Payment gateways for Hong Kong companies: comparing options and regulatory requirements

Payment Gateways for Hong Kong Companies: Options and Compliance

For a Hong Kong company accepting online payments, the first question is not which provider to choose but which regulatory framework applies. Payment gateways for Hong Kong companies operate under different licences, and the wrong choice can expose the business to regulatory action.

Hong Kong Payment Gateway Provider Types

A payment gateway provider in Hong Kong falls into one of three categories, each with a distinct regulatory status.

Payment institutions are companies authorised by the Hong Kong Monetary Authority (HKMA) to operate payment systems. They are not banks. A payment institution account is not a bank account, and the funds held are not protected by the Deposit Protection Scheme. Payment institutions offer merchant accounts that allow a company to accept credit card payments, digital wallet transactions, and bank transfers through the Faster Payment System (FPS).

Stored value facility (SVF) operators hold an SVF licence from the HKMA. These providers issue prepaid accounts or wallets that customers can top up and use for purchases. If your business model involves issuing a stored value product to the public, the provider you use must be an SVF licensee, or you may need to apply for an SVF licence yourself.

Money Service Operators (MSOs) are licensed by the Commissioner of Customs and Excise under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO). An MSO licence is required if the gateway involves money changing or remittance services. A gateway that converts customer payments from foreign currency into Hong Kong dollars and then remits the funds to your company may trigger the MSO requirement.

Hong Kong Online Payment Processing Company: What to Look for

When evaluating an online payment processing company in Hong Kong, the key distinction is whether the provider holds a payment institution licence, an SVF licence, or an MSO licence. Each licence imposes different customer due diligence obligations, capital requirements, and reporting duties.

A payment institution must comply with the HKMA's supervisory requirements, including maintaining adequate systems for anti-money laundering and counter-terrorist financing. The provider must verify the identity of its merchant clients, conduct ongoing transaction monitoring, and report suspicious activity to the Joint Financial Intelligence Unit.

If the provider offers multi-currency settlement, check whether it holds the appropriate licence for foreign exchange conversion. Some payment institutions operate under a restricted licence that limits the currencies they can handle.

Hong Kong Merchant Account: What It Is and Is Not

A Hong Kong merchant account is a facility that allows a company to accept card payments from customers. It is not a bank account, although it is often linked to one. The merchant account holds funds temporarily before they are settled to the company's business bank account.

Banks and payment institutions both offer merchant accounts. The terms differ. A bank-issued merchant account is more expensive and requires a longer application process. A payment institution merchant account may be faster to set up but carries the risk that funds are held by a non-bank entity.

When applying for a merchant account, the provider will request the same documents a bank would ask for during account opening: the Certificate of Incorporation, the Business Registration Certificate, the articles of association, proof of registered office, and identification for directors, shareholders, and significant controllers. The provider will also conduct customer due diligence under AMLO, including verifying the source of funds and the beneficial owner of the business.

Hong Kong Payment Institution Licence: When It Applies

A payment institution licence from the HKMA is required for any company that operates a payment system or provides payment services to the public. The licence covers processing card payments, operating a digital wallet, and facilitating bank transfers.

The application process involves demonstrating that the company has adequate financial resources, robust governance, and effective systems for managing operational risk. The HKMA also assesses the fitness and propriety of the company's directors and controllers.

If your company intends to operate its own payment gateway rather than using a third-party provider, you must apply for a payment institution licence. The threshold for licensing is low: any company that processes more than HK$1 million in payment transactions per month must be licensed.

Money Service Operator Licence and Remittance Gateways

If the payment gateway involves receiving funds from customers in one currency and delivering them to your company in another, or if it involves sending funds to a third party outside Hong Kong, an MSO licence may be required. The MSO licence is issued by the Commissioner of Customs and Excise and is separate from the payment institution licence.

An MSO must comply with AMLO requirements, including customer due diligence, record keeping, and suspicious transaction reporting. The licence application requires the company to demonstrate that its directors and beneficial owners are fit and proper persons.

Some payment gateways operate under both a payment institution licence and an MSO licence. If your business involves both payment processing and money changing, confirm that the provider holds both licences.

Money Lenders Ordinance Cap. 163 and Payment Gateways

If the payment gateway involves lending money to customers, for example by offering buy-now-pay-later (BNPL) services or instalment credit, the Money Lenders Ordinance (Cap. 163) applies. A money lender's licence is required to carry on business as a money lender in Hong Kong.

BNPL providers that are not licensed under the Money Lenders Ordinance risk prosecution. The ordinance imposes strict requirements on interest rates, disclosure, and collection practices. To offer credit through a payment gateway, your company must either obtain a money lender's licence or use a licensed money lender as the credit provider.

Securities and Futures Commission Regulated Activities

If the payment gateway involves the handling of securities or futures transactions, a licence from the Securities and Futures Commission (SFC) may be required. The SFC regulates 13 types of regulated activity, from Type 1 (dealing in securities) to Type 13 (operating an automated trading system).

Most payment gateways do not trigger SFC licensing because they process payments for goods and services, not for securities. However, if your company operates a platform that allows customers to trade digital assets or securities, the payment gateway may be part of a regulated activity. The company must hold the appropriate SFC licence.

Compliance Obligations for the Merchant

Regardless of which payment gateway provider you choose, your company retains responsibility for compliance. The provider will conduct customer due diligence on your business. You must also conduct due diligence on your own customers if you are handling payments directly.

The AMLO requires all financial institutions, including payment institutions and MSOs, to identify and verify the identity of their customers. If your company operates a payment gateway that collects funds from end customers, implement procedures for customer due diligence. These must cover verifying the source of funds and the beneficial owner of each transaction.

The HKMA expects payment institutions to monitor transactions for suspicious activity and to report any transactions that may be linked to money laundering or terrorist financing. Maintain records of all transactions for at least seven years.

Choosing a Compliant Payment Gateway

Verify the provider's licence status before signing a contract. The HKMA maintains a register of authorised payment institutions and SVF licensees. The Customs and Excise Department maintains a register of licensed MSOs. Check the register.

Ask the provider whether it holds a payment institution licence, an SVF licence, or an MSO licence, and whether it has any restrictions on the currencies or jurisdictions it can handle. If the provider is not licensed, your company may be using an unregulated service that exposes you to regulatory risk.

For most Hong Kong companies that sell goods or services online, a licensed payment institution is the appropriate choice. If the business involves money changing or remittance, an MSO licence may be needed. If the business involves lending, a money lender's licence under Cap. 163 applies. If the business involves securities, an SFC licence may be required.

The regulatory landscape for payment gateways in Hong Kong is clear: every provider must hold the correct licence, and every merchant must ensure its provider is compliant. Choosing a licensed provider protects your company from enforcement action and ensures that customer funds are handled according to Hong Kong law.