Token issuers and fund managers expanding into Asia increasingly treat Hong Kong as the gateway for real-world asset tokenization – the process of representing legal claims over physical or financial assets, such as real estate, private credit or infrastructure debt, as programmable digital tokens on a public or permissioned blockchain. The question is rarely whether tokenization is possible. It is whether the token, the issuance structure and the secondary-market activity sit inside the Securities and Futures Commission (SFC) regulatory perimeter – and what that means for an inbound operator.
Under Hong Kong's securities regime, a tokenized security (a digital token representing an interest that constitutes a "collective investment scheme" or a traditional security) triggers the same licensing obligations as its analogue counterpart. The SFC has made that position explicit through successive circulars. A token's form does not alter its legal substance. This guide maps the classification test, the licence route, the cross-border structuring considerations and the practical steps a business must complete before a tokenized-asset product goes live in or from Hong Kong.
What is a tokenized real-world asset under Hong Kong law?
A tokenized real-world asset (tokenized RWA) is a digital representation of a legally enforceable interest in an underlying asset, with the token's ownership and transfer governed by a smart contract (self-executing code on a blockchain that enforces pre-defined rules without intermediaries). Under Hong Kong law, the classification question turns on the rights the token confers, not on its technical form or the label on the offering document.
The SFC applies a substance-over-form analysis. A token that entitles its holder to a share of the income or proceeds of an asset pool is, in all probability, a collective investment scheme interest. A token representing direct ownership of a single asset – say, a fractional interest in a specific property title – may also fall within the securities definition depending on the manner of management and the profit-sharing structure. Operators who assume a utility label on a whitepaper resolves this question are mistaken. That assumption is the single most consequential error we see in inbound tokenization mandates.
The SFC's VASP licensing regime for virtual-asset trading platforms (VATPs) adds a second layer. Secondary trading of tokenized securities on a platform that operates in Hong Kong requires the platform to hold the appropriate SFC authorisation. Structuring the primary issuance correctly but distributing through an unlicensed venue creates regulatory exposure at the secondary-market stage.
How does the SFC classify tokenized assets?
The SFC classification framework treats a token as a security if it falls within the existing definition under the Securities and Futures Ordinance, applying that definition to the bundle of rights the token confers. Classification is not a one-time event. It is a continuing assessment that must be repeated whenever the token's economics, governance or transfer restrictions change materially.
In our cross-border practice, we use a four-limb analysis. First, does the token represent a financial interest in a shared pool of assets managed by a third party? Second, do holders have a reasonable expectation of profit or income from that management activity? Third, is the management sufficiently centralised that holders cannot meaningfully affect it? Fourth, is the token freely transferable or redeemable in a manner that gives it a market? A strong positive reading on the first three limbs points toward a collective investment scheme; the fourth determines whether secondary-market obligations also apply.
An important cross-border note: an issuer that concludes its token is not a security under its home jurisdiction's law must run a separate analysis against Hong Kong law if it intends to offer or market the token to Hong Kong investors. The SFC's reach extends to conduct occurring outside Hong Kong that is directed at Hong Kong persons. Operators we advise regularly underestimate the extraterritorial scope of this position.
For a scoped classification assessment of your token before launch, contact OBOLUS at info@oboluslaw.com. The process above describes the standard analytical path. Your specific token economics – the voting rights, the income waterfall, the redemption mechanics – change the answer.
What licences are required for RWA tokenization in Hong Kong?
The licence requirement in Hong Kong depends on what the operator does, not merely what the token is. A business involved in tokenized-asset activity may need one or more of: a Type 1 (dealing in securities), Type 4 (advising on securities), Type 6 (advising on corporate finance), or Type 9 (asset management) licence from the SFC, depending on the activities it carries out in connection with the tokenized product.
For a platform that facilitates secondary trading of tokenized securities, the VASP licensing regime for virtual-asset trading platforms applies in parallel. Since the SFC opened the VATP licensing window, platforms seeking to offer retail-accessible tokenized products have faced dual regulation: the securities-regime licences and the VATP authorisation. These are not interchangeable. Operating under one without the other, where both are required, is a criminal offence under Hong Kong law.
A practical note on the banking interaction: licensed SFC entities generally find it easier to establish business accounts with Hong Kong's major banking institutions than unlicensed entities. Tokenized-asset issuers that hold no SFC authorisation but intend to raise capital in Hong Kong will find the banking channel materially constrained. This is a structural consideration that belongs at the design stage, not after a failed account opening.
Step by step: how does an RWA tokenization project reach market in Hong Kong?
Getting a tokenized real-world asset product to market in Hong Kong involves a structured sequence of legal, technical and regulatory steps; skipping any one of them typically causes delays or regulatory exposure at a later stage.
Step 1 – Asset legal audit. Confirm that the underlying asset is capable of being represented by a token. For real estate, this means title verification, encumbrance searches and an assessment of whether local property law permits fractional digital title. For private credit or fund interests, the question is whether the fund documents permit tokenized transfer of limited partnership or note interests.
