Since 1 August 2025, issuing a fiat-referenced stablecoin in Hong Kong, or issuing a Hong Kong dollar stablecoin anywhere, has required a licence from the Hong Kong Monetary Authority, and unlicensed issuers face criminal penalties of up to HK$5 million and seven years' imprisonment. The Stablecoins Ordinance (Cap. 656) and the HKMA's Guideline on Supervision of Licensed Stablecoin Issuers set detailed rules on reserves, redemption, capital, risk management, private key custody, smart contract audits and outsourcing. The HKMA granted the first two licences on 10 April 2026. This guide is for compliance, risk, security and technology leaders at prospective issuers, banks, virtual asset platforms and their service providers. It covers scope, the key obligations, the timeline, enforcement and the security and identity controls the guideline expects. Facts were checked on HKMA and Legislative Council pages on 8 November 2026. For the EU and US equivalents see the MiCA and DORA for Crypto-Asset Service Providers Guide and the GENIUS Act Stablecoin Guide.
Key takeaways
- Licence first, then issue: issuing a specified stablecoin in Hong Kong, or issuing one outside Hong Kong that references the Hong Kong dollar, is a regulated stablecoin activity requiring an HKMA licence; actively marketing such activity to the Hong Kong public counts as holding out.
- Full reserves, redeemable at par within one business day: reserve assets must at all times be worth at least the par value of coins in circulation, be segregated, and held in high-quality liquid assets; valid redemption requests are processed within one business day.
- HK$25 million minimum paid-up capital: plus liquid net assets funded by equity, quarterly stress testing and a three lines of defence risk structure.
- Prescriptive key and smart contract controls: significant private keys must be generated and stored offline in air-gapped hardware security modules in Hong Kong (or an HKMA-acceptable location), with multi-signature for high-risk operations and smart contract audits at least annually and on every upgrade.
- Retail access is restricted: only licensed issuers and named categories of permitted offerors may offer specified stablecoins to the public; stablecoins from unlicensed issuers may only be offered to professional investors.
Scope: who and what is covered
According to the Legislative Council papers on the Stablecoins Bill, a person needs a licence from the Monetary Authority to carry on, or hold out as carrying on, a regulated stablecoin activity. The activity covers:
- Issuing a specified stablecoin in Hong Kong in the course of business.
- Issuing a specified stablecoin outside Hong Kong in the course of business where it purports to maintain a stable value with reference wholly or partly to the Hong Kong dollar.
- Other activities the Monetary Authority specifies by notice in the Gazette after consulting the Financial Secretary.
A specified stablecoin is one referenced wholly to one or more official currencies, specified units of account or stores of value, or a combination, plus other digital representations of value the Monetary Authority specifies. Holding out means actively marketing to the Hong Kong public that a person carries on the activity, so an overseas issuer that targets Hong Kong users can be caught.
Who may offer stablecoins to the public
| Party | Position under the regime (per the Bills Committee report) |
|---|---|
| Licensed stablecoin issuer | May issue and offer its stablecoins |
| Authorized institution (bank) under the Banking Ordinance (Cap. 155) | Permitted offeror |
| Virtual asset trading platform licensed by the SFC | Permitted offeror |
| Corporation licensed by the SFC for Type 1 (dealing in securities) | Permitted offeror |
| Stored value facility licensee | Added by amendment; needs the Monetary Authority's prior express approval before offering |
| Any offeror of a stablecoin not issued by a licensee | May offer only to professional investors, with a clear indication that it is not issued by a licensed issuer |
The HKMA also warns that holders of stablecoins from unlicensed issuers bear the risk themselves, and that falsely claiming to be a licensee or an applicant is an offence.
