What is a digital banking license? Which business models are applicable
Hong Kong digital banks usuallyHong Kong Monetary Authority(HKMA)’s “Virtual Bank” regulatory framework，Conduct business as a licensed bank under the Banking Ordinance。Its core features are：Online-focused customer acquisition and service delivery、Risk management driven by technology and data、and in capital、governance、outsourcing、Meet the same or more prudent regulatory requirements as traditional banks in terms of cybersecurity and consumer protection。
Common applicable modes：
- Retail/SME Digital Banking (Deposits、loan、pay、Cards and wealth management, etc.)
- Scenario finance (e-commerce/platform ecology，Embedded Finance)
- Cross-border and multi-currency services (for international customers or cross-border trade)
- B2B2C distribution model based on API/open banking (need to focus on evaluating outsourcing and third-party risks)
If your product route is more "payment/remittance" or "money services" rather than complete banking services，You can also first evaluate whether you need other license/qualification combinations，Then decide whether to enter the digital banking license path。For relevant technical and compliance support, please refer to：Fintech Compliance Consulting、Cross-border payment solutions。
Regulatory concerns and entry barriers (expressed in terms of “verifiable evidence”)
"Recognized Minimum Standards" in Schedule 7 of the Banking Ordinance，Banks incorporated in Hong Kong are required to maintain a paid-up share capital of not less than HK$300 million (or its equivalent in a recognized currency)；Digital banks must also meet the minimum standards of licensed banks。In addition to the legal minimum，Applicants should also follow the business plan、Risk and stress testing demonstrates adequacy of capital resources。
board governance、independence、Separation of responsibilities for key positions (CEO/CRO/CCO/MLRO/CIO, etc.)、Performance and accountability mechanisms need to form systems and evidence chains (meeting minutes、authorization matrix、Risk Appetite Statement, etc.)。
Cover credit、market、Liquidity、operate、Compliance、Models and third-party risks；Clarify RCSA、KRI、quota system、Problem rectification closed loop and internal audit plan。
Align AMLO、HKMA SPM and related guidelines：Customer Risk Assessment (CRA)、EDD、Transaction monitoring、List screening、suspicious transaction report、and digital identity/remote account opening control。
Identify key outsourcing clearly、Due diligence、Contract terms (audit rights/data residency/subcontracting controls/exit plans)、Continuous monitoring and concentration risk。
security baseline、Penetration testing and vulnerability management、Log retention and evidence collection、Keys and Encryption、Permissions and privileged account management，and personal data protection (PDPO) and cross-border transfer assessments。
We emphasize the principle of “verifiable evidence” in our coaching：Every regulatory statement should be traceable to institutional documents、System screenshot/configuration、Exercise records、Supplier Contract Terms、and auditable operational processes，Thereby improving interview defense and follow-upOn-site inspectionpass rate。
Implementation support related to data and privacy can be carried out simultaneously：Data security assessment、Personal information protection、Data privacy policy development。
List of core materials for application package (regulatory perspective)
1)Business and Products：target customer group、Product terms and pricing logic、Customer acquisition and marketing compliance (including misleading statement control)、Customer Complaints and Compensation Mechanism、Key indicators and customer handling plans in case of downtime/failure。
2) Governance and three lines of defense：Board Charter、committee setting、Authorization Matrix (DoA)、Compliance and risk independence、internal audit plan、Policy Framework。
3) Risk and Capital：Risk Appetite (RAS)、Limits and monitoring、stress test、Liquidity management、capital planning、and model methodology and verification mechanisms (such as using scorecards/machine learning)。
4）AML/CFT：Enterprise-level risk assessment、Customer due diligence (KYC/EDD)、Sanctions and PEP Strategy、Transaction monitoring rules and scenarios、Suspicious transaction handling process、Training and quality inspection mechanism。
5)IT and outsourcing：target architecture、List of critical systems、Change management、access control、Logging and monitoring、Vulnerability management、BCP/DR (including drills)、Key Outsourcing Due Diligence and Contract Points、Exit Plan。
6) Finance and Auditing：accounting policies、Audit and regulatory reporting capabilities、Data caliber and reconciliation mechanism、Description of fund uses and sources (including shareholder penetration and fund compliance)。
Implementation path：From 0 to being able to submit an application (including online preparation)
Clear license path、product boundaries、Target customer groups and regulatory risk points；Output gap list and roadmap (Governance/Capital/IT/AML/Outsourcing)。
Board of Directors and Key Position Responsibilities、three lines of defense、Policies and Procedures Library、Reporting mechanism and KRI system taking shape。
