HKMA Virtual Bank Licensing Regime: Application Eligibility and Operational Requirements

On 20 March 2025, the Hong Kong Monetary Authority (HKMA) published a revised supervisory policy manual (SPM) module for virtual banks, marking the most significant regulatory recalibration since the virtual banking licence regime opened in 2018. The revised SPM module, effective from the date of issue, replaces the original 2018 version and introduces a formal timeline for virtual banks to demonstrate a credible path toward profitability. This policy shift comes as Hong Kong’s eight licensed virtual banks collectively reported operating losses of approximately HKD 3.6 billion for the 2024 financial year, according to aggregated financial disclosures filed with the HKMA. The regulator has signalled that the experimental phase is over. For applicants currently preparing licence submissions, the 2025 revisions tighten the eligibility bar, impose new operational benchmarks, and require a demonstrable business model that can achieve profitability within a timeframe the HKMA considers acceptable. This article sets out the current application framework, eligibility criteria, and operational requirements under the HKMA’s virtual banking regime as of 2025.

The HKMA Virtual Banking Licence Framework: Authority and Scope

The HKMA administers the virtual banking licence regime under the Banking Ordinance (Cap. 155). A virtual bank is defined in the HKMA’s SPM module as a bank that primarily delivers retail banking services through digital channels rather than physical branches. The HKMA has granted eight virtual banking licences since 2019, all of which commenced operations between 2020 and 2021. No new licences have been issued since June 2020, and the HKMA has not publicly committed to a specific timeline for processing new applications.

Legal Basis and Regulatory Instruments

The primary legal authority for the HKMA to licence virtual banks lies in section 16 of the Banking Ordinance (Cap. 155). The HKMA supplements this statutory power through its SPM module on virtual banks, which was first issued in May 2018 and revised in March 2025. The SPM module is not subsidiary legislation but carries significant regulatory weight. The HKMA expects all authorised institutions, including virtual banks, to comply with the module as a condition of their licence.

The HKMA also relies on its Supervisory Policy Manual module CA-S-1 on “Authorisation” to assess fitness and propriety of applicants. This module cross-references the Banking Ordinance and the HKMA’s internal authorisation guidelines. Applicants should review CA-S-1 alongside the virtual bank-specific module when preparing their submissions.

Who Must Apply

Any entity that intends to carry on a banking business in Hong Kong primarily through digital channels must apply for a virtual banking licence under the Banking Ordinance. The HKMA does not distinguish between locally incorporated virtual banks and branches of foreign banks for licensing purposes, though the capital requirements differ. A locally incorporated virtual bank must maintain a minimum paid-up share capital of HKD 300 million, as required under section 60 of the Banking Ordinance. A branch of a foreign bank must maintain a minimum capital base of HKD 100 million, subject to the HKMA’s approval in each case.

The HKMA has stated in its 2025 SPM revision that it will not accept applications from entities that cannot demonstrate a clear and credible path to profitability within a reasonable timeframe. The HKMA has not defined “reasonable timeframe” in the module, but its public statements and the 2025 revision indicate that five years from the date of licence grant is the expected benchmark.

Eligibility Criteria for Virtual Banking Licence Applicants

The HKMA evaluates virtual banking licence applications against the same core criteria applicable to conventional banking licence applications, with additional requirements specific to digital-only operations. The eligibility criteria fall into three categories: applicant structure, business model viability, and technological capability.

Applicant Structure and Ownership

The HKMA requires every virtual bank applicant to be a company incorporated in Hong Kong under the Companies Ordinance (Cap. 622). The applicant must have a board of directors that includes at least one individual who satisfies the HKMA’s fit and proper criteria under section 71 of the Banking Ordinance. The HKMA also expects the applicant to have a controlling shareholder or group of shareholders that can demonstrate financial strength and a long-term commitment to the virtual bank.

The 2025 SPM revision introduced a new requirement: the applicant must disclose the ultimate beneficial owners of any shareholder that holds 10% or more of the applicant’s shares. The HKMA will assess whether these ultimate beneficial owners have any criminal record, adverse regulatory history, or financial distress that could impair the virtual bank’s stability. This requirement mirrors the HKMA’s approach under the Banking Ordinance for conventional banks but is now explicitly codified for virtual bank applicants.

Business Model Viability and Profitability Path

The HKMA requires the applicant to submit a detailed business plan covering the first five years of operations. The business plan must include projected income statements, balance sheets, and cash flow statements. The HKMA will assess whether the projected revenue streams are realistic given the competitive landscape in Hong Kong’s retail banking sector.

The 2025 SPM revision added a specific requirement: the business plan must identify the key assumptions underlying the revenue projections and include a sensitivity analysis showing how the virtual bank would perform under adverse scenarios. The HKMA expects applicants to demonstrate that they can achieve profitability within five years of licence grant. The regulator has stated in the SPM module that it will not accept business plans that rely on indefinite capital injections from shareholders to sustain operations.

The HKMA also requires the applicant to explain how it will achieve sufficient scale to cover operating costs. The regulator has noted that Hong Kong’s eight existing virtual banks collectively hold less than 1% of total banking assets in Hong Kong as of December 2024, according to HKMA banking statistics. The applicant must demonstrate how it will capture market share from incumbent banks and other virtual banks.

