Hong Kong's New Crypto Regulations Arrive: A Detailed Look at CRP-1 and Its Market Impact

Author: Xiao Sa Legal Team

Driven by the wave of technological innovation, the global cryptocurrency market has expanded rapidly. At the same time, risks such as extreme price volatility and money laundering have become increasingly evident, making effective regulation particularly urgent. In September 2025, the Hong Kong Monetary Authority (HKMA) issued a consultation paper on the new module CRP-1 "Classification of Crypto Assets" of the Banking Supervision Policy Manual (SPM) to the local banking sector. This aims to align with international regulatory standards and establish a balanced regulatory framework that supports innovation while managing risks, providing clear guidance for banks engaging in crypto-related activities.

Next, TechFlow will walk you through the key requirements under CRP-1, compare them with regulations in other jurisdictions, and discuss how these changes may impact cryptocurrency users.

01 Interpretation of Key Content in Hong Kong's CRP-1 Regulation

(i) Foundational Definitions: Regulatory Scope and Applicable Entities

The CRP-1 regulation first establishes a clear scope for crypto asset oversight, laying the foundation for implementation. Specifically, it defines crypto assets as those primarily relying on cryptography and distributed ledger technology (DLT) or similar technologies, used for payment, investment purposes, or to obtain goods and services. However, central bank-issued digital currencies are explicitly excluded. This precise definition distinguishes crypto assets from legal tender digital currencies, preventing overreach in regulation.

In terms of regulated entities, CRP-1 applies to all licensed financial institutions in Hong Kong, including authorized banks, restricted license banks, and deposit-taking companies. These institutions are key components of Hong Kong’s financial system, and their involvement in crypto activities directly affects financial stability. Including them in the regulatory framework enables risk control at the source.

Regarding risk management, the regulation adopts a “no exceptions” approach. All risks—whether arising from banks’ own holdings of crypto assets, custody or trading services provided to clients, or indirect exposure via financial derivatives—must be managed. This prevents financial institutions from circumventing supervision and ensures comprehensive oversight of all crypto-related risks.

(ii) Core Classification

Risk-based classification is the core logic of the CRP-1 regulation. Based on the ability to mitigate risk, crypto assets are divided into Group 1 (low risk) and Group 2 (high risk). The table below provides a clear overview of this classification.

02 Alignment and Differences Between CRP-1 and International Standards (BCBS)

(i) Core Logic of BCBS Standards

The Basel Committee on Banking Supervision (BCBS), as the core global authority for banking regulation, released "Prudential Treatment of Crypto Asset Exposures" in December 2022 and the "Crypto Asset Standards Revision" in July 2024, establishing a unified global regulatory framework for crypto assets. Its core principle can be summarized as “risk-based classification and prudent control.”

In terms of regulatory objectives, the BCBS standards focus on “controlling crypto asset risks and ensuring adequate bank capital,” aiming to prevent spillover effects to traditional banking systems and maintain global financial stability. The core framework divides crypto assets into “Category 1” and “Category 2,” imposing stricter capital requirements on high-risk assets while promoting global regulatory coordination to avoid regulatory arbitrage.

The development of BCBS standards was driven by the rapid growth and accumulating risks in the global crypto market. They aim to provide a uniform supervisory benchmark for internationally active banks, balancing “financial stability” and “responsible innovation,” and serving as a reference for regulators worldwide.

(ii) Alignment Between CRP-1 and BCBS

CRP-1 shares significant alignment with BCBS standards in key areas, reflecting Hong Kong’s position as an international financial center closely following global regulatory trends.

In asset classification, CRP-1 divides crypto assets into “Group 1” and “Group 2,” while BCBS uses “Category 1” and “Category 2.” Both classify based on the ability to control asset risks. For example, compliant stablecoins—considered lower risk and more reliable—are classified as “Category 1” under BCBS and correspond to “Group 1” under CRP-1. Both frameworks require clear legal frameworks and robust risk controls for such assets. For high-risk assets, both impose strict capital requirements on financial institutions, fully embodying the principle that “higher risk means tighter control.”

In terms of funding supervision, CRP-1 largely follows BCBS’s prudent management approach. BCBS mandates that for certain high-risk crypto assets, institutions must hold capital equivalent to 1250% of the asset value; CRP-1 applies the same standard to Group 2b assets. For liquid crypto assets, BCBS requires trading on compliant exchanges with minimum market size thresholds; similarly, CRP-1 requires Group 2a assets to be traded on regulated exchanges, setting market cap and trading volume thresholds to ensure capital allocation matches asset risk.

Additionally, both CRP-1 and BCBS emphasize comprehensive oversight. Whether assets are held directly by banks, involved in client services, or indirectly linked, all exposures must fall within the regulatory perimeter. This eliminates unregulated “gray zones” and advances the goal of globally consistent supervision.

03 Practical Impacts of CRP-1 on Crypto Users

After CRP-1 takes effect, major adjustments to bank crypto services will directly affect users' ability to trade, store, and use crypto assets.

First, trading options will tighten. High-risk Group 2b assets—such as certain NFTs and governance tokens—will no longer be tradable through banks and must be traded on alternative platforms, which may be less reliable. While Group 1 compliant assets are safer, the range of available options will shrink. Group 2a assets must be traded on licensed exchanges, where account opening involves stricter checks and higher barriers. Regarding asset security, the new rules enhance custody safety—users may recover funds more easily if a platform fails—but stringent anti-money laundering requirements reduce personal privacy, and different assets will experience varying levels of price volatility.

For users holding 2b-class assets like NFTs and governance tokens, TechFlow recommends prioritizing platforms regulated by HKMA or with international compliance credentials, and avoiding concentrating all assets in one place. Users favoring Group 1 compliant assets can benefit from bank-level security but should accept fewer investment choices. Those trading Group 2a assets should prepare full documentation—including ID and bank cards—in advance to meet strict exchange verification. Regardless of asset type, users should reassess their investment portfolios, monitor changes in bank fees, and strike a balance between enjoying enhanced security and preserving privacy and operational convenience.

Final Thoughts

In summary, Hong Kong’s CRP-1 regulation demonstrates strong foresight in the field of crypto asset supervision, offering new directions for industry development and risk management.

TechFlow recognizes that Hong Kong’s crypto regulatory framework is entering a phase of dynamic optimization and deeper implementation. Going forward, regulators must keep pace with international developments and strengthen cross-border regulatory coordination. Industry participants should establish regular compliance communication mechanisms. We look forward to Hong Kong leveraging CRP-1 as an opportunity to enhance regulatory technology, balance investor protection with innovation, and set a global benchmark in financial regulation.