High-risk payment gateway and merchant accounts in Hong Kong

Hong Kong law is separate from mainland law. Most consumer rules are criminal offenses enforced by Customs, and most financial activity is licensed by the HKMA and the SFC.

Under the privacy ordinance, using a customer’s data for direct marketing needs informed, explicit consent and an opt-out, and silence is not consent; the offense carries HK$500,000 and three years, or HK$1 million and five years when data is sold. Reporting a data breach to the Privacy Commissioner is recommended, not compulsory: amendments to make it mandatory were still under review in September 2026, with no bill.

The HKMA launched the Faster Payment System on September 17, 2018, and payments started on September 30. It runs around the clock in Hong Kong dollars and renminbi, by account, mobile number or email, and counted 22,037,436 registrations at the end of September 2026. By early 2024, merchant and business payments, wallet top-ups and bill payments made up half of its turnover, and a free common QR code lets a merchant show one code for several providers.

Stored-value wallets run under HKMA licenses: the non-bank licensees include Octopus, Alipay Financial Services (HK), WeChat Pay Hong Kong, PayPal Hong Kong and HKT Payment, and HSBC issues PayMe among the banks. Card-based wallets such as Apple Pay hold no stored value and sit outside that licensing. Of these, we switch on Alipay, WeChat Pay and PayPal; Octopus and PayMe are not offered through OpenGate. A prepaid facility usable only for the issuer’s own goods, such as a store gift card, needs no license; a balance your customers could spend elsewhere does.

In June 2023 the HKMA told card-issuing banks to offer cardholders an authentication factor more robust than SMS one-time passwords for 3-D Secure, to let them switch card-not-present use on or off and set limits, and reminded them that every card-not-present transaction must be notified. From late 2024, banks began offering in-app approval instead of SMS codes, and they report fraud on those payments down by nearly 80%; in October 2026 they were still reducing their reliance on SMS codes. The requirements fall on the banks, not on merchants, but without 3-D Secure the bank cannot ask for that approval, and fraud chargebacks stay with you; the 3-D Secure guide covers the mechanics.

No Hong Kong ordinance bans card surcharges, but the Consumer Council reported in 2008 that the card schemes’ rules forbid merchants from adding a surcharge or setting a minimum spend for card payments. The Trade Descriptions Ordinance covers surcharges of any kind: a restaurant was fined HK$4,000 for a misleading omission over a 10% dinner surcharge missing from its menu.

Under section 13E of that Ordinance, an invitation to purchase must give the material information: the trader’s identity and a street address, not a post office box, the price including taxes, the delivery charges, any payment arrangement that departs from professional diligence, and any right of cancellation. Giving it in an unclear or untimely way counts as omitting it.

Since July 19, 2013, the Trade Descriptions Ordinance covers services as well as goods and makes six practices criminal offenses: false trade descriptions of services, misleading omissions, aggressive commercial practices, bait advertising, bait and switch, and wrongly accepting payment. On indictment they carry a fine of HK$500,000 and five years in prison, the court can order compensation, and Customs may accept a written undertaking from a trader instead of prosecuting.

Hong Kong law gives online shoppers no statutory right to cancel for any reason. A consultation that closed on August 31, 2026 proposed a 7-day cooling-off period, with refunds within 14 days, only for prepaid beauty and fitness contracts; under the proposal, a trader refunding a card payment could deduct the payment provider’s fee, up to 2% for a one-off payment. A business cannot exclude liability for death or injury caused by negligence, nor, against a consumer, the implied terms on description, quality and fitness for purpose, and a service must be supplied with reasonable care and skill.

No ordinance is written for subscriptions, free trials or automatic renewal. In a 2012 study, the Consumer Council called an automatic renewal term unfair without a clear written reminder before the contract ends, and a renewal hidden in small print can be a misleading omission. The subscription billing guide shows how to build a flow that holds up.