Key obligations
The Ordinance sets minimum criteria in Schedule 2, and the HKMA's Guideline on Supervision of Licensed Stablecoin Issuers explains how they are met. Paragraph numbers below refer to the guideline.
| Area | Requirement | Reference |
|---|---|---|
| Reserve backing | Market value of reserves at all times at least equal to par value of outstanding stablecoins; over-collateralisation expected; reconciliation required | Sch. 2 s.5(2); para 2.2.1 |
| Eligible reserve assets | Cash; bank deposits of up to 3 months; marketable debt securities with residual maturity of no more than 1 year; overnight reverse repos; dedicated investment funds; other assets the HKMA accepts | Para 2.3.1 |
| Currency | Reserves in the referenced currency unless the HKMA approves otherwise | Para 2.4.1 |
| Segregation and trust | Reserves segregated per stablecoin and from the issuer's own assets; trust arrangement supported by an independent legal opinion; custody with licensed banks or acceptable custodians | Paras 2.5.1, 2.5.2, 2.5.4 |
| No interest | No interest or interest-like payments to holders | Sch. 2 s.15; para 2.6.1 |
| Reserve disclosure and attestation | Daily reserve statements; weekly reporting to the HKMA; independent external auditor attestation covering the last business day and at least one randomly selected business day, submitted within one month and published | Paras 2.7.2, 2.7.3 |
| Redemption | Holders can redeem at par; valid requests processed within one business day; fees no more than reasonable; terms published | Paras 3.3.1, 3.3.3 to 3.3.5, 3.6.1 |
| White paper | A white paper for each type of stablecoin issued | Sch. 2 s.13(1) |
| Capital | Paid-up share capital of at least HK$25,000,000 (or HKMA-approved equivalent); sufficient liquid net assets funded by equity | Paras 5.1.1, 5.2.1 |
| Fit and proper | Chief executive, directors, stablecoin manager and controllers fit and proper; managerial changes notified within 14 days | Sch. 2 s.7(2); paras 7.2.2 to 7.2.7 |
| Risk management | Three lines of defence; credit, liquidity and market limits; stress testing at least quarterly reported to the Board and HKMA | Paras 6.2.3, 6.4.2 to 6.4.7 |
| AML/CFT | Customer due diligence and AML/CFT risk management under the separate HKMA AML/CFT guideline for licensed stablecoin issuers | Paras 3.5.1, 6.3.1 |
Technology risk and cyber security
Section 6.5 of the guideline is unusually specific for a financial regulator, and most of it concerns identities and keys rather than networks.
| Control area | What the guideline expects | Paragraph |
|---|---|---|
| Token documentation | Documented token standards, distributed ledgers and smart contract architecture | 6.5.2 |
| Privileged operations | Authorisation proportionate to risk; high-risk operations (such as minting and burning) need controls like multi-signature so no single party can act alone | 6.5.3 |
| Smart contract audits | Qualified third-party audit at least annually and on any deployment, redeployment or upgrade | 6.5.5 |
| Significant seeds and private keys | Keys for contract deployment, role management and large-scale minting or burning: offline air-gapped generation; air-gapped storage in HSMs in Hong Kong or an HKMA-acceptable location; direct physical presence for use; backups in multiple secure locations in Hong Kong; HKMA informed when recovery is triggered; logs across the full key lifecycle | 6.5.7 |
| Customer accounts | Transfers only to pre-registered accounts and wallets in the customer's name; two-factor authentication expected | 6.5.9, 6.5.10 |
| Incident response and recovery | Detect, contain and restore within recovery time objectives; IT disaster recovery plan | 6.5.19, 6.5.20 |
| Technology outsourcing | Critical technology services outsourced only after an independent assessment against recognised standards, shared with the HKMA | 6.5.22 |
Outsourcing, continuity and exit
- Licensee stays responsible: risk assessment and due diligence before engaging a provider, with contingency arrangements; the licensee remains solely responsible for its obligations (paras 6.6.2 to 6.6.4).
- Contract terms: performance standards, subcontracting, contingency, termination, record access and data handling (para 6.6.5), and no impediment to HKMA or auditor access (para 6.6.7).
- Board-approved plans: incident management framework, business continuity plan and exit plan approved by the Board, reviewed at least annually and after activation, and tested at least annually (paras 6.8.1, 6.8.18, 6.8.19).
