The Hong Kong Securities and Futures Commission (SFC) has released its eagerly awaited conclusions (Consultation Conclusions) to its consultation on its proposed rules to be implemented under Hong Kong’s new virtual asset exchange licensing regime (VA Licensing Regime).
The Consultation Conclusions set out regulatory requirements applicable to the VA Licensing Regime in the form of various draft guidelines (Regulatory Requirements). Over 150 industry participants, including King & Wood Mallesons, provided written submissions, indicating the importance of the new regime and ensuring appropriate balance in the rules regulating the industry are applied.
This alert gives you a snapshot of the key things you need to know about the Consultation Conclusions and Regulatory Requirements and the key next steps for exchanges.
It is structured as follows:
Please contact us anytime if you would like to discuss. We have a large team working with clients to ensure they are ready for the transitional arrangements and full licensing. We’re also actively working with industry bodies and clients on the consultation.
Part A – Snapshot of key changes
The following chart shows the key areas that changed in response to industry feedback. To its credit, the SFC took on board multiple suggestions and in some cases applied a pruning approach, paring back certain requirements to better reflect the “same activity, same risk, same rules” principle.
Part B - Key points to know
What is the VASP Licensing Regime?
The VA Licensing Regime commences on 1 June 2023. The Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) sets out the overarching requirements and framework underpinning the VA Licensing Regime.
The Regulatory Requirements represent more granular compliance requirements that licensees (Licensed Providers) need to comply with in connection with the VASP Licensing Regime.
A snapshot of the VA Licensing Regime is available here.
Important! Not all virtual asset activities are caught by the VA Licensing Regime – a significant number of activities will remain unregulated in Hong Kong, but care is required. The securities and futures, money services, stored value, lending, custody and gambling restrictions may apply.
Scope of the Regulatory Requirements
The Regulatory Requirements are a unified framework for exchanges licensed under the AMLO and the Securities and Futures Ordinance (SFO) to ensure there is a consistent approach across the industry.
The Regulatory Requirements take the form of four key guidelines:
Further guidance
On the eve of the new regime, the SFC also issued the following circulars:
- Circular on implementation of new licensing regime for virtual asset trading platforms (Circular on Implementation).[1] This links the FAQs on licensing and conduct-related matters, the Licensing Handbook for Virtual Asset Trading Platform Operators, and licensing and ongoing notification forms. In short, it links all the key rules.
- Circular on transitional arrangements of the new licensing regime for virtual asset trading platforms (Circular on Transitional Arrangements).[2] This is generally consistent with the Consultation Conclusions, but has some important clarifications for anyone seeking to rely on transitional relief.
These circulars aim to assist applicants with their completing their applications and provide further guidance on the Regulatory Requirements.
Key topics covered
The Regulatory Requirements cover minimum standards across the following areas:
In some instances, the requirements impose obligations on the Licensed Provider to ensure its affiliates (for example, its Associated Entity[3] holding client assets), satisfy certain minimum standards.
What else do I need to know?
Applicants and Licensed Providers must comply with the Regulatory Requirements.
Importantly:
- Regulatory Requirements are mandatory. The Regulatory Requirements do not generally have the force of law, but will affect the interpretation of the AMLO and the ability to obtain and retain a licence. Failure to comply may result in disciplinary action and the refusal or loss of a licence (if a person is considered no longer “fit and proper”). Compliance with the VATP Guidelines will be imposed as a licence condition on Licensed Provider’s licence. In this way, Licensed Providers are expected to comply with the Regulatory Requirements strictly, as licensees.
- Regulatory Requirements will supersede previous virtual asset exchange requirements. The SFC will regulate the trading of security tokens via the existing securities licensing regime (SFO regime) and regulate non-security token trading under the VA Licensing Regime. The VATP Guidelines, which is the key guideline in the Regulatory Requirements will apply to all Licensed Providers under both regimes. This means they will supersede the existing rules for exchanges licensed under the SFO, which we wrote about here. The SFC has encouraged exchanges to apply for both AMLO and SFO licences, but this is not strictly mandatory.
- Consolidation of requirements rather than total re-write. The Regulatory Requirements are long but consolidate many existing SFC concepts and requirements such that they are not totally new and unfamiliar. For example, the SFC has incorporated its guideline on competence into the VATP Guidelines, albeit some modifications to reflect virtual asset practices and some greater flexibility. This means that many of the requirements are not surprising, although a close review is necessary.
Important note for other SFC and HKMA regulated entities
The SFC states that amendments to the joint circular on intermediaries’ virtual asset-related activities issued by the SFC and the HKMA on 28 January 2022 will be made. This is to ensure that consistent requirements across the frameworks administered by the SFC.
