On 23 May 2023, the Securities and Futures Commission (the SFC) published its much anticipated consultation conclusions (the Consultation Conclusions) on the proposed regulatory requirements for virtual asset (VA) trading platform operators (Platform Operators).  The new licensing regime for Platform Operators under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) will come into effect on 1 June 2023 (the VASP regime).   As a result of the VASP regime, all centralised VA trading platforms carrying on business in Hong Kong or actively marketing their services to Hong Kong investors, will need to be licensed by the SFC.

In response to the feedback from over 150 industry participants, certain changes and clarifications have been made to the draft Guidelines for Virtual Asset Trading Platform Operators (the VATP Guidelines) and the draft of Chapter 12 of the Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations and SFC-licensed Virtual Asset Service Providers) (the SFC AML Guidelines).  From 1 June 2023, all Platform Operators, whether licensed under the Securities and Futures Ordinance (the SFO), the AMLO, or both, will be subject to the VATP Guidelines and the SFC AML Guidelines.

The key takeaways from the Consultation Conclusions, including the key amendments and clarifications to the VATP Guidelines and SFC AML Guidelines, are set out below.

1. Retail access to licensed VA trading platforms

The SFC has confirmed that it will allow retail investors access to licensed VA trading platforms, subject to Platform Operators complying with various investor protection measures relating to onboarding, governance, disclosure and token due diligence and admission.

Client onboarding requirements

Except for institutional[1] and qualified corporate professional investors[2], Platform Operators are required to assess a client’s risk tolerance levels and assess whether it is suitable for a client to participate VA trading and set a VA exposure limit for each client. In addition, Platform Operators will also be required to assess a client’s knowledge in VAs, which could include an assessment of VA training or VA courses that the client has previously attended, the client’s current or previous work experience related to VAs and/or the client’s prior VA trading experience.  The SFC clarified that it expects Platform Operators to conduct a “holistic assessment of an investor’s understanding of the nature and risks of virtual assets”. In line with this position, the SFC has removed the presumption that clients possess VA knowledge if they have executed five or more transactions in any VAs within the past three years.

The SFC will issue further guidance on the onboarding requirements to address more specific aspects of the process, such as how to assess a client’s risk tolerance to VAs, in the form of FAQs.

Governance

The SFC clarified that persons “principally responsible” for managing different aspects of a VA trading platform, such as the key business line, compliance, risk management and information technology, will include the corresponding managers-in-charge (MICs) of the Platform Operator. The SFC will issue further guidance on the MIC regime in respect of licensed VA trading platforms, which will mirror that for traditional licensed corporations under the SFO.

Due diligence on VAs and disclosure obligations

A Platform Operator is required to conduct due diligence on each VA prior to admission for trading. The SFC has acknowledged that it may be difficult for a Platform Operator to obtain and verify all product specific information obtained from the relevant VA issuer (or through other sources).  Therefore, to adequately discharge its due diligence obligations, a Platform Operator will be required to take all reasonable steps to: (a) disclose the nature and risks of trading in VAs (instead of the more onerous obligation to make full disclosure of such risks); and (b) ensure that product-specific information disclosed to clients is not false, biased or deceptive (rather than the obligation to ensure that such information is not false, biased or deceptive) [emphasis added].

Token admission criteria and other token due diligence to be performed

Following the many respondents’ concern regarding the prescriptive nature of the due diligence requirements, the SFC has revised these to become more principles-based (with a note that further guidance will be released in due course). This should provide Platform Operators with greater flexibility given that the overall responsibility for a VA listing rests with them. Whilst the SFC has not agreed to exempt certain tokens from the due diligence requirements, it has agreed to the following relaxations:

  • A Platform Operator will only be required to consider the regulatory status of the relevant VAs in Hong Kong, rather than in each jurisdiction in which the Platform Operator provides trading services.  However, Platform Operators must still ensure that their operations are compliant with the local laws and regulations in all jurisdictions in which it (or its affiliates) operate.
  • A Platform Operator will be able to rely on a smart contract audit conducted by an independent assessor engaged by a third party (e.g. the VA issuer) provided that, in line with the previous proposal, the Platform Operator can demonstrate that it would be reasonable to do so.
  • As a cost-saving measure, the SFC has removed the requirement for Platform Operators to obtain and submit a legal opinion confirming that each VA made available for trading by retail clients would not amount to a “security” under the SFO.  However, the onus will be on a Platform Operator to take reasonable steps to ensure that retail trading of the relevant VA will not be in breach of the public offering regimes in Hong Kong[3]. Please note that the SFC may, as part of its approval process, request the Platform Operator to provide legal opinions on specific VAs in light of developments in other jurisdictions.