Step 2 – Token classification opinion. Commission a written legal opinion applying the SFC's substance-over-form test before any offering document is drafted. The opinion must address the VASP regime interaction and the cross-border marketing perimeter. In our practice, this opinion also covers the primary market (offer to investors) and the secondary market (transfer and exchange).
Step 3 – Issuance vehicle and legal wrapper. A Hong Kong Special Purpose Vehicle (SPV) is the most common issuance vehicle, with the underlying asset held by the SPV and the token representing a beneficial interest or a debt instrument. The choice of debt versus equity wrapper affects both the tax treatment and the investor-protection regime applicable at marketing. Allied counsel in the relevant tax jurisdiction should confirm the treatment of distributions to offshore token holders at this stage.
Step 4 – SFC licence application or exemption confirmation. If the token is classified as a security, the issuer or its distributing entity must hold the appropriate SFC Type licence, or the offering must fall within a recognised exemption (typically the professional-investor-only exemption for private placements). The application process involves submitting a detailed business plan, compliance manuals, key-person vetting and, for VATPs, demonstrating adequate technology and cybersecurity controls. Timeline varies by licence type and the SFC's current queue; operators should plan for a period measured in months, not weeks.
Step 5 – Smart-contract audit and documentation. The smart contract governing the token's issuance, transfer restrictions, dividend or interest payments and redemption must be audited by a specialist firm and the audit report disclosed to investors. The legal documentation – offering circular, token purchase agreement, smart-contract specification appendix – must be aligned so that the on-chain behaviour matches the off-chain contractual terms. Divergence between the two creates liability exposure for the issuer.
Step 6 – AML/KYC and Travel Rule integration. Under Hong Kong's anti-money-laundering regime and the requirements applicable to VATPs, token transfers above the applicable threshold must carry originator and beneficiary information – the Travel Rule (the obligation to transmit identifying data with a virtual-asset transfer). The issuance platform must be capable of performing this screening at both primary issuance and any permitted secondary transfer.
Step 7 – Marketing and distribution compliance. All marketing materials directed at Hong Kong investors must comply with the SFC's advertising guidelines and, where the token is a collective investment scheme interest, the authorisation or exemption framework. Cross-border distribution – for example, marketing the token to EU investors simultaneously – requires a separate analysis under MiCA and the applicable national private-placement regimes. We regularly advise on parallel Hong Kong – EU tokenization structures where the same product reaches two regimes in the same offering window.
If your project is at step two or beyond and you need a structural second opinion, write to info@oboluslaw.com or message us via t.me/oboluslaw. If a prior structure was challenged or a distribution channel closed, a fresh review often surfaces the misalignment between the on-chain design and the regulatory position.
How does cross-border structuring affect tokenized RWA projects?
The most consequential cross-border decision for a tokenized RWA project is where the issuance vehicle sits relative to where the investors are and where the underlying asset is located. These three elements rarely align in a single jurisdiction, and the legal risk attaches to each leg separately.
A common structure in our experience places the SPV in Hong Kong or the Cayman Islands, the underlying asset in another jurisdiction (infrastructure assets in Southeast Asia, real estate in mainland China or Australia) and the investor pool across multiple countries. Each leg generates its own regulatory and tax consequences. The Cayman SPV route benefits from an established track record in structured finance but requires CIMA registration under the applicable VASP regime if the token is to be traded. A Hong Kong SPV benefits from the SFC licensing clarity but subjects the issuer to a broader regulatory perimeter.
Tax treatment deserves separate attention. The classification of token distributions as interest, dividends, or income from a trust determines the withholding tax position in the asset's home jurisdiction and the investor's home jurisdiction. Hong Kong itself imposes no capital gains tax and applies profits tax only to Hong Kong-sourced income – features that make it a structurally efficient booking centre for tokenized products generating offshore returns. However, the substance of the arrangement, not its form, determines whether the Hong Kong booking centre analysis holds. Allied counsel in the relevant tax jurisdiction must confirm the treatment before distribution terms are set.
Banking integration is a parallel pressure point. Tokenized-asset issuers need a fiat settlement layer: an account capable of receiving subscription proceeds, paying distributions and processing redemptions in conventional currency. Banks in Hong Kong assess tokenized-asset businesses against enhanced due diligence standards, and the account-opening process for an unlicensed or newly licensed entity can extend materially beyond a standard corporate account opening. In our practice, we have seen issuers whose token documentation and smart-contract audit were complete face unexpected delays at the banking stage because the AML/KYC narrative for the token structure had not been prepared in the form the bank's financial-crime team required.
What is the decision point for a tokenization project choosing Hong Kong?
Hong Kong suits a tokenized-asset project with an identifiable underlying asset, a professional or institutional investor target pool and a need for regulatory legitimacy in the Asia-Pacific corridor. It is not the optimal venue for projects that require retail distribution, rapid time-to-market with minimal regulatory engagement, or assets that cannot withstand a title and valuation audit.
