Hong-Kong flag

Global Financial Regulations 2022

Financial regulations in Hong Kong

Although Hong Kong faces competition by rapidly digitalizing Asian powerhouses like India and Singapore, it is poised to make incredible strides in open banking and other fintech innovations as it emerges from the COVID-19 pandemic. 

Country Overview

Although Hong Kong faces competition by rapidly digitalizing Asian powerhouses like India and Singapore, it is poised to make incredible strides in open banking and other fintech innovations as it emerges from the COVID-19 pandemic. The health crisis drove a 6.1% shrinkage in Hong Kong’s 2020 GDP, its largest annual contraction on record,1 but the wealthy and innovative special administrative region is expected to make a strong recovery. Indeed, the economy expanded by 7.9% in the first quarter of 2021,2 its strongest quarterly performance in eleven years.3

In ensuring a stable recovery and securing Hong Kong’s status as a modern, global financial hub, digitalization will be key. In February 2021, Financial Secretary Paul Chan released the 2021-2022 budget, which allocates HK $120 billion (approximately USD $15.5 billion) towards strengthening digital transformation, the market recovery process and Hong Kong’s competitiveness.4 Hong Kong already ranks third globally and second in the APAC region in digital evolution, according to the Digital Intelligence Index (DII) 2020 prepared by Mastercard and Tufts University’s Fletcher School. The pandemic further sped up digitalization in Hong Kong as consumer preferences shifted and banks rushed to adopt digital solutions, including increased investment in AI.5 Alongside a boost in the use of digital payments, e-commerce sales soared amidst containment measures and political protests, and the market is expected to grow at a compound annual growth rate of 8.3% between 2021 and 2024.6

The Hong Kong Monetary Authority (HKMA) has been especially eager to cultivate the city’s vibrant fintech ecosystem, and has encouraged the accelerated adoption of online banking, open banking and other future-proof solutions. Eight virtual banks—licensed by the HKMA—launched in 2020,7 and virtual banks are expected to yield HKD $76 billion in revenue per year by 2025, a combined market share of 19.3%.8 Meanwhile, the HKMA is pushing small and medium-sized lenders to digitalize their operations. 

Hong Kong’s 2021 digital agenda focuses on strengthening the fintech sector and its open banking framework, regulating crypto, an investigation into a possible e-HKD, a digital yuan cross-border retail payment system and a multiple central bank digital currency (CBDC) bridge project. A key challenge will be navigating a continuously evolving cyberthreat landscape as digitalization presents new and sophisticated risks. In 2020, cybercrime in Hong Kong skyrocketed by 55% compared to 2019,9 with a notable increase in cyber fraud tactics like phishing. Hong Kong has no comprehensive national cybersecurity framework, which would be instrumental in protecting its digital economy and bolstering its competitiveness. 

Financial Regulatory Authorities

The Hong Kong Monetary Authority (HKMA) is the jurisdiction’s central bank reporting to the Financial Secretary. The bank’s primary objective is to ensure the stability of the territory’s financial system and currency. 

The Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD) is the main data protection authority in the jurisdiction. The statutory body enforces the Personal Data Privacy Ordinance (PDPO) and issues various regulations and guidelines implementing requirements under the PDPO. 

Other Regulatory Authorities

The Financial Services and the Treasury Bureau (FSTB) develops and implements government policy on finance and treasury. 

Policy, Laws and Regulations

Open API Framework, 2022 

The Hong Kong Money Authority’s (HKMA) phased rollout of the Open API Framework for the banking sector involves 28 participating banks. The banks began Phases III and IV in late 2021, with an initial focus on deposit account information and online merchant payments. 

Per the HKMA’s website, under Phase III, 25 banks plan to launch the API functions for retail customers by June 30, 2022. In addition, 23 banks will launch the API functions for corporate and SME customers by June 30, 2022.

Under Phase IV, app-to-app payments, 27 of the 28 participating banks will launch this capability by June 30, 2022.  The remaining bank plans to do so by September 30, 2022. 

Hong Kong Monetary Authority to Begin Study on Use Cases of Central Bank Digital Currency, 08 June 2021 

As part of its Fintech Development Strategy (“Fintech 2025”), the HKMA announced that it has been working in partnership with the Bank for International Settlements (BIS) in researching retail CBDCs, and that it will now begin to study use cases and risks of CBDCs. Project Aurum will test both hybrid CBDC and private CBDC-backed stablecoin models. The HKMA also announced that it was entering a second phase of testing to explore the linkage of China’s digital yuan with Hong Kong’s domestic payments system to assess the CBDC’s feasibility in cross-border transfers. 