- Redemption under stress: delaying redemption beyond one business day needs the Monetary Authority's written consent before it is implemented (para 6.8.21).
Timeline and current status
| Date | Event | Source |
|---|---|---|
| 12 March 2024 | HKMA launches the stablecoin issuer sandbox arrangement | HKMA |
| 18 July 2024 | Sandbox participants announced | HKMA |
| 29 July 2025 | HKMA publishes consultation conclusions, the supervision and AML/CFT guidelines, and explanatory notes on licensing and on transitional provisions for pre-existing issuers | HKMA and Hong Kong Government press releases |
| 1 August 2025 | Stablecoins Ordinance (Cap. 656) commences; guidelines gazetted | HKMA |
| 31 August 2025 | Deadline for interested parties to contact the HKMA | HKMA press release |
| 30 September 2025 | Deadline for applications seeking early consideration | HKMA press release |
| 10 April 2026 | First licences granted to Anchorpoint Financial Limited and The Hongkong and Shanghai Banking Corporation Limited, effective that day | HKMA press release |
As of 8 November 2026, the HKMA describes licensing as an ongoing process and maintains a public Register of Licensed Stablecoin Issuers; check the register for the current list rather than relying on any published count. The first licensees said they planned to launch within a few months of April 2026. Pre-existing issuers were covered by transitional provisions explained in a separate HKMA note; their detail is not summarised here because the note could not be checked.
Enforcement and penalties
Maximum penalties below are as described in the Legislative Council papers on the Bill. Section numbers in the enacted Ordinance may differ from the Bill clause numbers, so confirm against Cap. 656 on Hong Kong e-Legislation.
| Breach | Summary conviction | Conviction on indictment |
|---|---|---|
| Carrying on or holding out as carrying on a regulated stablecoin activity without a licence; offering a specified stablecoin when not permitted | Fine of HK$500,000 and 2 years' imprisonment; further HK$10,000 per day for continuing offences | Fine of HK$5,000,000 and 7 years' imprisonment; further HK$100,000 per day for continuing offences |
| Advertising offences | Fine at level 5 (HK$50,000) and 6 months' imprisonment | Not stated in the papers |
- Civil sanctions: the Monetary Authority can impose a pecuniary penalty of up to HK$10,000,000 or three times the profit gained or loss avoided, whichever is greater.
- Investigation powers: investigators can require records, documents and answers verified by statutory declaration.
- Statutory manager: after consulting the Financial Secretary, the Monetary Authority can direct that a licensee's affairs be managed by a statutory manager, for example where it is likely to become unable to meet its obligations.
- Immediate reporting: reserve breaches, unresolved reconciliation discrepancies and redemption breaches must be reported to the HKMA immediately (paras 2.7.5, 3.6.3).
What it means for AI agents and non-human identities
The guideline's heaviest controls fall on non-human identities: the private keys, signing services and smart contract roles that mint, burn and administer the token. Treat these as the most privileged identities in the organisation.
- Minting and admin keys: map every key and smart contract role (owner, minter, pauser, upgrader) to an owner, a custody method and a multi-signature policy. Paragraph 6.5.7 effectively rules out hot, cloud-hosted single keys for significant operations. See the HSM Deployment and Operations Guide and the Multisig Treasury Operations Guide.
- Service accounts in the redemption path: the systems that check reserves, approve redemptions and send payments run on service accounts and API credentials; they need least privilege, rotation and monitoring like any payment system. See the API Key Management Guide.
- Automated agents: if AI agents or bots initiate treasury, monitoring or customer operations, they must not hold keys that bypass the multi-signature and physical-presence controls the guideline expects. See the AI Agents with Crypto Wallets Security Guide.
- Provider identities: custodians, technology providers and smart contract auditors given access to production systems are third-party identities subject to the outsourcing rules in section 6.6.
Compliance steps
- Confirm scope: decide whether your activity is issuing in Hong Kong, issuing a Hong Kong dollar referenced stablecoin abroad, offering to Hong Kong users, or none of these; record the legal analysis.
