Operating a digital-asset business in Hong Kong without properly structured payment service agreements exposes the enterprise to frozen fiat rails, enforcement action and the loss of banking relationships that can take years to rebuild. A PSP and acquiring agreement (the contractual framework that enables a business to accept card payments, receive fiat settlements and process customer funds) sits at the intersection of the Hong Kong Payment Systems and Stored Value Facilities Ordinance regime, the Securities and Futures Commission (SFC) licensing requirements for virtual-asset trading platforms, and the Travel Rule (the obligation to pass originator and beneficiary data with a transfer). Getting the contract structure wrong – or launching without the right underlying licence – can terminate the business relationship before a single transaction settles. This page explains how PSP and acquiring agreements work for digital-asset businesses in Hong Kong, what regulators now expect, and where the cross-border complications arise.
What is the regulated basis for payment services in Hong Kong?
Hong Kong payment services are regulated under the Payment Systems and Stored Value Facilities Ordinance, administered by the Hong Kong Monetary Authority (HKMA), which also sets out the licensing regime for stored-value facility (SVF) operators and designated retail payment systems. For digital-asset businesses, a second layer applies: the SFC's VASP licensing regime for virtual-asset trading platforms (VATP) imposes conduct and client-money requirements that directly shape the terms a PSP or acquirer will accept. The two regimes do not operate in isolation. A business that holds client fiat while matching crypto orders is simultaneously subject to HKMA expectations on payment flows and SFC expectations on custody and safeguarding. Any PSP onboarding that fails to account for both regulators creates structural gaps that emerge, almost invariably, at the worst moment – during a compliance review or a client dispute.
The regulatory picture has sharpened considerably since the SFC opened its VATP licensing window. Banks and licensed payment institutions now apply their own overlay of internal policy on top of the statutory requirements. That means a formal licence is necessary but not sufficient: the business must also be able to demonstrate, in contractual terms, that its settlement model, client-money flows and AML/CFT controls are consistent with what the PSP's own compliance function will accept.
In our practice, we have seen institutions turn down well-capitalised applicants because the PSP agreement template they presented treated crypto settlement flows as generic merchant payments. The solution is almost always to engage the PSP's legal and compliance teams with jurisdiction-specific documentation that maps each payment type to the applicable regulatory permission.
For a first read of your Hong Kong payment structure, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity structure, the user geography and the fiat settlement model – change the analysis meaningfully.
Who needs a PSP and acquiring agreement in Hong Kong?
Any digital-asset business that accepts fiat from clients, settles trades in fiat, or enables customers to fund accounts via card or bank transfer needs a PSP and acquiring relationship. In Hong Kong, this includes licensed VATPs, over-the-counter crypto desks, digital-asset custodians that offer fiat redemption, and token issuers running primary-sale processes. It also extends to crypto fund administrators that handle subscription and redemption flows in Hong Kong dollars or other currency. The scope is broader than many operators assume. A business that uses a third-party payment processor without a properly documented agreement risks operating as an unlicensed stored-value facility or, in cross-border scenarios, as an unregistered money service operator.
Foreign businesses entering Hong Kong face an additional layer. Operating through a Hong Kong subsidiary that holds a VASP registration does not automatically entitle the parent entity to use the subsidiary's PSP relationship for global settlement. The acquiring agreement must specify the legal entities that are party to each payment flow, the jurisdictions in which transactions originate, and the currencies involved. Where the parent sits in a different regulatory jurisdiction – say, a Singapore-licensed Digital Payment Token service provider or an EU CASP authorised under MiCA – the PSP will expect evidence that the cross-border arrangement does not create unregistered payment service activity in Hong Kong.
How does the PSP onboarding process work for a digital-asset business?
PSP onboarding for a digital-asset business in Hong Kong follows a structured diligence process that differs materially from standard merchant onboarding. The acquiring institution conducts a multi-stage review covering corporate structure, beneficial ownership, licensing status, AML/CFT programme quality, and the nature of the transaction flows the agreement will cover. The process is driven by the PSP's own risk appetite, the HKMA's supervisory expectations, and, for card scheme agreements, the scheme rules of Visa, Mastercard or UnionPay.
