Asia Fintech & Payments Regulatory Bulletin – March 2026

Regulatory activity across Asia's fintech and payments landscape continued at pace, with key themes including virtual asset ecosystem development, cross-border data transfer regulation, stablecoin and real-world asset tokenisation oversight and payment system designation frameworks.

This bulletin contains a quick-fire summary of the key regulatory developments across the region. To receive a more detailed breakdown of these developments, please subscribe to our monthly newsletter below.

Key developments by jurisdiction:

• Hong Kong SAR:

  • The SFC issued several circulars on virtual assets, including permitting VA brokers to offer margin-style financing for VA trades for the first time, subject to tight risk controls, and clarifying requirements for routing client orders into shared order books with offshore affiliate platforms.

  • Separately, a principles-based framework was introduced for VATP operators to offer VA perpetual contracts to professional investors, covering pricing, margining, liquidation mechanics, stress testing and loss allocation.

  • The SFC also set out the conditions under which a VATP operator may permit an affiliated market maker to provide liquidity on its platform, subject to strict conflict of interest and client protection safeguards.

  • The HKMA issued its Fintech Promotion Blueprint as part of its Fintech 2030 strategy, signalling heightened expectations on the use of AI and distributed ledger technology, and announcing four flagship projects including a Quantum Preparedness Index and a New Risk Data Strategy.

• Mainland China:

  • New Guidelines on Automotive Data Cross-Border Transfer Security, jointly issued by eight government authorities, establish mandatory security assessment thresholds for cross-border transfers of important data and personal information by automotive data handlers.

  • A separate set of measures, also issued on a multi-agency basis, introduces quantitative thresholds for identifying online platforms with a large number of minor users or significant influence on minors, requiring platforms meeting either threshold to apply for identification and submit self-assessment reports.

  • The People's Bank of China (PBOC) and seven other regulators released a notice reaffirming that virtual currency-related activities are illegal in China, prohibiting unauthorised offshore issuance of renminbi-pegged stablecoins and domestic RWA tokenisation, and imposing strict oversight of offshore RWA tokenisation by onshore entities.

  • Separately, the China Securities Regulatory Commission introduced regulatory guidelines establishing a filing-based supervision regime for the offshore issuance of asset-backed security tokens backed by domestic assets.

  • The PBOC finalised revised measures on the categorisation and rating of non-bank payment institutions, strengthening the link between rating outcomes and supervisory planning and tightening regulatory measures for the lowest-rated institutions.

• Singapore:

  • The PDPC announced that from 1 January 2027 it will intensify enforcement against private organisations using NRIC numbers for authentication, recommending that organisations phase out such practices by end of 2026.

  • Details were released of Singapore's largest coordinated cyber incident response, led by the Cyber Security Agency of Singapore and the IMDA, involving over 100 cyber defenders responding to an advanced persistent threat actor that infiltrated critical telecommunications infrastructure.

• Japan: 

  • The JFSA proposed draft amendments to subordinate regulations under the Payment Services Act to designate certain foreign trust beneficiary interests as Electronic Payment Instruments (the regulatory category covering stablecoins), and separately released a draft policy on strengthening cybersecurity in crypto-asset exchange businesses.

• Thailand: 

  • A suite of notifications from the Bank of Thailand establishes the regulatory framework for Systemically Important Retail Payment Systems (SIRPS), covering designation criteria, enhanced governance and risk management requirements for operators, and conduct-of-business rules for participants. PromptPay was designated as the first SIRPS.

• UAE: 

  • The Abu Dhabi Global Market Registration Authority published a discussion paper on proposed guidance for crypto mining activities conducted within or from ADGM, covering governance expectations, risk-based supervision and oversight of overseas mining operations by ADGM-registered entities. The consultation is open until 20 March 2026.