Fintech 2025 seeks to further integrate fintech with the financial sector, develop next-generation data infrastructure, bolster the fintech workforce, prepare Hong Kong for the advent of CBDCs and cultivate the fintech ecosystem through funding and policies. Towards these goals, the HKMA will create a Fintech Cross-Agency Co-ordination Group to develop policies in support of fintech, strengthen the Fintech Supervisory Sandbox and build the Commercial Data Interchange (CDI), a digital identity and distributed ledger technology (DLT)-based platform that facilitates consent-based data sharing. To encourage the adoption of fintech by banks, the HKMA will issue a Tech Baseline Assessment to help pinpoint fintech business areas or technologies in need of support from the authority. The Hong Kong Growth Portfolio, a HKD $22.4 billion (approximately USD $2.9 billion) investment fund10 to support key companies and projects, is in development, as is the Industry Projects Masters Network scheme, which aims to cultivate fintech talent by offering internship opportunities to postgraduate students. 

Circular on iAM Smart in Remote Onboarding, 24 May 2021 

The HKMA issued a circular to authorized institutions (AIs) to promote the wider adoption of the iAM Smart (internet Access by Mobile in a Smart way) mobile app in remote onboarding. Launched in December 2020, the iAM Smart app offers digital identity services, including authentication, form-filling, personalized notifications and digital signing. Holders of a Hong Kong Identity Card (HKIC) aged 11 and above are eligible to register for the app. In order to clarify the use of iAM with regard to AML/CFT compliance, the Hong Kong Association of Banks (HKAB), with help from the HKMA, updated the relevant FAQs. The circular states “that when iAM Smart is used for identity verification, record keeping requirements may be met by retaining the specific data or information obtained from iAm Smart through Application Programming Interface, showing the customer’s iAM Smart authentication result and verified Hong Kong Identity Card data. AIs do not need to obtain additional identification documents solely for record keeping purposes.”  

Penalties on Unlicensed Crypto Exchanges, 21 May 2021 

In their report Public Consultation on Legislative Proposals to Enhance Anti-Money Laundering and 

Counter-Terrorist Financing Regulation in Hong Kong, the Financial Services and the Treasury Bureau (FSTB) proposed regulations and penalties on unlicensed virtual asset service providers (VASPs) in line with Financial Action Task Force (FATF) standards. Per the proposals, unlicensed VASPs would be prohibited from actively marketing their services and face a fine of HKD $5,000,000 (approximately USD $644,000) and imprisonment of seven years for conducting a regulated virtual asset activity. Continued offenses would incur a fine of HKD $100,000 (approximately USD $12,900) per day. Non-compliance with AML/CFT requirements; the provision of false, deceptive or misleading statements in a license application; and “fraudulent or reckless misrepresentation for the purpose of inducing another person to acquire or dispose of a VA” will incur a fine of HKD $1,000,000 (approximately USD $129,000) and imprisonment of two years. The Securities and Futures Commission (SFC) would administer the new licensing framework for VASPs. 

Implementation Plan for Phases III and IV for Open Banking API, 13 May 2021

HKMA announced its implementation plan for Phases III (account information) and Phase IV (transactions) of the Open API Framework for the Hong Kong Banking Sector, which was launched in July 2018 to support the safe development and adoption of open banking products and services. The framework’s 28 participating banks will begin to progressively implement Phases III and IV by December 2021, with an initial focus on deposit account information and online merchant payments. The HKMA’s approach centers on minimizing risk and lowering implementation costs. Its document, The Next Phase of the Banking Open API Journey, outlines essential practices in the implementation of Phases III and IV, including the need to:  

“Adopt appropriate risk management strategies

Introduce appropriate protection mechanisms 

  • Design compelling banking API propositions for customers 
  • Understand the range of bank capabilities required 
  • Understand the range of TSP capabilities required 
  • Select one or more appropriate business/finance models  
  • Monitor the banking Open API ecosystem”11

The HKMA will also support the Hong Kong Association of Banks (HKAB) in developing standards regarding customer experience and authentication, technical and data standards, information security and operation standards. The standards and a revised Common Baseline document have an expected publication date of December 2021.

Open Banking and Security: How to Ensure a Safe User Journey

Open Banking and Security: How to Ensure a Safe User Journey

“Security in open banking is a topic that is not focused on often enough. When it comes to open banking, financial institutions usually have their focus on the technical or business possibilities. But data security is just as important – and maybe even more so.”

Learn More

Multiple Central Bank Digital Currency Bridge Project, 23 February 2021  

A joint statement announced the addition of the Central Bank of the United Arab Emirates and the Digital Currency Institute of the People’s Bank of China to the Multiple Central Bank Digital Currency (m-CBDC) Bridge Project, spearheaded by the HKMA and the Bank of Thailand. The project, supported by the Bank for International Settlements Innovation Hub, explores the use of a CBDC and DLT in instantaneous cross-border payments, and investigates scalability, interoperability, privacy and governance. It aims to simplify cross-border fund transfers by lowering costs, reducing inefficiencies and easing the burden of complicated regulatory compliance.  

