A staking service operating in or from Hong Kong sits at the intersection of securities law, payment regulation, and a rapidly evolving virtual asset trading platform (VATP) licensing regime administered by the Securities and Futures Commission (SFC). The legal classification of the staking product – not its marketing label – determines whether the service requires a licence, triggers securities law obligations, or falls within the SFC's expanding VATP rulebook. Mis-classifying a token can convert a product launch into an unregistered securities offering, with consequences that cascade across licensing, banking, and cross-border distribution.
This guide walks through the regulated basis for staking services under Hong Kong crypto law, the inbound-business process, the cross-border interaction with tax and banking, and the key decision point every operator faces before going live.
What Is a Staking Service Under Hong Kong Law?
A staking service is regulated in Hong Kong by reference to what the staked asset is, what rights the user holds, and whether the operator exercises discretionary control over the staking process. The SFC does not regulate "staking" as a discrete activity. Instead, it looks through the product structure to the underlying asset and the nature of the arrangement.
If the staked token qualifies as a security under the Securities and Futures Ordinance – the governing framework – the operator is offering a collective investment scheme or a managed account, both of which require SFC authorisation. If the staked token is a virtual asset that does not meet the securities definition, the staking service may still be caught as an activity ancillary to a VATP, particularly where the operator pools user assets, exercises discretionary control, or promises a yield.
The principle here is one of substance over form. The SFC has consistently signalled – in circulars and public statements – that a utility label on a whitepaper does not settle legal classification. Rights analysis controls: what does the holder actually receive, and from whom? In our practice advising DeFi operators and centralised exchanges active in Hong Kong, the first question we ask is always about the rights architecture, not the token name.
Does Your Staking Service Require a VATP Licence?
Under the SFC's VATP licensing regime, an operator providing staking as a service alongside trading or custody almost certainly needs a VATP licence if it operates a centralised platform and the staked assets include tokens the SFC has approved for retail. The regime requires operators to be licensed under the applicable VASP provisions before offering services to Hong Kong investors.
Staking-only operators – those that offer no trading function – occupy a more ambiguous position. The SFC has not issued a staking-specific licence category. The analysis turns on whether the staking arrangement constitutes dealing in securities, managing a collective investment scheme, or providing an associated service to a licensed platform.
Three structural features push a staking service toward regulation:
- The operator pools user assets across multiple participants and deploys them collectively.
- The operator exercises discretion over validator selection, restaking, or yield distribution.
- The service promises or implies a fixed or variable yield to participants.
A pure non-custodial staking interface – where the user retains full control of keys and the protocol acts autonomously – sits at the other end of the spectrum. Even there, the SFC's posture toward DeFi legal questions is one of ongoing scrutiny, not a blanket exemption.
The process above describes the standard analytical path. Your facts – the entity structure, the user base, the token list, the banking – change the analysis materially. For a scoped classification review before you commit to a structure, contact OBOLUS at info@oboluslaw.com.
How Does the SFC Classify Staking Tokens?
The SFC applies a substance-over-label test drawn from the structure of the Securities and Futures Ordinance and consistent with how leading common-law jurisdictions approach investment products. A token is a security if it confers rights analogous to a share, a debenture, or an interest in a collective investment scheme – regardless of what the issuer calls it.
For staking services, the critical question is whether the yield-bearing arrangement looks like a managed fund. If an operator:
- collects assets from the public,
- manages those assets with a view to profit, and
- distributes returns to participants
– the arrangement likely constitutes a collective investment scheme under the applicable regime, requiring SFC authorisation regardless of whether the underlying token is itself a security.
A common assumption is that the tokenisation of the staking position changes the legal analysis. It does not. The SFC looks at economic substance. Wrapping a staking position in a smart contract or a DAO structure does not move the arrangement outside the regulatory perimeter if the underlying rights are investment rights.
In our cross-border practice, we regularly advise operators who have structured staking products under a foreign law opinion – often a Cayman or BVI opinion – without mapping the Hong Kong distributional exposure. Distribution to Hong Kong residents or from Hong Kong-based entities triggers the SFC's jurisdiction independently of where the entity sits.
What Is the Inbound Licensing Process for a Staking Operator?
An inbound operator seeking to offer a staking service in or from Hong Kong should work through the following sequence. Each step has a legal basis and a cross-border note.
- Classification analysis. Conduct a formal classification of every staked token and of the staking arrangement itself. This analysis maps each token against the SFC's security definition and the collective investment scheme provisions. The output is a written position that can be shared with the SFC if the operator seeks a no-action or pre-application engagement.
- Entity structure. Determine whether to operate from a Hong Kong entity or from a foreign entity with a local nexus. VATP applicants must be a company incorporated in Hong Kong or a foreign company registered in Hong Kong under the Companies Ordinance. The choice has direct tax and banking consequences.
