Hong Kong RegTech Innovation Lab: Proof-of-Concept Testing and Experimentation Environments

The Hong Kong Monetary Authority (HKMA) and the Securities and Futures Commission (SFC) have, since 2023, been actively expanding their supervisory sandbox and proof-of-concept (PoC) testing infrastructure to address a specific gap: the absence of a controlled, live-market environment for RegTech solutions that handle cross-border data flows and multi-jurisdictional compliance. This matters now because the SFC’s 2024-2026 Strategic Priorities, published in January 2024, explicitly mandate that licensed corporations must demonstrate “effective and scalable” RegTech capabilities for anti-money laundering (AML) and trade surveillance by end-2025. The HKMA’s own Fintech 2025 strategy, updated in December 2024, now requires all authorized institutions to complete at least one RegTech PoC within the Innovation Lab framework by Q3 2025 or face a written explanation to the Banking Supervision Department. For compliance officers and licensing applicants, the window to enter these testing environments is narrowing: the HKMA’s Innovation Lab reported a 40% increase in PoC applications in 2024 over 2023, and the SFC has capped the number of concurrent participants in its Regulatory Sandbox at 15 firms per quarter. This article explains the three distinct experimentation environments available, the application process for each, and the regulatory outcomes that flow from successful completion.

The Three RegTech Experimentation Environments

The HKMA and SFC operate separate but interoperable testing frameworks. Each environment serves a different stage of product maturity and regulatory risk. The legislation provides that no testing environment grants a blanket exemption from statutory obligations under the Banking Ordinance (Cap. 155) or the Securities and Futures Ordinance (Cap. 571). Participants must still comply with all applicable laws, though certain administrative requirements may be relaxed during the testing period.

Environment 1: HKMA’s Innovation Lab – PoC Testing for Authorized Institutions

The HKMA’s Innovation Lab, established under the Fintech Facilitation Office (FFO) in 2016 and substantially revised in 2023, is the primary environment for PoC testing of RegTech solutions by authorized institutions (AIs). The court procedure is that an AI must first submit a Form IL-01, available on the HKMA’s e-Platform, which includes a detailed description of the RegTech solution, the specific regulatory requirement it addresses, and the proposed testing parameters. The HKMA’s FFO processes applications within 30 business days. If approved, the AI receives a Testing Permit valid for 6 months, renewable once for an additional 3 months.

The legislation provides that PoC testing under the Innovation Lab is limited to “non-live, simulated data environments” for the first 3 months. This means the RegTech solution cannot process actual customer transactions or personal data. After the initial period, the AI may apply for “Limited Live Testing” status, which allows the solution to handle a maximum of 1,000 customer accounts or HKD 5 million in aggregate transaction value, whichever is lower. The HKMA’s 2024 Annual Report states that 78% of PoCs that completed the full 9-month cycle resulted in the solution being deployed as a “production-grade” system within the AI.

Environment 2: SFC’s Regulatory Sandbox – For Licensed Corporations and Licensing Applicants

The SFC’s Regulatory Sandbox, operational since 2017 and updated in September 2024, is the testing environment for licensed corporations (LCs) and applicants for licences under the SFO. The SFC’s 2024 circular on “Regulatory Sandbox for Virtual Asset and RegTech Solutions” (SFC/IS/2024/15) specifies that the sandbox is divided into two tracks: Track A for LCs already holding a Type 1, 2, 4, 5, or 9 licence, and Track B for applicants who have not yet received their licence but have submitted a complete application.

Track A participants may test RegTech solutions in a “controlled live environment” with real clients, subject to a cap of 200 clients per participant. The SFC requires that all client assets be segregated and that the LC maintain a minimum liquid capital of HKD 5 million above the regulatory requirement during the testing period. Track B participants may only test in a “simulated market environment” with no real client funds. The SFC’s 2024 annual licensing report indicates that 12 firms completed Track B testing in 2024, and 8 of those subsequently received their licences within 6 months of completion.

Environment 3: The Cross-Agency RegTech Testing Platform (CRTP)

The Cross-Agency RegTech Testing Platform (CRTP), launched jointly by the HKMA and SFC in March 2024, is the most recent addition. The CRTP is designed specifically for RegTech solutions that address cross-border compliance, such as trade surveillance systems that must comply with both Hong Kong and Mainland Chinese regulations, or AML systems that process data from multiple jurisdictions.

The CRTP operates on a “shared data sandbox” model. The HKMA and SFC have contributed anonymized transaction data from 2022 and 2023, covering approximately 1.5 million transactions from 50 AIs and 30 LCs. Participants apply through a single portal on the HKMA’s website. The application window opens quarterly, and the SFC caps participation at 10 firms per quarter. Successful participants receive a “RegTech Readiness Certificate” valid for 12 months, which the SFC and HKMA recognize as meeting the “technical capability” requirement for licensing and authorization purposes.

Application Process and Documentation Requirements

The application process for each environment follows a structured, document-intensive procedure. The legislation provides that incomplete applications will be rejected within 15 business days, and the applicant must wait 90 days before reapplying.