White Paper on the Value of Regulatory Technology in the Financial Sector, 02 November 2020 

The Hong Kong Monetary Authority published a white paper entitled Transforming Risk Management and Compliance: Harnessing the Power of Regtech, which outlines the state of regtech in Hong Kong banking, alongside actions that the HKMA will take in facilitating its adoption. Regtech solutions can reduce costs, boost efficiency and improve risk management, and they are instrumental in maintaining the competitiveness of Hong Kong’s banking sector. The six main fields in which regtech solutions are applied include regulatory compliance obligations, conduct and consumer protection, regulatory and tax reporting, governance and accountability, risk management and financial crime. Of the banks surveyed for the paper, one-third had already implemented at least one regtech solution, while cost and capabilities constraints have prevented more banks from adopting regtech. The paper reviews the five core areas making Hong Kong a global leader in regtech, which includes boosting awareness, promoting solution innovation, continued regulator engagement with the ecosystem, developing the talent pool and sustaining adoption.

Digital Strategy: Standard Chartered Bank

Digital Strategy: Standard Chartered Bank

Learn why it was important for the bank to deploy an e-signature platform that had strong capabilities such as: notifications, 2FA options, access to APIs for workflow automation, and the adaptability to integrate 3rd party identity providers, e.g. Aadhaar in India and SingPass in Singapore.

Learn More


1. Leung, Kanis. “Hong Kong economy suffers biggest annual contraction on record, shrinking 6.1 per cent as coronavirus hammers tourism, local spending.” South China Morning Post, 29 January 2021. https://www.scmp.com/news/hong-kong/hong-kong-economy/article/3119795/hong-kong-economy-suffers-biggest-annual.

2. Lee, Yen Nee. “Hong Kong’s economy is not out of the woods despite sharp rebound, says commerce secretary.” CNBC, 03 June 2021. https://www.cnbc.com/2021/06/03/hong-kong-economy-commerce-secretary-on-trade-recovery-from-covid.html.

3. Leung, Kanis. “Hong Kong economy grows 7.9 per cent in first quarter, higher than projected.” South China Morning Post, 14 May 2021. https://www.scmp.com/news/hong-kong/hong-kong-economy/article/3133494/coronavirus-hong-kong-economy-grows-79-cent-first.

4. “Hong Kong Budget 2021-22: Blueprint for Economic Recovery.” China Briefing, 10 March 2021. https://www.china-briefing.com/news/hong-kong-budget-2021-22-blueprint-for-economic-recovery/.

5. Alois, JD. “Artificial Intelligence in Banking: Hong Kong Academy of Finance Publishes Report on AI and Fintech.” Crowdfund Insider, 21 August 2020. https://www.crowdfundinsider.com/2020/08/165566-artificial-intelligence-in-banking-hong-kong-academy-of-finance-publishes-report-on-ai-and-fintech/.

6. “Hong Kong’s e-commerce growth will continue beyond COVID-19 pandemic, says GlobalData.” GlobalData, 22 March 2021. https://www.globaldata.com/hong-kongs-e-commerce-growth-will-continue-beyond-covid-19-pandemic-says-globaldata/.

7. “Hong Kong’s Fintech Industry Booms As Consumers Turn To Mobile Solutions.” Forbes, 01 March 2021. https://www.forbes.com/sites/hongkong/2021/03/01/hong-kongs-fintech-industry-booms-as-consumers-turn-to-mobile-solutions/?sh=30e4f6054a6e.

8. Yiu, Enoch. “HKMA piles pressure on small lenders to digitise as Hong Kong’s virtual banks gain traction with customers.” The South China Morning Post, 17 March 2021. https://www.scmp.com/business/banking-finance/article/3125662/hkma-piles-pressure-small-lenders-digitise-hong-kongs.

9. Bower, Matt et al. “A guide to Hong Kong’s cyber security laws and practices.” Allen & Overy. https://www.jdsupra.com/legalnews/a-guide-to-hong-kong-s-cyber-security-1037956/?origin=CEG&utm_source=CEG&utm_medium=email&utm_campaign=CustomEmailDigest&utm_term=jds-article&utm_content=article-link.

10. Tsang, Denise. “Hong Kong closer to launching unprecedented HK$22.4 billion investment vehicle with appointment of top executives.” The South China Morning Post, 30 September 2020. https://www.scmp.com/news/hong-kong/hong-kong-economy/article/3103734/hong-kong-closer-launching-unprecedented-hk224.

11. “The Next Phase of the Banking Open API Journey.” Hong Kong Monetary Authority and Accenture. https://www.hkma.gov.hk/media/eng/doc/key-functions/ifc/fintech/The_Next_Phase_of_the_Banking_Open_API_Journey.pdf.

*DISCLAIMER: This information is OneSpan's interpretation of the compliance requirements as of the date of publication. Please note that not all interpretations or requirements of the applicable laws are well-settled and its application is fact- and context-specific. The information contained in this document should not be relied upon as legal advice or to determine how the law applies to your business or organization. We encourage you to seek guidance from your legal counsel with regard to law applying specifically to your business or organization and how to ensure compliance. This information is provided “as-is” and may be updated or changed without notice. OneSpan does not accept liability for the contents of these materials.

Last updated: November 2021