Security Token Offerings in Hong Kong: A Legal and Regulatory Guide

A legal and regulatory guide to Security Token Offerings (STOs) in Hong Kong: SFC framework, security token classification, prospectus requirements, intermediary licensing, tokenised bonds and funds, and practical compliance checklist.

Security token offerings (STOs) represent one of the most significant developments at the intersection of traditional securities law and blockchain technology. An STO involves the issuance of digital tokens on a blockchain that represent ownership of, or rights in, an underlying asset — whether equity in a company, debt, real estate, fund interests, or other financial instruments. Unlike utility token sales (which aim to provide access to a product or service), STOs are explicitly designed to constitute securities, and are therefore subject to securities regulation.

This article examines the legal and regulatory framework for STOs in Hong Kong, the SFC’s approach, and the key considerations for issuers.

What Makes a Token a “Security Token”?

A token is a security token if it constitutes a “security” as defined in the Securities and Futures Ordinance (SFO). The most common categories engaged by STOs are:

  • Shares: Tokens representing equity interests in a corporation.
  • Debentures: Tokens representing debt obligations of an issuer.
  • Collective Investment Scheme (CIS) interests: Tokens representing interests in an arrangement where participants participate in or receive profits from the management of a pool of property by others, without day-to-day control.

The SFC applies a “look-through” approach: the label applied by the issuer is irrelevant. If the economic substance of the token is that of a security, it is regulated as one regardless of what it is called.

The SFC’s Regulatory Framework for STOs

The SFC has issued a number of statements and circulars addressing STOs. Its position, consistent since its November 2018 Statement on STOs, is that: security tokens are “securities” under the SFO; dealing in, advising on, and managing security tokens requires SFC licensing; and STOs offered to the public in Hong Kong must comply with the prospectus requirements of the Companies (Winding Up and Miscellaneous Provisions) Ordinance (Cap. 32) or an exemption must apply.

Licensing Requirements

The following SFC licences are relevant to STOs:

  • Type 1 (Dealing in Securities): Required for brokers and dealers who buy and sell security tokens for clients, including distribution of tokens in the primary offering.
  • Type 4 (Advising on Securities): Required for advisers who provide investment advice on security tokens.
  • Type 6 (Advising on Corporate Finance): May be required for corporate finance advisers involved in structuring and executing an STO.
  • Type 9 (Asset Management): Required for managers of funds or portfolios holding security tokens.

Offering to Professional Investors Only

In practice, most STOs in Hong Kong are structured as private placements to “professional investors” only, relying on the exemptions under Section 103(3) of the SFO (which exempts offers made only to professional investors from the prohibition on offering CIS interests to the public without SFC authorisation) and under the Companies (Winding Up and Miscellaneous Provisions) Ordinance (which provides a prospectus exemption for offers to professional investors).

“Professional investors” under the SFO include: institutions (banks, licensed corporations, insurance companies, authorised institutions), corporate investors with portfolios exceeding HK$8 million, and individual investors with portfolios exceeding HK$8 million who sign a professional investor declaration.

SFC-Regulated Platform Requirement

The SFC has indicated that secondary market trading in security tokens should only be conducted on SFC-licensed platforms. This is a significant constraint: there are currently very few SFC-licensed platforms with the technical capability to support secondary trading in security tokens. The SFC’s licensing regime for virtual asset trading platforms (VATPs) under the AMLO provides a separate licensing pathway for platforms trading non-security virtual assets, but for security tokens, Type 7 (Automated Trading Services) or Type 1 licensing on an appropriate platform is required.

Structuring an STO in Hong Kong

Choose the Asset and Token Type

Determine what the token represents: equity (shares in a company), debt (a bond or note), fund interests (units in a fund or OFC), or real estate interests (beneficial interests in a property-owning SPV). The choice of underlying asset determines the applicable legal framework and documentation requirements.

Legal Opinion on Token Characterisation

Obtain a written legal opinion from Hong Kong counsel confirming the token’s characterisation as a security (and the applicable regulatory framework). This is essential for the offering document and for representations to exchanges and investors.

Appoint a Type 1 Licensed Distributor

The primary distribution of security tokens must be conducted through an SFC Type 1 licensed entity. The issuer itself may apply for a Type 1 licence, or it may appoint an existing licensed intermediary as the placement agent or distributor.

Prepare an Offering Memorandum

An STO requires a comprehensive offering memorandum disclosing: the issuer’s business and financial position, the terms of the security token (rights, restrictions, transferability), the technology and smart contract architecture, AML/KYC procedures for investors, risk factors (including technology risk, liquidity risk, and regulatory risk), and the dispute resolution mechanism.

AML/KYC

All investors must undergo AML/KYC verification before receiving security tokens. The KYC process must be conducted by a regulated entity (the Type 1 licensed distributor or its AML/KYC service provider). Robust investor eligibility verification (confirming professional investor status) is essential.

Smart Contract Audit

The smart contract governing the token issuance, transfer, and any automated distributions should be independently audited by a reputable blockchain security firm. Smart contract bugs can result in loss of assets, unintended token creation, or unauthorised transfers.

Secondary Market Arrangements

Arrange for secondary market trading on an appropriate licensed platform. Given the limited availability of SFC-licensed platforms supporting security token trading, this is currently one of the most challenging aspects of STO structuring. Some issuers have established bilateral OTC transfer arrangements as an interim measure.

Key Legal Documents

  • Token Instrument: The legal instrument (articles of association, instrument creating the security, or trust deed) establishing the rights conferred by the token.
  • Offering Memorandum / Prospectus: The investor disclosure document.
  • Subscription Agreement: The binding contract between the issuer and each investor.
  • Placement Agency Agreement: Between the issuer and the Type 1 licensed distributor.
  • Smart Contract: The on-chain code governing token mechanics.
  • Custody Agreement: With the custodian responsible for safekeeping of the tokens.

Conclusion

STOs in Hong Kong are regulated as securities offerings, with all the associated licensing, disclosure, and compliance requirements. The SFC’s “look-through” approach means that technology does not change regulatory treatment. A well-structured STO — with proper licensing, a comprehensive offering memorandum, robust AML/KYC, and a smart contract audit — is achievable, but requires careful planning and experienced legal counsel.

Alan Wong LLP advises on security token offerings, SFC licensing, and digital asset law in Hong Kong. Contact us to discuss your STO.

Disclaimer: This article is provided for general information only and does not constitute legal advice. It should not be relied upon as a substitute for specific legal advice on any particular matter. No solicitor-client relationship is created by your access to or use of this article. The law may change, and its application will depend on the specific facts and circumstances of each case. To the fullest extent permitted by law, we accept no responsibility for any loss or damage arising from reliance on this article.

You may like

AI Governance in Hong Kong: A 2026 Compliance Checklist for Businesses

AI Governance in Hong Kong: A 2026 Compliance Checklist for Businesses

A practical guide to AI governance and compliance in Hong Kong — the PCPD, HKMA and SFC expectations, plus a 13-point checklist for businesses adopting AI.

PDPO Compliance for Hong Kong Startups – A Practical Legal Guide

PDPO Compliance for Hong Kong Startups – A Practical Legal Guide

Hong Kong startup PDPO guide — privacy notices, direct marketing rules, employee data, cookies, breach response, and a practical compliance checklist for founders.