Asia Fintech & Payments Regulatory Bulletin – May 2026

Regulatory activity across Asia's fintech and payments landscape continued at pace last month, with key themes including tokenised investment product trading, AI governance, data-export frameworks, cybersecurity standards, the prudential treatment of digital assets and oversight of online financial product marketing.

This bulletin contains a quick-fire summary of the key regulatory developments across the region. To receive a more detailed breakdown of these developments, please subscribe to our monthly newsletter below.

Key developments by jurisdiction:

• Hong Kong SAR:

• The SFC now permits secondary trading of tokenised SFC-authorised investment products by retail investors, exclusively via on-platform auto-matching on licensed virtual asset trading platforms, with fair pricing, liquidity safeguards and seamless token transfer arrangements between primary and secondary markets.

• Mainland China:

  • The CAC and four other authorities jointly issued Interim Measures for the Administration of AI Anthropomorphic Interaction Services, effective 15 July 2026, regulating AI companionship and emotional-support services, prohibiting inducement of emotional dependency and restricting virtual intimate relationships for minors.

  • The CAC released draft Simplified Personal Information Protection Measures for Small Personal Information Processors, introducing simplified compliance obligations for businesses handling personal information of fewer than 100,000 individuals, including a more lenient enforcement stance for first-time minor violations. Read more. 

  • Eight government authorities, including the PBOC, the NFRA and the CSRC, jointly issued Measures for the Administration of Online Marketing of Financial Products, effective 30 September 2026, placing primary compliance responsibility on financial institutions and restricting non-bank payment institutions from listing financial products as payment options.

• Singapore:

  • MAS published a consultation paper proposing a more risk-sensitive prudential treatment for cryptoassets issued on permissionless blockchains, closing on 18 May 2026, which would allow banks to classify permissionless cryptoassets as Group 1 cryptoassets, subject to principle-based requirements and interim exposure and issuance caps.

• The CSA highlighted Singapore's public-private partnership approach to cybersecurity at GITEX Asia, noting the potential to develop sector-specific capability hubs in finance and referencing its collaboration with Google on Enhanced Fraud Protection, which has blocked more than 2.9 million potentially malicious installation attempts.

• Japan: 

  • The JFSA finalised and published a policy on strengthening cybersecurity in crypto-asset exchange businesses, aiming to ensure appropriate self-help measures by operators, promote industry-wide mutual assistance and provide certain public assistance support.

• UAE:

  • The UAE CMA issued a new VASP Rulebook (comprising a General Module and a Business Regulation Module) and an Alternative Trading System Module, requiring any person conducting VASP activities in or from the UAE in relation to virtual assets used for investment purposes to obtain a CMA licence, with Privacy Tokens, Algorithmic Tokens, Utility Tokens and NFTs prohibited.

  • VARA issued an updated Exchange Services Rulebook introducing a new Part V governing Exchange Traded Derivative Services, imposing obligations including client suitability requirements, mandatory account segregation, a maximum leverage cap for retail investors and additional rules for perpetual ETDs.

  • VARA issued new guidance on its Virtual Asset Issuance Rulebook, covering licensing requirements for virtual asset issuance, whitepaper disclosure obligations and additional compliance requirements for issuers of asset-referenced virtual assets.