Core system and cloud architecture selection；Outsourced due diligence and solidification of contract terms；Security and BCP/DR solutions and drill plans。
Complete business plan、venture capital、AML/CFT、Complete application package for IT and outsourcing；Prepare to defend Q&A and evidence attachment。
Provide additional explanations and adjustments in response to inquiries；“Operation proof” (commissioning record) of key controls、Exercise minutes)。
Online list、KYC and transaction monitoring threshold calibration、Operation and customer service SOP、Internal audit first year planning and compliance routine monitoring。
If you plan to introduce mature systems or white label capabilities，Technical deliverables can be designed simultaneously with regulatory materials，Avoid “system first”、Refactoring costs caused by "compliance and post-compliance"。Relevant delivery capabilities can be referred to：Payment system integration、KYC identity verification system、eDon TM Transaction Monitoring System。
AML/CFT and Sanctions：“Explainable Compliance” in Digital Scenarios
The difficulty with AML/CFT in digital banks is usually not “whether there is a system”，But lies in：The customer journey is highly online、Identity verification and device/behavior signals are complex、and the superimposed risks of sanctions and fraud brought about by cross-border transactions and multiple currencies.。
Key controls we generally recommend：
- Customer Risk Assessment (CRA) Interpretable：Rule + model parallelism，The source of the variable needs to be explained、weight logic、Manual review and appeal mechanism。
- Remote account opening hierarchical control：Different risk levels correspond to different amounts、Function and trigger review points (such as abnormal address/occupation/fund source)。
- Sanctions and List Screening：Cover customers、beneficial owner、Counterparties and ultimate beneficiaries；Clarify fuzzy matching strategy and disposition SLA。
- Scenario-based transaction monitoring：around products (transfers、Card、Loan disbursement and repayment、Merchant acquiring, etc.) Create scenarios；Adjust parameters regularly、Backtesting and false positive management。
- STR closed loop and audit trail：From alarm - investigation - upgrade - report - archiving, the entire process leaves traces，Support regulatory spot checks and internal audit reviews。
If involvedCross-border customersand group structure，It is also recommended to evaluate simultaneouslytax information exchangeand disclosure obligations：CRS tax consulting、Cross-border tax consulting。
Cost and Budget Reference
Hong Kong digital banks apply for bank licenses under the Banking Ordinance。Verification as of September 3, 2026，the OrdinanceSchedule 2 "Fees"The stated bank license fee and renewal fee are both HK$750,000。
The above amount is the statutory license fee，Not includedSchedule 7 "Recognized Minimum Criteria"required minimum paid-up share capital，Nor does it include the core banking system、network security、Management and control functions、office space、audit、Legal and professional advisors, etc. application and operating costs。Project budgets should be presented separately：Statutory license fee、capital resources、Application preparation and system launch costs，and ongoing regulatory and operational costs after approval.。
The service fees are subject to applicable jurisdiction、Business scope、Main structure、Data complexity and delivery schedule assessment；Involving government fees，The latest fees announced by the corresponding regulatory agency shall prevail.。
Frequently Asked Questions (FAQ)
The Hong Kong Monetary Authority has updated the name of the relevant guidelines to digital banking。Digital banks mainly provide banking services through the Internet or electronic channels，Still have to meet the conditions for authorization under the Banking Ordinance，Not to be construed as a lower level payment license。 SeeHong Kong Monetary Authority Digital Banking Supervision Notes。
High-frequency inquiries focus on：Penetration of shareholders and funding sources、Board governance and independence of key positions、Controllability of outsourcing and cloud (audit rights/exit plan/subcontracting management)、Interpretability and enforceability of AML/CFT、Cybersecurity and operational resilience (including drills and incident response)。
Can use outsourcing and mature systems，However, outsourcing governance needs to be included as a core chapter in application materials and implementation control.：Due diligence、Contract terms、Continuous monitoring、Concentration risk and exit plans must be implementable and auditable。
The license path should be determined first based on actual products and capital flows.。If the business does not accept deposits but primarily provides exchange or remittances，Appropriate monetary services or payment regulatory requirements should be assessed；Applying for a digital bank falls under the banking license path under the Banking Ordinance.，The MSO license cannot be regarded as a prerequisite or substitute for a digital banking license.。You can refer to it firstHong Kong Monetary Authority Digital Banking Supervision Notes。
