RegAlertHong Kong: lending & credit regulation
RestrictedLending restricted to licensed banks; digital lenders operate under banking code guidance
- Lead regulator
- Hong Kong Monetary Authority (HKMA)
- Also involved
- Personal Data (Privacy) Ordinance · PDPO · PDPC
- Core law
- Banking Ordinance (Cap. 155)
- Entry capital
- —
- Approval timeline
- —
- Customer assets
- No specific custodial regime for non-bank lenders
- Data protection
- PDPO 1996 · PDPC
- Sandbox
- —
Hong Kong strictly restricts lending to Authorized Institutions (banks). Non-bank digital lenders operate without a specific license but must adhere to the Code of Banking Practice and HKMA supervisory expectations. The regulatory environment is highly mature, focusing on consumer protection, data privacy, and prudent risk management rather than entry barriers for non-banks.
Which licence do you need?
| Your activity | Requirement | Capital | Timeline | Authority |
|---|---|---|---|---|
| Consumer lending | Uncertain[1][2] Unlicensed digital lenders follow banking code guidance | — | — | — |
| SME / commercial lending | Uncertainverify with regulator No specific SME lending license; unregulated market | — | — | — |
| Microfinance | Uncertainverify with regulator No specific microfinance regime identified | — | — | — |
| Buy-now-pay-later | Uncertain[1] Treated as unsecured consumer credit | — | — | — |
| P2P lending platform | Uncertainverify with regulator No specific P2P lending license exists | — | — | — |
| Credit bureau / scoring | Uncertain[3][4] Data sharing via CRAs under HKMA guidelines | — | — | — |
| Debt collection | Uncertainverify with regulator General commercial law applies | — | — | — |
New — what changed recently
- 2025-10-10Cross-boundary Credit Referencing — HKMA outlines guiding principles to regularize cross-boundary credit data transfer with the PBOC.[3]
- 2024-11-08Cooling-off Period for Unsecured Consumer Credit — Mandates a minimum seven-day cooling-off period for all unsecured consumer credit products.[1]
- 2024-06-28Pilots on Cross-boundary Credit Referencing — Establishes regulatory framework for cross-boundary credit data pilots with the Mainland.[5]
Market-entry checklist
- 1Establish local banking licenseApply for Authorized Institution status under the Banking Ordinance to legally lend.
- 2Implement cooling-off periodsEnsure all unsecured credit products offer a 7-day cooling-off period per HKMA guidance.
- 3Adhere to Code of Banking PracticeComply with the Code of Banking Practice for fair treatment of customers.
- 4Register for data privacyComply with the Personal Data (Privacy) Ordinance (PDPO) for all customer data handling.
Sources
- Cooling-off Period for Unsecured Consumer Credit Products · 2024-11-08
- Key Observations and Sound Practices on Consumer Protection in respect of Digital Platforms for the Application of Credit Products · 2022-12-20
- Cross-boundary Credit Referencing · 2025-10-10
- The Sharing and Use of Consumer Credit Data through Credit Reference Agencies · 2022-07-08
- Pilots on Cross-boundary Credit Referencing · 2024-06-28