The typical stages are as follows. First, the applicant submits a business questionnaire covering entity structure, jurisdictions served, licence copies and AML policy documentation. Second, the PSP's financial crime compliance team reviews the KYB (know your business) package; for crypto businesses this review is almost always escalated to a specialist financial-crime unit, adding time to the process. Third, the PSP's legal team negotiates the acquiring agreement, which for a VATP will typically include enhanced transaction-monitoring clauses, a right to require the business to implement additional controls at short notice, and a termination-for-regulatory-change provision. Fourth, the card scheme or payment network separately approves the merchant category code assignment. Fifth, the parties execute the agreement and a technical integration phase begins.
Timelines vary by institution and by the completeness of the submission. In our experience, a well-prepared submission for a licensed VATP can move through internal diligence in a matter of weeks; under-prepared submissions can stall in the financial-crime review stage for months, or result in a quiet decline. Operators we advise routinely underestimate the quality of documentation the PSP expects at first submission – particularly the adequacy of the AML/CFT programme, the Travel Rule compliance framework, and the client-money safeguarding model.
What do PSP and acquiring agreement terms cover for crypto businesses?
The commercial and legal terms of a PSP or acquiring agreement for a digital-asset business are more demanding than those offered to conventional merchants, and the negotiation points are substantive. Key provisions include settlement currency and frequency, chargeback liability allocation, reserve requirements, termination triggers linked to regulatory events, data-sharing obligations under the Travel Rule, and the scope of the indemnity for losses arising from crypto-specific fraud.
Settlement terms deserve particular attention. A standard merchant acquiring agreement settles net proceeds daily or weekly. For a VATP, the PSP may impose a longer settlement cycle to accommodate chargeback risk, may denominate the reserve in a stable currency (which creates FX exposure), and may include a right to withhold settlement if the business's regulatory status changes. These provisions are negotiable, but only if the business enters the negotiation with a clear understanding of the HKMA and SFC expectations that underpin them.
Termination provisions are a critical risk point. Several standard PSP agreements contain clauses that permit termination on short notice if the business becomes subject to regulatory investigation, if a licence is suspended, or if the acquiring institution's internal policy on crypto risk is revised. A business that has onboarded hundreds of clients and is processing material volume can find its fiat rails closed within days under such a clause. Negotiating a cure period, a transition assistance obligation and a proportionality test into the termination provision is a material commercial protection that we routinely seek for clients.
Data obligations under the Travel Rule also appear in modern acquiring agreements for crypto businesses. The Travel Rule requires a VASP to collect and transmit originator and beneficiary information on virtual-asset transfers above a de-minimis threshold, which varies by jurisdiction and is subject to HKMA guidance. A PSP that acts as an intermediary in a chain involving both fiat and crypto legs will want contractual certainty that the VATP is meeting its Travel Rule obligations, because the PSP's own AML compliance function is reviewed by the HKMA on a consolidated basis.
How does the Hong Kong agreement interact with a cross-border structure?
For a digital-asset business with operations in multiple jurisdictions, the Hong Kong PSP and acquiring agreement is one layer of a multi-jurisdictional payment stack that must be designed to function consistently. A VATP licensed in Hong Kong and operating a parallel entity in Singapore under the Monetary Authority of Singapore (MAS) Payment Services Act, or in the EU under the MiCA CASP regime, will face a PSP that wants to understand which entity is the contractual counterparty for each payment flow, and where the AML/CFT programme of record sits.
The cross-border complication intensifies around client-money safeguarding. SFC conduct requirements for licensed VATPs impose specific safeguarding standards for client assets held in Hong Kong. Where a client's fiat is swept to a parent entity or a treasury vehicle in another jurisdiction before settlement, the acquiring bank in Hong Kong may treat that sweep as a payment to a third party and apply enhanced due diligence or a separate fee schedule. The PSP agreement must be drafted to accommodate the treasury architecture, not the other way around.
Banking de-risking adds a further dimension. Regulators in the leading hubs – including the HKMA – have published guidance noting that blanket de-risking of crypto businesses is not a compliant approach to risk management. In practice, however, individual institutions continue to apply conservative internal policies, and a business that has had a PSP relationship closed in one jurisdiction will face heightened scrutiny when onboarding in Hong Kong. The drafting history, the reason for the prior termination, and the compliance improvements made since then are all material to the new PSP's diligence file.