- Gap-assess against the guideline: walk paragraphs 2 (reserves), 3 (issuance and redemption), 5 (financial resources), 6 (risk, technology, outsourcing, incidents) and 7 (governance) and record evidence for each.
- Design reserve operations: trust structure with legal opinion, custodians, daily reconciliation, weekly HKMA reporting and auditor attestation.
- Build key custody: air-gapped HSM-based generation and storage in Hong Kong, multi-signature for high-risk operations, ceremonies with physical presence, backups at multiple Hong Kong sites, lifecycle logging. See the Cryptographic Key Management Guide.
- Commission smart contract audits before deployment and schedule annual and upgrade-triggered audits.
- Prepare AML/CFT controls under the HKMA AML/CFT guideline, including customer due diligence at issuance and redemption, and align with travel rule processes. See the Crypto Travel Rule Compliance Guide.
- Assess technology providers independently and share results with the HKMA; put section 6.6.5 terms in contracts.
- Approve and test incident, continuity and exit plans at Board level, including a redemption run scenario.
- Engage the HKMA early and check the register and HKMA publications for changes before filing.
Detection and measurement
| Metric | Target or signal |
|---|---|
| Reserve coverage ratio (reserves at market value / par value outstanding) | Never below 100%; daily |
| Redemptions completed within one business day | 100%, with exceptions only under written consent |
| Privileged key operations with full multi-signature approval and log | 100% |
| Smart contract versions in production with a current third-party audit | 100% |
| Critical technology providers with an independent assessment shared with the HKMA | 100% |
| Stress tests completed per quarter | At least one, reported to the Board |
Monitor on-chain events for mint, burn, role change and contract upgrade transactions and reconcile them against approved requests. See the On-Chain Monitoring Guide.
Common failure patterns
- Treating "holding out" narrowly: an overseas issuer markets to Hong Kong users through local channels without a licence.
- Single-key administration: one deployer or owner key controls upgrades or minting, contrary to multi-signature expectations.
- Audits that stop at launch: upgrades deployed without a fresh third-party audit.
- Reserve reporting by spreadsheet: reconciliation gaps go unreported instead of being raised with the HKMA immediately.
- Untested exit and redemption plans: plans exist on paper but have never been exercised under a run scenario.
Practitioner checklist
- Scope analysis documented, including Hong Kong dollar referencing and marketing to Hong Kong users.
- Paid-up capital of at least HK$25 million and equity-funded liquid net assets confirmed.
- Reserve trust, custody, daily reconciliation, weekly reporting and auditor attestation in place.
- Redemption at par within one business day tested end to end.
- Inventory of keys and smart contract roles with owner, custody and multi-signature policy.
- Significant keys generated and stored offline in HSMs in Hong Kong or an accepted location, with Hong Kong backups.
- Smart contract audit schedule (annual and on every deployment or upgrade).
- AML/CFT programme aligned with the HKMA guideline for licensed stablecoin issuers.
- Critical technology providers independently assessed; contracts carry section 6.6.5 terms.
- Incident, continuity and exit plans Board-approved and tested annually.
Standards and references
- HKMA: Regulatory regime for stablecoin issuers
- HKMA: Guideline on Supervision of Licensed Stablecoin Issuers
- HKMA: Granting of stablecoin issuer licences
- HKMA: Press release on guidelines and explanatory notes for stablecoin issuers
- Hong Kong Government: Press release on the stablecoin issuer regime
- Legislative Council: Report of the Bills Committee on Stablecoins Bill
- Legislative Council: Legal Service Division report on Stablecoins Bill
Related NHI Mgmt Group resources: MiCA and DORA for Crypto-Asset Service Providers Guide · GENIUS Act Stablecoin Guide · Stablecoin Security and Risk Guide · Hong Kong PDPO Guide. This guide summarises the Hong Kong Stablecoins Ordinance (Cap. 656) and HKMA guidance and is not legal advice.