usually include：Gap Assessment and Roadmap、Complete governance and compliance package、AML/CFT framework and key processes、Outsourcing and Cloud Governance Documents、Data and security assessment recommendations、Application materials coordination and inquiry response support，and compliance acceptance checklist before going online.。
no。Company registration is different from bank approval，Requires bank licensing requirements based on target jurisdiction、governance、capital、Risks and operational requirements。 SeeHong Kong Monetary Authority Digital Banking Supervision Notes。
Should be combined with the HKMA’s digital banking instructions、Current authorization guidelines and minimum authorization conditions of the banking regulations are prepared item by item，Instead of just referring to the promotional articles of the old name virtual bank。 SeeHong Kong Monetary Authority Digital Banking Supervision Notes。
It cannot be generally claimed that exemption。Hong Kong Monetary Authority explains that digital banks are subject to the same regulatory requirements as traditional banks，Some arrangements will be adjusted based on risks and business models。 SeeHong Kong Monetary Authority Digital Banking Supervision Notes。
uncertain。should be combined with licensing conditions、Sustained Capital and Liquidity、Business forecasting and stress scenario assessment，The registered capital cannot be、Paid-in capital and regulatory capital are conflated。 SeeHong Kong Monetary Authority Banking Supervision Framework。
Equity and control chain should be prepared、background、Financial capabilities and sources of funds，Relevant controllers and management must meet applicable approval requirements。 SeeHong Kong Monetary Authority Banking Supervision Framework。
cannot。Even using outsourcing，Banks still need to be able to manage risks、Monitoring services and handling events，Governance responsibilities cannot be replaced by software contracts。
Used to describe target customers、product、revenue cost、Capital and liquidity needs and risk response；Predictions should be based on，and test adverse scenarios，Don’t just show ideal growth。
not equal to。Authentication should be designed according to risk、Beneficial owner identification、Enhance due diligence and recording arrangements，Technical methods must be consistent with applicable requirements。 SeeHong Kong Monetary Authority Anti-Money Laundering Supervision Information。
Critical services should be identified、recovery goals、backup、Alternative paths and notification mechanisms，Test customer and funds processing in case of vendor or network failure。
You cannot judge based on the location of the computer room alone，Data should be checked、access、audit、Regulatory access and exit arrangements，Evaluate against applicable requirements。
cannot be automatically presumed。Bank approval does not replace registration for other products、license、Personnel qualifications and sales requirements，Should be confirmed item by item。
Risk assessment should be provided、Due diligence and screening records、Surveillance case、Upgrade decision、Training and review evidence，Not just submitting system templates。 SeeHong Kong Monetary Authority Anti-Money Laundering Supervision Information。
Financial and risk information is required to be submitted in accordance with applicable regulations，Continue to meet capital liquidity and governance requirements，and cooperate with regulatory inspections。 SeeHong Kong Monetary Authority Banking Supervision Framework。
cannot。Approval and additional conditions are determined by the competent authority，Should be prepared according to the information、Inquiry and verification set project milestones。
Suggested target jurisdictions、shareholders funds、Management team、product customers、System architecture、Outsourcing checklist and financial forecast，to identify licensing and implementation gaps。
If you want to plan an integrated path of "license + system + compliance operation" at the same time，Can be referenced：Virtual Banking Solutions、Fintech Compliance Consulting。
Executable preparation for digital banking license application
Digital banking license applications usually examine both shareholders and funding sources、Management、business model、capital、client funds、risk governance、Technological resilience and exit planning。Completing the system or registering a company does not equate to meeting the conditions for a banking license。
- Clear deposits and loans、pay、Card、Forex、Permissible boundaries for wealth management and client funds。
- Prepare shareholders and controllers、Source of funds、management suitability、Three-year business and financial plan。
- Establish credit、Liquidity、capital、AML/CFT、consumer protection、Data and Cyber Security Framework。
- Provide stress testing、Disaster recovery、outsourcing、incident response、Evidence of recovery and orderly exit。
Official verification：Chapter 9 of the Hong Kong Monetary Authority’s Authorization Guidelines：Digital banking authorization、Chapter 8：Application procedureandApplication Document List Attachment 2。Whether the application can be approved and the time required for review will be determined by the Hong Kong Monetary Authority based on the application materials and actual circumstances.，Cannot promise fixed results or periods。