- Responsible Officer (RO) appointments. The SFC requires at least two SFC-licensed individuals to be appointed as Responsible Officers for each regulated activity. If the inbound operator lacks Hong Kong-licensed personnel, this is frequently the longest lead-time item in the process.
- Application preparation. The VATP application pack includes a detailed business plan, an AML/CFT manual aligned with the applicable VASP provisions, a technology risk assessment, a cybersecurity framework, and a client asset safeguarding plan. For a staking service, the safeguarding plan must address validator key management, slashing risk allocation, and yield distribution mechanics.
- Pre-application engagement. The SFC has encouraged applicants to engage before formal submission. For staking-specific questions – particularly around yield-bearing products and pooled arrangements – pre-application engagement is strongly advisable. The SFC's posture on yield products has shifted; operators should not assume that an approach that was uncontested two years ago remains acceptable.
- SFC review period. The SFC does not publish a fixed timeline for VATP applications. In practice, the review period varies by complexity. Staking services with pooled assets and discretionary management attract closer scrutiny and longer review cycles. Operators should plan for a multi-month process and must not commence regulated activity before the licence is granted.
- Post-licence conditions. Licensed VATPs operating staking services are subject to ongoing conduct requirements: periodic reporting, audit obligations, client disclosure requirements, and AML/Travel Rule compliance. The Travel Rule (the obligation to pass originator and beneficiary data with a transfer) applies to virtual asset transfers above the applicable threshold.
What Are the Cross-Border Tax and Banking Interactions?
Hong Kong's tax environment is territorial. A staking operator structured through a Hong Kong entity is taxed on profits sourced in Hong Kong. Staking rewards and service fees earned from non-Hong Kong sources may fall outside the territorial charge – but the sourcing analysis requires care, particularly where validator nodes, smart contract infrastructure, or user accounts are distributed across jurisdictions.
The interaction between the staking structure and profits tax turns on whether staking rewards constitute income or a capital accretion. Hong Kong does not levy capital gains tax, but the characterisation of staking rewards as revenue receipts or as a return of capital has significant implications for the operator's tax position. The analysis is fact-specific and should not be assumed in either direction.
Banking is a parallel constraint. Hong Kong-licensed banks apply enhanced due diligence to virtual asset businesses. A staking operator – particularly one with pooled user assets – should expect detailed onboarding requirements covering the business model, the source of funds for staked assets, the AML/CFT framework, and the regulatory status of the entity. Operators we advise routinely underestimate the banking timeline. A strong regulatory compliance posture – including a completed VATP application or a formal classification opinion – materially improves the banking conversation.
For operators sitting between Hong Kong and another financial centre – Singapore, Dubai, or the Cayman Islands – the staking entity's location and the location of the regulated activity must be mapped against each jurisdiction's rules. A Hong Kong entity white-labelling a staking product developed by an offshore entity still attracts SFC jurisdiction if the Hong Kong entity is the face of the product to investors.
If a prior application stalled or a banking relationship was closed, a second structural read can surface the cause and the route forward. Write to us at info@oboluslaw.com or message via t.me/oboluslaw.
Which Operator Profile Should Choose Which Structure?
The right structural choice for a Hong Kong staking service depends on the operator's user base, asset list, degree of discretionary control, and cross-border footprint. A decision matrix follows.
Profile A – Centralised exchange adding staking. An established exchange seeking to offer staking on SFC-approved tokens to retail users in Hong Kong needs a VATP licence and must address staking as an ancillary service within its licence scope. The timeline is measured in months. The key risk is that yield products attract additional scrutiny and may require a separate product approval process inside the SFC review.
Profile B – Staking-only operator, custodial. An operator offering custodial staking – holding user keys and deploying assets to validators – without a trading function sits in a gap in the current regime. The SFC has not designated staking-only custody as a standalone regulated activity, but a pooled, yield-bearing arrangement with discretionary management will likely be characterised as a collective investment scheme. This profile should seek a pre-application classification engagement before building the product.
Profile C – Non-custodial staking interface. A protocol or interface that enables users to self-custody and stake autonomously, with no operator control over keys or yield distribution, is the least regulated profile under the current framework. The risk here is residual: the SFC's approach to DeFi legal questions is evolving, and an interface that today looks non-custodial may be re-characterised if the operator retains meaningful control over outcomes. A smart-contract audit combined with a legal analysis of the control architecture is advisable before launch.
Profile D – Foreign operator distributing into Hong Kong. An offshore entity – whether incorporated in the BVI, Cayman, or Singapore – that markets a staking product to Hong Kong investors is subject to SFC jurisdiction even without a local entity. Distribution triggers the regime. This profile requires a Hong Kong regulatory opinion before any investor-facing activity, and ideally a local entity structure if the service is intended to scale in the market.
