products). Key requirements for tokenised SFC-authorised products include: robust custody arrangements for the underlying assets, technology risk management, investor disclosure of tokenisation-specific risks, and compliance with existing product authorisation requirements.
The HKMA has issued tokenised green bonds under the Government Green Bond Programme (most recently in 2023 and 2024), demonstrating the feasibility of tokenised government bonds on distributed ledger infrastructure. These issuances have established important precedents for the legal and operational framework of tokenised bonds in Hong Kong.
The first question in any RWA tokenisation project is the legal characterisation of the token: what rights does it represent? Options include: direct legal ownership of the underlying asset (if the legal system recognises digital token ownership), beneficial ownership under a trust structure, contractual rights against the issuer, or interests in a fund or special purpose vehicle (SPV) that holds the underlying asset.
In Hong Kong (as in most common law jurisdictions), direct ownership of property via a blockchain token is not yet clearly established as a legal mechanism. Most RWA tokenisation structures therefore use a trust or SPV structure: the underlying asset is held by a trustee or SPV, and the token represents beneficial interests or shares/units in that structure.
The most common legal architecture for RWA tokenisation involves: an SPV (a Hong Kong or offshore company) that holds the underlying asset, with tokens representing shares or interests in the SPV; or a trust structure, with the trustee holding the underlying asset and tokens representing beneficial interests in the trust. In each case, the token is a digital representation of an existing legal interest (shares, trust beneficial interests, or contractual rights), rather than a sui generis form of property.
Security tokens are subject to transfer restrictions under the SFO and the offering documents: only eligible investors (professional investors) can hold them, and transfers must comply with securities law. Smart contracts can encode these restrictions — preventing transfer to ineligible wallets — but the compliance framework must also address “offchain” transfers (e.g., transfer of the private keys associated with a wallet).
Custody of tokenised assets involves two layers: custody of the underlying asset (the real estate title, bond certificate, etc.) and custody of the digital token (the private keys). The SFC has provided guidance on custody requirements for tokenised securities: the custodian must have adequate systems and controls for both layers, and the arrangements must be disclosed to investors.
Smart contract bugs, oracle failures, and blockchain infrastructure risks (hard forks, consensus failures) are specific risks of tokenised assets that issuers must disclose and manage. Independent smart contract audits and robust incident response procedures are essential.
RWA tokenisation is one of the most significant legal and financial innovations of the current decade. In Hong Kong, the regulatory framework — centred on the SFC’s securities law framework and the HKMA’s active engagement through Project Ensemble and tokenised bond issuances — provides a workable (if not yet fully resolved) environment for tokenisation projects. Legal structuring — particularly the choice of trust or SPV architecture — is the foundation on which a sound tokenisation project must be built.
Alan Wong LLP advises on RWA tokenisation structures, STO compliance, SFC licensing, and digital asset law in Hong Kong. Contact us to discuss your tokenisation project.
Disclaimer: This article is provided for general information only and does not constitute legal advice. It should not be relied upon as a substitute for specific legal advice on any particular matter. No solicitor-client relationship is created by your access to or use of this article. The law may change, and its application will depend on the specific facts and circumstances of each case. To the fullest extent permitted by law, we accept no responsibility for any loss or damage arising from reliance on this article.
A practical guide to AI governance and compliance in Hong Kong — the PCPD, HKMA and SFC expectations, plus a 13-point checklist for businesses adopting AI.

Hong Kong startup PDPO guide — privacy notices, direct marketing rules, employee data, cookies, breach response, and a practical compliance checklist for founders.