In the wave of digital economy where AI and blockchain are deeply integrated, data-related RWA (Real World Assets) is becoming the core link between the real economy and global capital markets. By 2025, the global RWA tokenization market size has surpassed $2 trillion, with an annual growth rate as high as 187%. As the core value anchor, the compliant circulation and innovative application of data assets become the key to breaking the industry deadlock. This article combines the latest regulatory policies and benchmark cases to systematically analyze the regulatory framework, compliance paths, technical architecture, and development logic of data-related RWA, providing practical guidance for enterprises to issue in Hong Kong and layout cross-border operations.
I. Core understanding and regulatory environment of data-related RWA
(I) Product definition and dual attributes
Data-related RWA is a financial product that tokenizes personal information, corporate data assets, and related revenue rights through blockchain technology, with the core characteristic of value anchoring data elements rather than traditional physical or financial assets. It has dual attributes: the financial attribute requires compliance with issuance regulatory rules from institutions such as the Securities and Futures Commission and the China Banking and Insurance Regulatory Commission, while the data attribute must strictly comply with data protection requirements such as the (Cybersecurity Law), (Data Security Law), and (Personal Information Protection Law), achieving full-process compliance in on-chain rights confirmation, pricing, and trading through smart contracts.
(II) Hong Kong regulatory framework and market status
Hong Kong, as an international financial center, has an open and prudent regulatory attitude towards RWA, clearly categorizing it as a 'security' regulated by the (Securities and Futures Ordinance), adhering to the principle of 'same business, same risk, same rules' in penetrating regulation. Issuers and distributors must hold a license from the Hong Kong Securities and Futures Commission and fully disclose product terms and risk information to protect investors' right to know (Hong Kong Monetary Authority Circular on (Sale and Distribution of Tokenized Products) issued in February 2024).
Currently, there are mature practices for domestic assets issuing RWA in Hong Kong, with successful projects such as the charging pile project in collaboration with Ant Financial and the photovoltaic project with Xiexin Energy, providing a reference for compliance models for data-related RWA. It is worth noting that Hong Kong will launch a 'Green and Sustainable Finance Subsidy Program' in 2024, prioritizing support for RWA projects, which has attracted over 50 institutions to settle in, becoming an innovation hub for RWA in the Asia-Pacific region.
(III) Core requirements for cross-border regulation
• China's data exit framework: Centered on the 'three laws', paired with (Regulations on Promoting and Regulating Cross-Border Data Flow) (effective March 2024) and compliance guidelines for promoting and regulating cross-border data flow in the financial industry by six ministries including the central bank, forming a regulatory system of 'classified and graded protection + multiple compliance paths + specific scenario exemptions', where 47 financial business scenarios can be exempted from reporting safety assessments and other procedures, loosening restrictions for cross-border financial innovation.
• Compliance for international investors: Must adapt to the data protection requirements of different jurisdictions, ensuring that the laws of the region where the overseas recipient is located do not affect the execution of standard contract terms, while dynamically adapting to global regulatory differences through AI technology to reduce cross-border compliance friction.
II. Core operational guidelines for compliance with China's data exit
(I) Data classification and grading basis
Data-related RWA involves data that must be accurately classified into three categories as a prerequisite for compliance path selection:
1. Personal information: Various information related to identifiable natural persons (excluding anonymized processing), must strictly follow the requirements of 'informed consent' and privacy protection;
2. Corporate data assets: Data resources collected and generated in corporate operations that can bring economic benefits and are legally controlled must meet the criteria for inclusion in the (Interim Regulations on Accounting Treatment of Corporate Data Resources) (effective January 2024);
3. Data product revenue rights: Economic benefits generated from data sales, authorized use, etc., must define the legal rights of all parties based on data sources and clarify the revenue distribution mechanism.