What Are the Common Mistakes, and How to Avoid Them?
Staking operators in Hong Kong consistently make a small number of structural errors that create significant legal exposure. Avoiding them requires early legal engagement – not a post-launch review.
Mistake 1: Assuming the offshore entity solves the jurisdictional question. A Cayman or BVI entity distributing a staking product to Hong Kong residents or operating from Hong Kong-based personnel is subject to SFC jurisdiction. The SFC looks at where the regulated activity occurs and where the investors are, not only where the entity is incorporated. In our practice, we have seen operators arrive with a Cayman structure and a BVI opinion, neither of which addresses Hong Kong distribution exposure.
Mistake 2: Relying on a utility designation to avoid securities analysis. A common assumption is that labelling a token as a utility token on a whitepaper settles the legal classification. It does not. The SFC applies a rights-based test. A token that confers a yield entitlement, a profit-sharing right, or a governance right over a managed pool will be analysed as a potential security regardless of its label. Classification analysis must be done against the substance of the rights architecture.
Mistake 3: Starting the Responsible Officer process too late. The RO appointment requirement is frequently the longest lead-time item in a Hong Kong VATP application. Finding, onboarding, and obtaining SFC approval for two licensed ROs can take materially longer than preparing the application itself. Operators who start this process at the application stage – rather than at the structuring stage – routinely extend their go-to-market timeline by several months.
Mistake 4: Omitting the Travel Rule from the AML/CFT framework. The Travel Rule applies to virtual asset transfers in Hong Kong. A staking service that moves assets between user wallets, validator addresses, and operator wallets generates Travel Rule obligations. The AML/CFT manual must address this data flow explicitly. An application that omits Travel Rule mechanics will draw a deficiency notice from the SFC.
A Recent Engagement: Staking Reclassification and Pre-Application Positioning
Earlier this year, a token issuer operating a yield-bearing staking product from an offshore entity approached us after receiving informal SFC feedback that its product raised collective investment scheme concerns. The operator had launched on the basis of a foreign utility opinion and had not conducted a Hong Kong-specific classification analysis. We conducted a full rights-based classification review, restructured the staking arrangement to remove the operator's discretionary control over validator selection and yield distribution, and prepared a pre-application position paper for submission to the SFC. The SFC's subsequent engagement was materially more constructive. The operator is now progressing a VATP application with the staking service reframed as a non-discretionary, user-directed function. No regulatory action was taken during the restructuring period.
Related at OBOLUS
- DeFi, tokenization and smart-contract law for digital-asset businesses – our practice overview for operators at the frontier of on-chain legal questions.
- Oracle and data feed liability for established operators – legal risk analysis for operators whose products depend on external data inputs.
- UAE (VARA/Dubai) vs British Virgin Islands – where to licence – a comparative analysis for operators weighing offshore and onshore structures.
FAQ
Can a DeFi protocol be regulated?
Yes – the SFC and other leading regulators assess DeFi protocols by substance, not form. A protocol that performs a regulated function (dealing in securities, managing a collective investment scheme, operating a trading platform) may attract regulatory obligations even if it operates via smart contract. The key question is whether any identifiable party exercises meaningful control over the protocol's outcomes or the users' assets. Fully autonomous, non-custodial protocols with no controlling party present a genuinely different analysis, but that threshold is difficult to meet in practice.
What legal wrapper suits a DAO?
No single legal wrapper universally suits a DAO (decentralised autonomous organisation). Common approaches include a Marshall Islands DAO LLC, a Cayman foundation company, a BVI company, or a Swiss association – each carrying different liability, governance, and tax profiles. The right choice depends on the DAO's function, its token structure, and the jurisdictions where its members and users are located. Hong Kong does not currently offer a DAO-specific entity form. In our practice, we typically recommend a foundation company or a hybrid structure with a clear governance agreement that maps DAO votes to legal authority.
Who is liable when a smart contract fails?
Liability for a smart contract failure turns on the relationship between the parties, the governing law, and the nature of the failure. If the contract was deployed by an identifiable party, that party may face claims in tort or contract where the failure causes loss – particularly if the code was represented as audited or fit for purpose. Where the failure results from an oracle data error, liability may extend to the oracle provider. In cross-border disputes, establishing jurisdiction and tracing loss to a specific on-chain event requires both legal and forensic analysis working in parallel.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We assess classification against the substance of rights, not the marketing label – and our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums. To discuss your situation, contact info@oboluslaw.com.
By Roman Levitt, Technology & DeFi Counsel – specialising in smart-contract legal risk, DeFi protocol structuring, and tokenization under the SFC regime and comparable frameworks.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.