Notwithstanding pushback from the industry, the SFC has maintained its requirement for VAs to have at least a 12-month track record. The purpose of this is to reduce: (a) the risk of hard-to-detect fraud occurring; and (b) the impact that marketing efforts can have on the price of a VA in the lead up to its initial offering, especially since these offerings are generally unregulated and not subject to the safeguards present in traditional securities markets.

The Platform Operator must also take reasonable steps to ensure that the VA to be admitted for retail trading is of high liquidity. In assessing the liquidity of a specific VA, the SFC clarified that a Platform Operator must, at a minimum, ensure that the VA is an eligible large-cap VA, such that it is included in a minimum of two acceptable indices issued by at least two different index providers. The SFC also stressed that being included in two acceptable indices is not the sole criterion for admitting a VA for trading (i.e. it is only a minimum criterion) and that the Platform Operator should conduct further due diligence so as to comply with its token admission criteria.

The SFC appreciates respondents’ comments that it was not clear from the criteria which indices would be acceptable and that the specific token admission criteria will result in a small number of VAs being eligible for retail trading. The SFC has stated that it will not publish lists of VAs eligible for retail trading, acceptable indices or index providers.

Regarding the criteria of acceptable index providers, the SFC clarified that:

  • the relevant index providers should be separate and independent from each other, the VA issuer (if applicable) and the Platform Operator (e.g. they are not within the same group of companies); and
  • at least one of the indices should be issued by an index provider which complies with the IOSCO Principles for Financial Benchmarks and has experience in publishing indices for the conventional securities market.

Access to VA trading services

A Platform Operator should ensure that it complies with the applicable laws and regulations in the jurisdictions in which it provides services. It should have appropriate measures in place to: (a) disclose to its clients the jurisdictions which prohibit the trading of VAs; and (b) prevent persons from jurisdictions which have banned VA trading from accessing its services. These measures are broad in scope and go beyond what is expected in the traditional securities markets. The SFC has removed item (a) above from the VATP Guidelines, but has opted to retain item (b). Item (b) has been amended such that Platform Operators must also have measures in place to detect and prevent persons who are attempting to circumvent the relevant jurisdictions’ ban on VA trading from accessing its services.

Stablecoins

The SFC has confirmed that stablecoins will not be available for retail trading until they are subject to regulation in Hong Kong. The Hong Kong Monetary Authority published the consultation on its discussion paper on crypto-assets and stablecoins in January 2023, stating that the regulatory regime for stablecoins is expected to be implemented in 2023/2024. 

Other investor protection measures for retail clients

An express prohibition on gifts (with the exception of discounts on fees and charges) has been introduced. A cooling-off period, which some respondents had suggested, will not be introduced.

2. Maintaining an insurance or compensation arrangement

    The insurance and compensation arrangements received a large number of comments and pushback from market participants.  As a result, the SFC has agreed to lower the insurance coverage threshold to 50% for client VAs held in cold storage (instead of requiring full coverage), noting the requirement to keep 98% of client VAs in cold storage.  The requirement for full coverage of client VAs held in hot storage by the Platform Operator’s associated entity will remain in place.

    The SFC will allow the following types of assets to be included as part of the compensation arrangement (either alone or in combination):

    • third-party insurance;
    • reserve VAs (which must be held by the Platform Operator’s associated entity in cold storage on a segregated basis and of the same type as the client VAs covered under the compensation arrangement);
    • demand or fixed time deposit with a maturity of six months or less; and/or
    • bank guarantees provided by a licensed bank in Hong Kong.