(II) Four major compliance path choices (including applicable scenarios)
1. Data exit security assessment (SA): Core applicable to three scenarios—cross-border provision of data by critical information infrastructure operators; involving important data (such as industry operation data, core financial business data, high-value AI training data, etc.); accumulating provision of personal information of over 1 million people or sensitive personal information of over 10,000 people to overseas, must be reported to the national internet information department through provincial internet information departments.
2. Standard Contract for Cross-Border Personal Information (SCC): Applicable to scenarios where between 100,000 and 1 million personal information (excluding sensitive information) or fewer than 10,000 sensitive personal information are provided cumulatively. The contract must clearly outline the rights and obligations of both parties and the protection of data subjects' rights.
3. Personal information protection certification: The scope of application is consistent with SCC, requiring compliance evaluation by a specialized certification body, which can serve as compliance certification for cross-border data flow.
4. Exemption scenarios: Including four types of contract performance scenarios such as cross-border payments and account opening, cross-border human resource management, emergency escape needs, as well as scenarios where fewer than 100,000 personal information (excluding sensitive information) are provided cumulatively, can be exempted from the above compliance procedures.
(III) Additional compliance obligations
• Providing personal information to overseas must fully inform the receiving party about the information, processing purposes, etc., and obtain separate consent from individuals (the same applies to sensitive personal information);
• Complete personal information protection impact assessment (PIA) in advance, focusing on evaluating the legality of processing behaviors, the impact on rights, and the effectiveness of security measures.
III. Technical architecture and landing path (based on benchmark project practice)
Combining successful cases such as Ant Financial and Xiexin Energy, data-related RWA can adopt a 'compliance first, technology adaptation' architectural design, which includes three core modules:
1. Cross-chain technical solution: Following the principle of 'data not leaving the country, hash values crossing borders', the complete operational data of domestic alliance chains generates a unique irreversible cryptographic hash value, mapped to overseas public chains and bound with RWA tokens, meeting the regulatory requirements for data exit while achieving trusted verification on-chain. The integration of AI and Zero-Knowledge Proof (ZKP) technology can complete the verification of asset authenticity while protecting privacy, further enhancing compliance security.
2. Dual-layer SPV structure: Adopting a 'domestic asset SPV + overseas/Hong Kong SPV' dual-layer structure, paired with the 'asset chain + transaction chain + cross-chain bridge' system, achieving compliant issuance through asset isolation and cross-border mapping. This type of structure can reduce compliance costs by 30% and meets the regulatory requirements of Hong Kong SFC.
3. Intelligent revenue distribution mechanism: Implement revenue automatic distribution through smart contracts to ensure accuracy and timeliness; simultaneously, real-time business data such as charging volume and revenue will be on-chain to ensure investors' right to know. The involvement of AI technology can achieve second-level asset valuation and dynamic pricing, compressing the traditional rights confirmation cycle from months to seconds, greatly improving operational efficiency.
It should be noted that although the above model has been verified by new energy projects, the scenario adaptability of data-related RWA still needs careful assessment. It is recommended to complete reporting and filing as required to avoid compliance risks.
IV. Industry outlook and core judgments
The explosive growth of data-related RWA is not accidental; its essence is the reconstruction of asset value under the synergy of AI and blockchain technology—AI achieves precise data valuation and risk control, while blockchain builds a trusted transaction system. The combination reduces the financing cost of supply chain finance by 40% and shortens the cross-border arrival cycle from 3 months to 72 hours. However, whether the industry can continue to develop healthily still returns to the essence of business: it must focus on 'improving financial efficiency and reducing financial costs' as the core goal, rather than merely serving as a financing tool.
In the future, with the unification of technological standards and the coordination of regulatory policies, data-related RWA will accelerate penetration in various fields such as new energy, cultural IP, and green finance. For enterprises, it is essential to grasp the three principles of 'compliance first, technology empowerment, scenario adaptation', ensuring precise matching with domestic and foreign regulatory requirements, while leveraging AI and blockchain technology to release the value of data elements. As industry consensus indicates, only by balancing innovation vitality and compliance bottom line can one occupy core competitiveness in the $30 trillion RWA market.