Hong Kong levies no value-added or sales tax. Only profits arising in or derived from Hong Kong are taxed, whatever the residence of the business. A corporation pays 8.25% on its first HK$2 million of assessable profits and 16.5% on the rest; among connected entities, only one may elect these two-tiered rates.

Every business carried on for gain registers with the Inland Revenue Department, and a valid business registration certificate is displayed at the place of business. A one-year certificate starting between April 1, 2026 and March 31, 2027 costs HK$2,350, the fee of HK$2,200 plus a HK$150 levy that is charged again after a two-year waiver. Records of receipts, payments, invoices and bank statements are kept for at least seven years, with fines of up to HK$100,000 for failing to do so. We found no e-invoicing obligation in Hong Kong.

Chargebacks in Hong Kong run under the card schemes’ rules, not statute. The HKMA has explained that, as long as a chargeback meets the scheme rules, the acquirer stays liable to refund the cardholder even if the merchant has gone out of business, which is why acquirers hold reserves against prepaid and delayed-delivery models. The Consumer Council found scheme time limits ranging from 60 to 540 days, and Hong Kong has no law making the card issuer jointly liable with the merchant.

Under the Code of Banking Practice of December 2023, a cardholder who did not act fraudulently or with gross negligence and reported promptly bears at most HK$500 of a loss from a lost card or compromised card details, and should report an unauthorized transaction within 60 days of the statement date. The issuer carries the rest and recovers it by chargeback when the payment was not authenticated. Each card chargeback counts toward your chargeback ratio.

A local company files its incorporation form and articles of association with the Companies Registry and receives its Certificate of Incorporation and Business Registration Certificate together, normally within an hour for an electronic filing. Every year it delivers an annual return within 42 days of its incorporation anniversary, and it files changes of directors or registered office within 15 days.

Since March 1, 2018, every unlisted Hong Kong company keeps a significant controllers register at its registered office, naming anyone holding more than 25% of the shares or voting rights or otherwise in control, updated within seven days of a change and shown to law enforcement on demand; breaches carry a HK$25,000 fine plus HK$700 a day. The acquirer applies the same 25% test under the anti-money laundering ordinance, so the register should match what you declare. Since October 2022, the public index of directors shows a correspondence address and a partial identity number, so acquirers ask for proof of address directly.

The Hong Kong dollar has been linked to the US dollar since October 17, 1983, within a band of HK$7.75 to HK$7.85. Real-time gross settlement runs in Hong Kong dollars, US dollars, euros and renminbi, and the Faster Payment System carries retail transfers. Two anti-money laundering registrations fall on merchants themselves: a remittance or currency exchange service needs a money service operator license from Customs, and a dealer in precious metals or stones carrying out transactions of HK$120,000 or more registers with Customs.

1. Letting the business registration certificate lapse. It is valid only until the printed expiry date, and an acquirer’s review can pause payouts until it is renewed.
2. Filing the annual return late, or not at all. It is due within 42 days of the anniversary, the Registrar sends no reminder unless you sign up for one, and a record of missed returns is a red flag at onboarding.
3. A significant controllers register that does not match the file. The register and the acquirer’s due diligence ask the same 25% question, and two answers halt the file.
4. A checkout that hides who you are or what it costs. Name, street address, full price and delivery charges are material information, and an unfamiliar name on the statement breeds “not recognized” disputes.
5. Free trials that roll into paid plans in small print. A hidden renewal can be a misleading omission, and every forgotten renewal becomes a chargeback.
6. Taking payment for stock you cannot ship. Wrongly accepting payment is an offense, and a valid chargeback is refunded by the acquirer even if you have closed.
7. Adding a card surcharge, or springing it at checkout. Visa’s rules forbid card surcharges, and an undisclosed surcharge of any kind can be a misleading omission.
8. Holding customer money as a spendable balance, or moving money for others. A multi-purpose prepaid balance needs an HKMA license, and remittance a money service operator license.

Most of these are fixed before go-live. A business model that needs one of them to work is declined, whatever its volume.