In a recent cross-border matter, an exchange operator structured across Hong Kong and a Gulf free zone found that its Hong Kong acquiring agreement was being used by the Gulf PSP as a reference document for its own KYB review. The two agreements contained inconsistent representations about the scope of the business's AML programme. We were engaged to harmonise the compliance documentation across both entities, producing a single group-level AML framework that each local PSP could reference consistently. The process resolved the onboarding impasse within a short period and the acquiring relationships were established in both jurisdictions.
What mistakes lead to PSP rejection or account closure?
The most common reason a digital-asset business fails to complete PSP onboarding in Hong Kong is a mismatch between the regulatory claims made in the application and the documentation provided to support them. A business that describes itself as a "licensed VATP" but holds only a provisional approval, or that operates services in jurisdictions where it has no licence, will be identified during KYB and the application will stall or be declined. The second most common reason is an AML/CFT programme that is adequate on paper but cannot be evidenced in operation – no transaction monitoring records, no risk-rating rationale for high-risk clients, no Travel Rule implementation for virtual-asset transfers.
A third category of error is commercial: the business presents a generic merchant service agreement template to a specialist PSP, or fails to engage the PSP's legal team early in the negotiation. PSPs that service crypto businesses have invested in specialist legal resources; they will not adapt their position to a counterparty that cannot engage at the same level.
Account closure after successful onboarding follows a similar pattern. The most frequent trigger is a regulatory event – a change in the business's licence status, an enforcement action against a related entity, or a change in the PSP's own risk appetite following a regulatory communication from the HKMA. A close second is a spike in chargeback rates or fraud patterns that trigger the PSP's automated monitoring. The contractual provisions discussed above – cure periods, transition assistance and proportionality tests – are the primary protections against sudden closure.
A common assumption in the market is that a single offshore entity with a single licence is sufficient to operate globally and to support a single PSP relationship. That assumption is incorrect. PSPs in Hong Kong will scrutinise the jurisdictions from which clients are onboarded, the currencies in which settlement is requested, and the regulatory permissions held in each relevant jurisdiction. Operating through a single offshore licence without local permissions in the jurisdictions where clients actually sit creates enforcement exposure in those jurisdictions and makes the PSP's own compliance position untenable.
If a prior PSP application stalled or an account was closed, a second structural review can surface the reason and the route back. Write to OBOLUS at info@oboluslaw.com. A second read regularly surfaces the structural gap that the first submission missed.
How should an operator decide on the right PSP structure for Hong Kong?
The right PSP and acquiring structure for a Hong Kong digital-asset business turns on four variables: the regulatory permissions already held, the payment types and currencies needed, the jurisdictions from which clients are onboarded, and the treasury model. A structured decision process should work through each variable before approaching any PSP.
Profile A is the licensed VATP seeking a primary acquiring relationship for fiat-funded client accounts in Hong Kong dollars and major fiat currencies. The instrument here is a direct acquiring agreement with a licensed bank or payment institution that has a specialist crypto desk. The process is the most demanding in terms of diligence documentation but produces the strongest and most durable commercial outcome. The key risk is timeline: a well-prepared application still requires weeks of financial-crime review, and the negotiation of bespoke contract terms adds further time.
Profile B is the foreign-licensed operator – an EU CASP, a Singapore DPT service provider, or an ADGM-regulated entity – seeking a Hong Kong PSP relationship to support local client onboarding. The instrument here is typically a payment agent or sub-acquiring arrangement with a Hong Kong licensed entity, or a direct application to a PSP that has a cross-border service model. The key risk is regulatory characterisation: the arrangement must not constitute unlicensed payment service activity in Hong Kong, and the PSP's legal team will require a legal opinion to that effect. We map the licence, banking and tax stack for cross-border builds of this kind before any approach to a PSP.
Profile C is the early-stage token issuer or crypto desk operating at lower volume, seeking a payment processing solution rather than a full acquiring relationship. The instrument is an aggregated payment service through a specialist EMI or payment institution that already holds the relevant Hong Kong permissions. The diligence bar is lower, but the commercial terms – including settlement cycles and reserve requirements – reflect the aggregator model, and the contractual protections available to the business are narrower.
