Hong Kong: technology regulation at a glance

Framework: Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) VATP regime administered by the Securities and Futures Commission (SFC), the Stablecoins Ordinance (Cap. 656) administered by the Hong Kong Monetary Authority (HKMA), and the Securities and Futures Ordinance (Cap. 571) for security tokens; further dealer/custodian/adviser/manager licensing regimes scheduled for legislation in 2026.

Hong Kong treats crypto as legal but heavily regulated through a multi-pillar regime. A dedicated licensing regime for Virtual Asset Trading Platforms (VATPs) has been in force under the SFC since 2023, and the Stablecoins Ordinance for fiat-referenced stablecoin (FRS) issuers commenced on 1 August 2025, with the HKMA granting the first stablecoin issuer licences (to Anchorpoint Financial and HSBC) in April 2026. Parallel licensing regimes for VA dealers, custodians, advisers and managers are slated for legislation in 2026, and crypto retail is permitted on licensed platforms within the SFC's 'ASPIRe' roadmap.

Framework: No dedicated AI statute; governance rests on existing laws (Personal Data (Privacy) Ordinance, financial services legislation, copyright, AML/CFT) supplemented by regulator- and Digital Policy Office (DPO)-issued AI guidance and sector-specific circulars

Hong Kong has no comprehensive AI law. Instead, the Government has confirmed it will continue to regulate AI through existing regimes plus targeted sectoral rules and non-binding guidance — anchored by the Personal Data (Privacy) Ordinance (PDPO), the PCPD's Model Personal Data Protection Framework for AI (2024), the DPO's Hong Kong Generative AI Technical and Application Guideline (April 2025, updated December 2025), and financial-sector measures led by the HKMA, SFC, IA and MPFA. In March 2026 the Secretary for Justice convened a Steering Committee to lead an inter-departmental review of existing legislation to support wider AI application, but no bespoke AI bill has been introduced to the Legislative Council.

Framework: Personal Data (Privacy) Ordinance (Cap. 486) (PDPO), enforced by the Office of the Privacy Commissioner for Personal Data (PCPD)

Hong Kong has a comprehensive, principles-based data protection regime under the Personal Data (Privacy) Ordinance (Cap. 486), enacted in 1995 and in force since December 1996 — one of Asia's oldest such laws. It is administered by the independent Privacy Commissioner for Personal Data (PCPD), who as of 2026 is Ada Chung Lai-ling. The law was significantly amended in 2021 to criminalise doxxing, and further reforms (mandatory breach notification, direct administrative fines, an expanded definition of 'personal data') are actively under discussion but not yet enacted.

Framework: Payment Systems and Stored Value Facilities Ordinance (Cap. 584, PSSVFO), administered by the Hong Kong Monetary Authority (HKMA); supplemented by the Stablecoins Ordinance (in force 1 Aug 2025) and the HKMA Open API Framework.

Hong Kong has a mature, in-force licensing regime for digital payments and e-money. Under the PSSVFO the HKMA licenses stored value facility (SVF) issuers (e-wallets, prepaid products) and designates/regulates retail payment systems, and it operates the Faster Payment System (FPS) instant-payment rail. A dedicated fiat-referenced stablecoin issuer licensing regime took effect on 1 August 2025, while open banking is implemented via the HKMA's phased Open API Framework rather than a statutory mandate.

Framework: Immigration Department (IMMD) admission schemes under the Immigration Ordinance (Cap. 115): Top Talent Pass Scheme (TTPS), Quality Migrant Admission Scheme (QMAS), General Employment Policy (GEP), and New Capital Investment Entrant Scheme (New CIES).

Hong Kong has no dedicated digital-nomad visa; the Immigration Department requires anyone taking up residence or working while physically in the HKSAR (even for an overseas employer) to hold an appropriate visa/entry permit, and a visitor visa does not authorise ongoing remote work. High earners and top-university graduates can, however, effectively live and work remotely by using the Top Talent Pass Scheme (TTPS), the Quality Migrant Admission Scheme (QMAS), or, at the wealth end, the New Capital Investment Entrant Scheme (New CIES) golden-visa pathway.

Framework: Layered regime: Safeguarding National Security Ordinance 2024 (Article 23) and National Security Law 2020 (esp. Art. 43 Implementation Rules) drive content takedowns and site blocking; sectoral rules include the Control of Obscene and Indecent Articles Ordinance (Cap. 390) enforced by OFNAA and the Personal Data (Privacy) Ordinance anti-doxxing amendment (2021). No UK-OSA / EU-DSA-style comprehensive online-safety statute is in force.

Hong Kong has no comprehensive online-safety or platform-liability law equivalent to the EU DSA or UK OSA; platform obligations arise from a patchwork of sectoral statutes and, most consequentially, from national-security powers. Under Article 43 NSL Implementation Rules and the 2024 Safeguarding National Security Ordinance, police can compel service providers to remove content, restrict access, or hand over data, and multiple websites have been blocked. Age-verification and youth-social-media restrictions are not being pursued: in July 2026 the Secretary for Innovation, Technology and Industry explicitly ruled out a youth social-media ban, favouring guidelines and education.

Framework: Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653) enforced by the Office of the Commissioner of Critical Infrastructure (Computer-system Security) (OCCICS); Personal Data (Privacy) Ordinance (Cap. 486) under the PCPD; HKMA Cybersecurity Fortification Initiative (CFI) 2.0 for authorized institutions

Hong Kong does not have a NIS2-style horizontal cybersecurity statute covering all businesses. Its regime is sector-specific: the Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653) — Hong Kong's first dedicated cybersecurity law — took effect on 1 January 2026 and regulates designated critical infrastructure operators (CIOs) across eight essential sectors, while the HKMA (banking), SFC (securities), and PCPD (personal data) impose additional cyber and incident-reporting duties on regulated entities. Mandatory data-breach notification remains proposed under PDPO reform but is not yet in force.

Framework: Companies Ordinance (Cap. 622) administered by the Companies Registry, with parallel Business Registration under the Inland Revenue Department's Business Registration Ordinance (Cap. 310); no foreign-investment screening regime applies to most sectors.

Hong Kong is one of the most open jurisdictions globally for foreign business formation: 100% foreign ownership of a private limited company is permitted with no minimum capital and no requirement for a local director or shareholder. Incorporation and business registration are one-stop and typically completed within one hour for e-filings via the Companies Registry's e-Registry. Sectoral licences (banking, broadcasting, SFC-regulated activities) impose additional foreign-ownership or capital thresholds, but the general regime remains highly liberal.