    The relevant funds can be held:

    • in a segregated account with a licensed bank and segregated from the assets of the Platform Operator and its group company; and/or
    • by way of a third party escrow arrangement, provided that the Platform Operator provides the SFC with such party’s written acknowledgement regarding the designated purpose of these funds.

    Platform Operators will also have the flexibility to establish a pool of funds jointly or individually in the form of an insurer to cover the loss of client assets.

    3. Custody of client virtual assets

    Respondents suggested that the SFC should allow third-party custodians to safekeep client VAs given their extensive technical expertise. The SFC has rejected this proposal given that there is currently no regulatory regime in Hong Kong for VA custodians.  In addition, the SFC has re-confirmed that all seeds and private keys (and their backups) must be securely stored in Hong Kong with appropriate certification, such as a certified Hardware Security Module. 

    Despite the above, the SFC remains open to allowing Platform Operators to adopt different custody solutions provided that there is a consensus in the industry regarding their security and appropriate certifications for the solutions emerge.  

    4. Prohibited VA products and VA-related services

    Platform Operators will not be allowed (at least for now) to offer or allow any trading in VA derivatives.  The SFC has acknowledged the importance of VA derivatives to institutional and other professional investors for use in hedging, and will conduct a separate review in due course.

    The SFC confirmed the prohibition on:

    • proprietary trading by the Platform Operator[4].  Note that this prohibition extends to the Platform Operator’s group companies that conduct proprietary trading through the Platform Operator (whether on- or off-platform);
    • algorithmic trading services (though note that clients can use their own algorithmic trading systems in connection with trading via the licensed VA trading platform); and
    • earning, deposit-taking, lending and borrowing services.

    5. AML / CFT matters

    Implementation of the Travel Rule

    A number of respondents were concerned with the practical challenges of strictly adhering to the Travel Rule, namely the requirement to submit the required information about originators and recipients to the beneficiary institution immediately. The Travel Rule is a key AML/CFT measure for Platform Operators as it provides information for carrying out sanctions screening and transaction monitoring, and other risk mitigating measures.  The Financial Action Task Force requires member jurisdictions to implement the Travel Rule as soon as possible given that the sunrise issue[5] cannot be resolved until all Platform Operators and financial institutions in those jurisdictions comply with the Travel Rule.

    According to the Travel Rule, a Platform Operator is required to: (a) when acting as the ordering institution, obtain, hold and submit required information about the originator and recipient[6] to the beneficiary institution securely and immediately (i.e. the submission must occur before or when the VA transfer is conducted); and (b) when acting as the beneficiary institution, obtain from the ordering institution and hold the required information.

    The SFC acknowledged the practical challenges faced by Platform Operators in complying with the Travel Rule and, having regard to its implementation status in other major jurisdictions, will implement interim measures (to be in place until 1 January 2024) allowing Platform Operators to submit the required information to a beneficiary institution as soon as practicable after the VA transfer[7].

    The SFC has refined the requirements governing transfers to or from unhosted wallets, such that before a Platform Operator sends or receives VAs to or from an unhosted wallet on behalf of a client, it must obtain the required originator and recipient information from the customer. It must conduct sanctions screening and accept transfers from unhosted wallets that are assessed to be reliable, having regard to the screening results of the VA transactions, the associated wallet addresses and the ownership or control of the unhosted wallet[8]. 

    Since the ownership or control of an unhosted wallet may change over time, the SFC has also clarified that similar screening and assessments should be conducted on a unhosted wallet which has previously been whitelisted on a periodic and risk-sensitive basis, particularly when the Platform Operator becomes aware of any increased money laundering (ML) / terrorist-financing (TF) risk from the ongoing monitoring of transactions conducted through the unhosted wallet.

    VA transfer counterparty due diligence and additional measures

    In relation to the ongoing monitoring of VA transfer counterparties, a Platform Operator should adopt a risk-based approach when screening VA transfers. The SFC clarified that a Platform Operator should conduct due diligence on the entity which the Platform Operator conducts VA transfers with and, where transfers are conducted with multiple counterparties that belong to the same group, separate due diligence should be conducted on each such counterparty[9].