In each profile, the decision on entity structure, the choice of PSP counterparty and the negotiation strategy for the acquiring agreement should be set before any formal approach is made. A poorly structured first approach to a PSP can close that institution as an option and increase scrutiny at competitors.
Self-assessment checklist before approaching a PSP in Hong Kong
Before submitting a PSP onboarding application, an operator should be able to answer yes to each of the following questions. Does the entity hold, or have a credible path to, the HKMA and SFC permissions required for the payment flows contemplated? Is the corporate structure documented in a way that clearly shows beneficial ownership and the relationship between each entity in the group? Is the AML/CFT programme written, implemented and evidenced in operation – not merely drafted? Does the Travel Rule compliance framework cover all virtual-asset transfer legs that are connected to fiat settlement flows? Are the jurisdictions from which clients are onboarded accurately reflected in the business description, and does the operator hold the necessary local permissions in each? Has the operator reviewed the PSP's standard agreement and identified the provisions that require negotiation before execution? Is there a qualified legal adviser who can engage the PSP's legal team with jurisdiction-specific analysis of the SFC and HKMA requirements?
If any of these questions cannot be answered with confidence, the application is likely to stall in financial-crime review. The investment in preparation – correct entity structure, a complete compliance programme, and a properly negotiated agreement – is substantially less than the cost of a failed onboarding process or a subsequent account closure.
To map the licence, banking and payment stack for your Hong Kong build before you approach a PSP, write to OBOLUS at info@oboluslaw.com or message us via t.me/oboluslaw.
Related at OBOLUS
- Banking, Payments and EMI Onboarding for Digital-Asset Businesses – structuring fiat rails, PSP agreements and EMI onboarding across jurisdictions
- Corporate Bank Account Opening in ADGM, Abu Dhabi – the FSRA-regulated process for digital-asset businesses seeking Gulf banking
- Utility Token Legal Opinion in Liechtenstein – classification analysis for token issuers in a leading European digital-asset regime
FAQ
Why do banks close crypto company accounts?
Banks close crypto company accounts when the business's risk profile exceeds the institution's internal risk appetite or when the AML/CFT controls presented at onboarding cannot be evidenced in ongoing operation. Common triggers include a change in regulatory status, elevated chargeback or fraud rates, an enforcement action against a related entity, or a revision to the institution's own crypto risk policy. In Hong Kong, HKMA guidance discourages blanket de-risking, but individual institutions retain wide discretion in applying their own standards. A robust compliance programme, properly documented and consistently operated, is the primary protection against closure.
How can a VASP onboard with an EMI?
A VASP (virtual asset service provider) seeking to onboard with an EMI (electronic money institution) must demonstrate that its regulatory permissions, AML/CFT programme and client-money controls meet the EMI's own compliance requirements and those of its home regulator. In practice this means providing a corporate structure chart, all relevant licence copies, an AML/CFT policy, Travel Rule implementation evidence, and, for cross-border flows, legal analysis of the jurisdictions in which clients are onboarded. EMIs that service VASPs apply enhanced due diligence, and the onboarding process typically takes longer than for conventional merchants. Preparation quality is the single most important factor in outcome.
What does client-money safeguarding require?
Client-money safeguarding under the SFC regime for licensed virtual-asset trading platforms in Hong Kong requires that client assets – both fiat and virtual assets – be held separately from the firm's own assets, in identifiable accounts or wallets, and subject to daily reconciliation. The acquiring or PSP agreement must be consistent with this requirement: a provision that allows the PSP to set off client settlement proceeds against the business's own obligations to the PSP would breach the safeguarding standard. Operators should ensure that legal review of the PSP agreement expressly covers client-money compliance before execution.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70-plus jurisdictions, on disputes and on-chain asset recovery across 25-plus forums, and on the tax, banking and compliance that sit around them. We map the licence stack across operating, custody and payment layers before our clients commit to a structure – and digital assets are the entirety of our practice. To discuss your PSP, banking or payment structure, contact info@oboluslaw.com.
By Victor Olsen, Regulatory and Compliance Analyst – specialising in payment services regulation, VASP licensing and cross-border compliance programme design for digital-asset businesses.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.