Turn banks into your customers
With 174 banks in Hong Kong and 70+ of the world's top 100 present, it's an extremely dense pool of institutional buyers. There are several clear doors to selling to banks: Open API, the Commercial Data Interchange (CDI), the regulatory sandbox, GFT, bank accelerators, and vendor procurement. But a POC is not a contract, cycles run six months to a year and a half, and procurement compliance is a real barrier.
You work in fintech / data / compliance (RegTech) / risk control / cybersecurity / AI data analytics and want banks as B2B customers.
What you need is to open an account or get a loan — that's an entirely different matter (see account opening & pitfalls / financing guarantees).
Buyer profile
- 174 authorized institutions (147 licensed banks, 115 of them incorporated outside Hong Kong), with 70+ of the world's top 100 banks present — an extremely dense, internationally-dominated pool of buyers.
- Compliance and anti-money-laundering (RegTech), credit / risk control and alternative data, customer experience and digitalization, payments, cybersecurity, and AI / data analytics.
- A single purchase needs sign-off from the business sponsor + IT + risk + compliance + procurement — one person being 'interested' is nowhere near enough.
HKMA Open API framework[S13]
Become a TSP and connect to banks' APIs; the HKAB Common Baseline simplifies onboarding. Phases I–II (product information + customer acquisition) are done; phases III–IV (accounts + transactions) are rolling out bank by bank.
Who it's for: Customer acquisition, account / transaction, and price-comparison aggregation plays
Commercial Data Interchange (CDI)[S13]
HKMA's consent-based data infrastructure, where the bank is the data consumer connecting via API. Real POCs: PAOB × TradeLink, Standard Chartered × GS1, HSBC × HKTVmall.
Who it's for: Credit / trade-finance / alternative-data plays
Fintech Supervisory Sandbox (FSS)[S19]
Pilot in a controlled environment with a partner bank, gaining real data plus a regulatory endorsement.
Who it's for: Solutions needing validation in a real environment
GFT Global Fast Track[S81]
InvestHK's flagship programme: banks / insurers act as Corporate Champions, assessing startups and offering POC opportunities; 8 verticals, 120+ corporate and investor champions, with the grand finale at FinTech Week; 2026 applications close around September.
Who it's for: Startups that want to be seen directly by institutions
Banks' own labs / accelerators[S57]
The respective fintech partnership programmes of HSBC, Standard Chartered's eXellerator, DBS, BOCHK, and others; plus Accenture's FinTech Innovation Lab Asia-Pacific (a multi-bank accelerator for growth-stage startups, run in Hong Kong).
Who it's for: Those with a finished product wanting deep co-creation
Vendor onboarding / procurement (RFP)[S57]
The most formal and the most compliance-heavy: you must pass vendor due diligence (third-party risk management, TPRM) and information-security review (e.g. ISO 27001 / penetration testing).
Who it's for: Mature solutions that already hold the compliance credentials
Ecosystem and events[S80]
FinTech Week (every November, HKCEC, 45,000+ attendees), FTAHK, and the HKSTP / Cyberport communities — find the right decision-makers at the events.
Who it's for: Early-stage players looking for a way in
- 1
Pick the 1–2 doors that fit best
Don't cast a wide net.
Pitfall: Pursuing all seven doors at once spreads your resources thin and they all come to nothing.
- 2
Find an internal champion
Someone inside the bank willing to push for you internally — almost the deciding factor.
Pitfall: Relying on cold emails alone is essentially useless.
- 3
Prepare your materials
Information-security / compliance documentation, reference cases, and a clear ROI.
Pitfall: Without security credentials, even the best solution gets stuck at procurement.
- 4
A small-scale POC
From the outset, clarify the success criteria and the path to a full contract.
Pitfall: The POC finishes and then nothing happens ('POC hell').
- 5
Pass risk control / procurement
The stage most likely to stall.
Pitfall: A veto from any one of IT / risk / compliance / procurement stops it.
- 6
Sign → make the first bank your reference
Use it to lever in the next one.
Pitfall: The first reference is the hardest but the most valuable — don't rush it.
A POC is not a contract· First-hand insight in the works
It's common for a pilot to finish with no follow-up; clarify the path to a full contract from the start
Cycles run six months to a year and a half· First-hand insight in the works
Don't count on it to prop up short-term cash flow
Procurement and compliance are real barriers· First-hand insight in the works
Without information-security credentials and without passing third-party risk due diligence, even the best solution gets stuck at the procurement gate
Cold emails are essentially useless· First-hand insight in the works
You almost always need a referral or an internal champion — the value of the sandbox / GFT / accelerators is precisely that they give you a way in
Don't trust agents who 'guarantee' a bank deal or sandbox entry· First-hand insight in the works
Such promises are a red flag
- 01In credit / data → study CDI and work out what data you can provide or consume.
- 02In customer acquisition / accounts → go via Open API and become a TSP.
- 03Want an endorsement + a way in → pick one of the sandbox / GFT / bank accelerators to enter through.
Source correction: the Open API framework is run by the HKMA (S13), not HKSTP; S20 should be labelled as HKSTP's fintech ecosystem / community.