    Risk-based policies and procedures for handling incoming VA transfers lacking the required information

    Several respondents raised concerns about returning VAs to the originator for VA transfers that lack the required information. The SFC clarified that a Platform Operator should only return the relevant VAs having satisfied itself, after conducting the necessary due diligence and screening, that there is no ML or TF risk. Further, the SFC also stressed that the Platform Operator should return the relevant VAs to the account of the ordering institution or the intermediary institution from which it received the transfer instruction (instead of the originator’s account).

    Other amendments / clarifications to the SFC AML Guidelines

    The SFC also made the following clarifications (and where applicable, the corresponding amendments) to the SFC AML Guidelines:

    • Regarding the scope of application of cross-border correspondent relationships, a Platform Operator is required to conduct ongoing monitoring of VA transactions of the respondent institution and the associated wallet addresses.
    • To enable a Platform Operator to identify the source and destination of VAs and assess whether the relevant wallet addresses are associated with illicit or suspicious activities or parties, the Platform Operator should conduct screening of VA transactions and/or the associated wallet addresses before conducting such transfer, or before making the transferred VAs available to the client, and after conducting the VA transfer on a risk-sensitive basis.

    6. Licensing and transitional arrangements

    Given that the terms and features of VAs may evolve over time, a VA’s classification may change from a non-security token to a security token or vice versa.  As such, the SFC stated that it would be prudent for Platform Operators to be dually licensed under both the SFO regime and the VASP regime to avoid business disruption or contravention of the licensing regimes.  To simplify the application process in respect of applicants for dual licenses, the SFC will adopt a streamlined application process so that for these applications, only a single consolidated licensing application will need to be submitted to the SFC.

    Questions were raised as to whether a responsible officer applicant would need to meet the relevant industry requirements under both the VATP Guidelines (i.e. in respect of the operation of a VA exchange) and the Type 1 and Type 7 regulated activities (i.e. traditional securities trading and operation of automated trading services). The SFC acknowledged the difficulties in hiring individuals with both VA and traditional securities experience and clarified that an individual may be concurrently approved under both the SFO and AMLO regimes. As a result, a dual-licensed Platform Operator will not need to hire four responsible officers. The SFC will adopt a pragmatic approach when interpreting the competence requirements in this situation and will provide further guidance on this in due course.

    7. Implementation timetable

    The SFC will proceed to publish the amended VATP Guidelines and the SFC AML Guidelines in the Gazette, which will take effect on 1 June 2023.  Further guidance will be published by the SFC to enable the industry to better understand the particulars of this new licensing regime.

    [1] An “institutional professional investor” refers to a person falling under paragraphs (a) to (i) of the “professional investor” definition under the SFO. 

    [2] A “qualified corporate professional investor” refers to a corporate professional investor which has passed the assessment requirements under paragraph 1 of Schedule 1 to the VATP Guidelines and gone through the procedures under paragraph 2 of Schedule 1 to the VATP Guidelines.

    [3] Part IV of the SFO and Parts II and XII of the Companies (Winding Up and Miscellaneous Provisions) Ordinance.

    [4] Save for off-platform back-to-back transactions entered into by the Platform Operator and circumstances permitted by the SFC. The SFC did not clarify the circumstances in which it would permit proprietary trading.

    [5] The “sunrise issue” refers to the period when the Travel Rule is not in effect across jurisdictions, causing difficulties for virtual asset service providers trying to comply with the rule.

    [6] “required information” includes information such as the originator’s name and identification details, account details with the ordering institution or the unique reference number assigned to the VA transfer assigned by the ordering institution, and the recipient’s name and account details etc.

    [7] This will mean that the relevant requirements under paragraphs 12.11.10 and 12.11.13 under SFC AML Guidelines will take effect on 1 January 2024.

    [8] Paragraph 12.14 of the AML Guidelines has been amended to reflect this.

    [9] Paragraph 12.13 of the AML Guidelines has been amended to reflect this.