Technological Capability and Cybersecurity

The applicant must submit a technology roadmap that describes the core banking system, digital channels, data architecture, and cybersecurity framework. The HKMA requires the applicant to engage an independent third party to conduct a technology audit before licence grant. The audit must assess whether the applicant’s systems meet the HKMA’s requirements under the SPM module on “Supervision of E-Banking” (SA-2) and the “Cybersecurity Fortification Initiative” (CFI) published in 2021.

The 2025 SPM revision explicitly requires the applicant to demonstrate compliance with the HKMA’s “Cloud Computing” module (CRAF-1) if the virtual bank uses cloud services for any core banking functions. The applicant must provide evidence that the cloud service provider meets the HKMA’s data residency and data protection requirements. The HKMA has stated that it will not approve applications that rely on cloud services located outside Hong Kong for storage of customer data, unless the applicant can demonstrate that equivalent data protection standards are in place.

Operational Requirements After Licence Grant

Once the HKMA grants a virtual banking licence, the authorised institution must comply with ongoing operational requirements that are specific to virtual banks. These requirements supplement the general prudential requirements applicable to all authorised institutions under the Banking Ordinance.

Capital Adequacy and Liquidity

A virtual bank must maintain a capital adequacy ratio (CAR) of at least 8% under the Banking (Capital) Rules (Cap. 155L). The HKMA may impose a higher CAR on a virtual bank if it considers the bank’s risk profile warrants additional capital. The 2025 SPM revision states that the HKMA will consider imposing a CAR of 12% or higher on virtual banks that have not achieved profitability within five years of licence grant.

The virtual bank must also maintain a liquidity coverage ratio (LCR) of at least 100% under the Banking (Liquidity) Rules (Cap. 155Q). The HKMA has stated in the SPM module that it expects virtual banks to maintain a higher LCR than the regulatory minimum during the first three years of operations, given the higher funding volatility associated with digital-only deposit channels.

Customer Onboarding and Anti-Money Laundering

Virtual banks must comply with the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) and the HKMA’s supervisory guidelines on AML/CFT. The HKMA requires virtual banks to implement electronic know-your-customer (e-KYC) procedures that meet the standards set out in the HKMA’s “Guidelines on Anti-Money Laundering and Counter-Financing of Terrorism” (AML Guidelines) published in 2023.

The e-KYC procedures must include biometric verification, document authentication, and liveness detection. The virtual bank must maintain records of all e-KYC checks for at least seven years after the account is closed. The HKMA may conduct on-site examinations to verify that the e-KYC procedures are effective in preventing money laundering and terrorist financing.

Data Protection and Customer Privacy

Virtual banks must comply with the Personal Data (Privacy) Ordinance (Cap. 486). The HKMA requires virtual banks to implement data protection policies that cover data collection, storage, processing, and sharing. The virtual bank must obtain customer consent before using customer data for any purpose other than providing banking services.

The 2025 SPM revision introduced a new requirement: virtual banks must conduct a data protection impact assessment (DPIA) before launching any new product or service that involves significant processing of customer data. The DPIA must be submitted to the HKMA within 30 days of completion. The HKMA may require the virtual bank to modify the product or service if the DPIA identifies material data protection risks.

Closing the Licence Application: Key Steps and Timeline

The HKMA does not publish a standard timeline for processing virtual banking licence applications. Based on the experience of the eight licensed virtual banks, the application process typically takes 12 to 18 months from submission to licence grant. The HKMA may request additional information or require the applicant to address deficiencies before proceeding to the approval stage.

Step-by-Step Application Process

Step 1: Pre-submission consultation. The HKMA encourages applicants to engage in a pre-submission consultation with the Banking Supervision Department. The applicant should present its business model, ownership structure, and technology roadmap. The HKMA will provide preliminary feedback on whether the application is likely to meet the eligibility criteria.

Step 2: Formal application submission. The applicant must submit a formal application under section 16 of the Banking Ordinance, along with all supporting documents. The application must include the business plan, ownership structure, technology audit report, and fit and proper declarations for directors and senior management.

Step 3: HKMA review and due diligence. The HKMA will conduct a comprehensive review of the application, including background checks on shareholders and directors, assessment of the business plan, and evaluation of the technology systems. The HKMA may request additional information or require the applicant to address deficiencies.

Step 4: Financial Secretary approval. The HKMA must recommend the application to the Financial Secretary for approval under section 16(4) of the Banking Ordinance. The Financial Secretary has the final authority to grant or refuse the licence.

Step 5: Licence grant and commencement of operations. Once the Financial Secretary approves the application, the HKMA issues the licence. The virtual bank must commence operations within 12 months of licence grant, unless the HKMA grants an extension.

Actionable Takeaways

1. The HKMA’s 2025 SPM revision requires all virtual bank applicants to demonstrate a credible path to profitability within five years, making a detailed and realistic business plan the single most important document in the application package.
2. Applicants must engage an independent technology auditor before submission and ensure their cloud computing arrangements comply with the HKMA’s CRAF-1 module, including data residency requirements for customer data.
3. The HKMA will scrutinise ultimate beneficial owners of 10% or greater shareholders, so applicants should prepare detailed ownership disclosures and background documentation early in the process.
4. Virtual banks that fail to achieve profitability within five years face the risk of a higher capital adequacy ratio of 12% or more, which will directly affect capital planning and return on equity projections.
5. The HKMA expects virtual banks to maintain a liquidity coverage ratio above the 100% regulatory minimum during the first three years of operations, requiring careful management of deposit funding sources and contingency funding plans.

This does not constitute legal advice. Consult a solicitor for your specific case.