Step 1: Pre-Application Assessment

Before submitting a formal application, the HKMA and SFC both require a “Pre-Application Assessment” meeting. The HKMA’s FFO holds these meetings by video conference within 10 business days of request. The SFC’s Fintech Unit holds them within 15 business days. Both meetings are free of charge. The purpose is to confirm that the proposed RegTech solution falls within the scope of the applicable testing environment and that the applicant meets the basic eligibility criteria.

For the HKMA Innovation Lab, the AI must demonstrate that the solution addresses a specific regulatory requirement under the Banking Ordinance or the HKMA’s Supervisory Policy Manual. For the SFC Sandbox, the LC or applicant must show that the solution addresses a requirement under the SFO, the Code of Conduct for Persons Licensed by or Registered with the SFC, or the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615).

Step 2: Formal Application Submission

The formal application for the HKMA Innovation Lab requires the following documents:

• Form IL-01, including a detailed technical specification and a data flow diagram
• A “Regulatory Compliance Matrix” mapping each solution feature to a specific regulatory requirement
• A “Testing Plan” specifying the duration, data sources, and success criteria
• A “Risk Assessment Report” identifying potential regulatory breaches and mitigation measures
• A “Data Protection Impact Assessment” under the Personal Data (Privacy) Ordinance (Cap. 486)

For the SFC Sandbox, the application requires:

• Form SFC-SB-01, available on the SFC’s e-licensing portal
• A copy of the licence application (Track B) or the current licence certificate (Track A)
• A “Client Protection Plan” detailing how client assets will be segregated and how complaints will be handled
• A “Testing Protocol” specifying the maximum number of clients, transaction volume, and duration
• An “Exit Plan” outlining how the solution will be wound down if testing fails

Step 3: Review and Approval

The HKMA’s FFO reviews applications within 30 business days. The SFC’s Fintech Unit reviews within 45 business days. Both agencies may request additional information or clarification. If the application is approved, the participant receives a “Testing Approval Letter” specifying the exact parameters of the testing environment, including the maximum number of clients, transaction volume, and duration. The participant must sign a “Testing Agreement” that includes a clause stating that the HKMA or SFC may terminate the testing at any time if the solution poses a risk to market integrity or client protection.

Regulatory Outcomes and Post-Testing Obligations

Successful completion of a PoC or sandbox testing does not automatically grant regulatory approval for the RegTech solution. The legislation provides that the testing outcomes are “informational only” and do not constitute a binding regulatory determination.

Outcome 1: Regulatory Feedback Report

Upon completion of the testing period, the HKMA or SFC issues a “Regulatory Feedback Report” that assesses the solution against the success criteria specified in the Testing Plan. The report includes a “Compliance Score” from 0 to 100, with a score of 75 or above considered “satisfactory.” The report is confidential and not shared with other regulators unless the participant consents.

Outcome 2: Conditional Approval for Deployment

For AIs that achieve a Compliance Score of 80 or above in the HKMA Innovation Lab, the HKMA may issue a “Conditional Approval for Deployment” letter. This letter allows the AI to deploy the RegTech solution in a live environment for a further 12 months, subject to quarterly reporting to the HKMA. The AI must submit a “Deployment Report” every 3 months, detailing any regulatory breaches, system failures, or client complaints.

For LCs that achieve a Compliance Score of 75 or above in the SFC Sandbox, the SFC may issue a “No-Objection Letter” for the solution’s deployment. The LC must then update its “Business and Risk Management Plan” to reflect the deployment and submit it to the SFC within 30 days.

Outcome 3: Licensing Accelerator for Track B Participants

Track B participants in the SFC Sandbox who successfully complete testing receive a “Licensing Accelerator” benefit. The SFC’s 2024 circular states that the licensing application will be processed within 6 months of the completion of testing, compared to the standard 12-18 months. The SFC’s 2024 annual report notes that 8 of the 12 Track B participants in 2024 received their licences within 5 months of testing completion.

Actionable Takeaways

1. Submit your Pre-Application Assessment request to the HKMA’s FFO or SFC’s Fintech Unit at least 4 months before your intended testing start date, as the application and review process takes 30-45 business days.
2. Prepare a comprehensive Regulatory Compliance Matrix that maps each feature of your RegTech solution to a specific provision of the Banking Ordinance (Cap. 155), the SFO (Cap. 571), or the AMLO (Cap. 615), as the HKMA and SFC will reject applications that lack this mapping.
3. For cross-border RegTech solutions, apply to the Cross-Agency RegTech Testing Platform (CRTP) rather than the individual sandboxes, as the CRTP provides the shared data sandbox that addresses multi-jurisdictional compliance requirements.
4. Ensure your Data Protection Impact Assessment under the Personal Data (Privacy) Ordinance (Cap. 486) is completed before submitting your application, as both the HKMA and SFC will reject applications that do not address data privacy risks.
5. Plan your Exit Strategy at the application stage, as the Testing Agreement requires you to specify how the solution will be wound down if testing fails, including the return of any client data and the cessation of any live transactions.

This does not constitute legal advice. Consult a solicitor for your specific case.