Three operator profiles emerge from the mandates we see. Profile A is the established fund manager adding a tokenized class of an existing product. For this profile, the existing Type 9 licence often covers the new activity, and the primary work is the token classification opinion, the smart-contract documentation and the investor communication. The path is relatively direct – typically a matter of weeks for the legal work, assuming the fund documents already permit digital instruments. Profile B is the inbound operator launching a new tokenized product in Hong Kong with no existing SFC authorisation. This profile requires a full licence application and should plan for a process measured in multiple months. A Cayman or BVI SPV holding the asset, with a Hong Kong licensed distributor accessing the investor pool, is a workable interim structure while the licence application progresses. Profile C is the DeFi-native protocol seeking to tokenize real-world assets and distribute them through an on-chain mechanism. This profile faces the highest regulatory complexity: the SFC applies the same substance-over-form test to on-chain distribution, and an unlicensed automated market-maker route for tokenized securities is not currently permissible under Hong Kong law.
A tokenized private credit structure across two hubs
In a recent mandate, a fund manager domiciled in a common-law offshore centre sought to tokenize a portfolio of Southeast Asian private credit instruments for distribution to institutional investors in Hong Kong and Europe. The initial token design treated the token as a utility instrument, with a whitepaper description that emphasised the technology and omitted a legal analysis of the rights conferred. We conducted a classification review and concluded that the income-sharing and management structure qualified the token as a collective investment scheme interest under the applicable Hong Kong provisions. We restructured the issuance as a Hong Kong-law debt instrument held by an SPV, obtained a legal opinion confirming the Type 1 exemption for the placement agent under the professional-investor exemption, and aligned the smart-contract distribution logic with the off-chain transfer restrictions. The fund manager proceeded to a successful institutional close within the same quarter.
What are the most common classification mistakes in Hong Kong RWA tokenization?
A common assumption among first-time tokenization projects is that a utility label on the whitepaper, or a legal opinion obtained in an offshore jurisdiction, settles the Hong Kong classification question. It does not. The SFC reviews the substance of the rights, not the marketing characterisation, and an offshore legal opinion that does not apply Hong Kong law is not a defence to Hong Kong regulatory action.
A second frequent error is designing the smart contract before completing the legal classification. The order should always be reversed. The smart contract must implement the legal structure, not the other way around. When the technical build precedes the legal analysis, the project either has to re-engineer the contract – a material cost and time delay – or operate with a structure that does not match its regulatory representation.
A third error is treating the primary-market compliance (the offer to investors) and the secondary-market compliance (the platform permitting trading) as separate workstreams with separate counsel. In Hong Kong, these are connected: the SFC's position on secondary trading of tokenized securities is clear, and a primary offering that anticipates secondary liquidity through an unlicensed venue creates exposure at the point of the first secondary transfer.
We assess classification against the substance of rights, not the marketing label, and we structure the smart-contract documentation to implement that analysis. That is the principle that governs every tokenization mandate we take on.
Related at OBOLUS
- DeFi, tokenization and smart-contract law – the full practice area covering token issuance, DeFi structuring and protocol legal frameworks
- DeFi protocol legal structuring under heightened scrutiny – how to build regulatory defensibility into a DeFi protocol from the ground up
- Tax treatment of tokens: practical lessons for boards – a board-level analysis of how token distributions are taxed across the major jurisdictions
FAQ
Can a DeFi protocol be regulated?
Yes. Regulators including the SFC apply a substance-over-form analysis. If a DeFi protocol facilitates activities that constitute dealing in securities, operating an exchange or managing assets – regardless of whether a human intermediary is present – it may fall within the regulated perimeter. The degree of decentralisation matters but does not, by itself, remove regulatory exposure. An operator should obtain a classification opinion before deploying a protocol that interacts with tokenized assets or structured financial products.
What legal wrapper suits a DAO?
No universal answer exists, because the right wrapper depends on the DAO's function, its revenue model and where its participants are located. Common options include a Cayman Foundation Company, a BVI company or a Marshall Islands LLC – each of which offers limited liability while accommodating a token-based governance structure. The wrapper must also address the question of who, legally, is responsible for the DAO's regulatory obligations. In our practice, we map the DAO's activity against the regulatory perimeters in each relevant jurisdiction before recommending a structure.
Who is liable when a smart contract fails?
Liability for a smart-contract failure depends on the cause of the failure and the contractual and regulatory relationship between the parties. If the failure arises from a code defect in a contract deployed by an identifiable issuer, the issuer faces potential liability in contract and, depending on the jurisdiction, in tort. If the failure arises from an oracle manipulation or an external exploit, the analysis shifts to the security of the system design and whether adequate disclosure was made. There is no blanket immunity for on-chain automation. Investors and counterparties retain legal remedies, and operators should ensure the off-chain legal documentation accurately describes the risk of smart-contract failure.
About OBOLUS
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across more than seventy jurisdictions – including the full SFC-regulated spectrum in Hong Kong – on disputes and on-chain asset recovery across more than twenty-five forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We assess token classification against the substance of rights, not the marketing label, and we advise on parallel multi-jurisdictional structures where the same product touches two or more regulatory regimes simultaneously. To discuss your tokenization project, contact info@oboluslaw.com.
By Roman Levitt, Technology & DeFi Counsel – specialist in smart-contract legal structuring, token classification and DeFi protocol compliance across the Asia-Pacific and European regulatory environments.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.