Part C – A closer look at key thematic areas of the consultation
The following table summarises some of the most topical Regulatory Requirements:
Company requirements
|
Key requirement
|
Further detail
|
Example
uses 2
|
|
Who needs to be licensed? |
At a high level, the VA Licensing Regime captures centralised automated trading systems for virtual assets, where those assets come into the custody of the operator. The SFC has confirmed that certain over-the-counter and brokerage models will generally be out of scope. Past guidance has also noted that order routers, bulletin boards and peer-to-peer platforms are not generally caught. This makes the regime a narrow one and will leave multiple platforms out of scope. The SFC pre-vets and oversees the Licensed Provider, plus their responsible officers (ROs) and licensed representatives (LRs). In addition, there is indirect oversight of substantial shareholders / owners, directors, other personnel and the Associated Entity that must hold its client assets. More on this below. |
|
|
Position on key activities |
Exchanges will be largely limited in relation to their exchange functions. The SFC has formed a view on several key points of particular interest to the market:
There is also a restriction on the platform from conducting market making activities. However, the Regulatory Requirements signal there may be “other circumstances permitted by the SFC on a case-by-case basis” in which proprietary trading may be permitted. Affiliates of the Licensed Provider can perform market making activities on platforms other than the Licensed Provider’s platform.
|
|
|
Pathway for retail |
Retail investors will be able to participate, but have more protections in place. Several requirements will capture all individuals regardless of net worth (ie high net worth individuals are treated the same). Overall, there has been significant progress made on retail participation across multiple public and private consultations. A few key points:
|
|
|
Client asset protection |
Protection of client assets has long been a key focus area for the SFC. The key requirements include the following:
This compensation may not necessarily solely be in the form of insurance, but could include appropriate money (held as a deposit, or time deposit with maturity of 6 months or less), virtual assets or bank guarantee provided by a Hong Kong licensed bank. In essence, the cover between insurance and the Licensed Provider’s other reserve amounts funds must always exceed the Compensation Amount. Specific rules apply to the manner in which cash and virtual assets are held. As to the breakdown between insurance and the reserve funds, the SFC has granted the Licensed Provider flexibility to determine this, subject to satisfying the above. The compensation arrangements need to be reviewed and reconciled daily to ensure that clients are always adequately protected. Changes to the compensation arrangement must be pre-approved by the SFC.
|
|
|
Financial resources |
Licensed Providers are required to maintain adequate financial resources, including paid-up share capital of at least HKD5,000,000 and liquid capital of at least HKD3,000,000. The Regulatory Requirements also stipulate holding liquid assets equivalent to at least 12 months of actual operating expenses. Critically, virtual assets are not counted. Complex additional rules apply to ensure adequacy. |
|
|
AML/CFT compliance controls |
As expected with an AMLO regime, the Licensed Provider is required to maintain adequate anti-money laundering and counter-terrorist financing (AML/CFT) policies, procedures and controls. This will in practice mean developing strong written policies and procedures for risk-based customer due diligence at onboarding, periodically and on trigger events, name screening, sanctions compliance, transaction monitoring and record keeping. The key VA industry specific requirements are set out in Chapter 12 of the Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations and SFC-licensed Virtual Asset Service Providers) (AML/CFT Guideline), plus a thematic version for Associated Entities. Key points are summarised as follows. Compliance with the Travel Rule Similar to traditional wire transfer rules, Licensed Providers, whether as ordering, intermediate or beneficiary institution, are required to obtain, record and submit, as appropriate to the role, prescribed information relating to the originator and beneficiary (known as the Travel Rule). The SFC has taken onboard industry feedback that the technology to comply with travel rule fully is not widely available by allowing a “grace” period to 1 January 2024, during which time the information required to be sent can be provided “as soon as practicable” rather than prior to, or with, the transfer. Under the SFC’s traditional wire transfer rules, the only obligation on what to do with the information collected is to screen the parties involved in a cross-border transfer. The obligations on Licensed Providers under the Travel Rule go further than list screening (though screening is required). Licensed Providers are also required to have procedures to establish whether the counterparty is a VA transfer counterparty or an unhosted wallet with the requirements then flowing from the distinction. The first obligation for VA transfer counterparties is to identify whether the counterparty is “eligible” to deal with. The “eligibility assessment” includes understanding the:
Senior management approval is also required. In addition, Licensed Providers are required to assess whether the VA transfer counterparty can comply with the travel rule and conduct a form of risk assessment on the counterparty similar to a client risk assessment. Overall, the requirements are similar to those that apply to cross-border correspondent relationships and the AML/CFT Guideline directly references those rules as providing further guidance on conducting due diligence. Although onerous, due diligence only needs to be conducted on the VA transfer counterparty on the first transaction, unless there is a suspicion of ML/TF and then periodically as part of ongoing monitoring, it is not required on each transaction. For VA transfers to or from unhosted wallets, “extra care” is required. The same originator and recipient information must still be collected before the transaction takes place and a risk assessment must be conducted. Additional risk mitigation steps To mitigate the non-face-to-face nature of onboarding expected to be adopted by most Licensed Providers, they are encouraged to obtain the IP address with an associated time-stamp, geo-location data and device identifiers. The SFC has also introduced the rule that the digital identity system “iAM Smart” can be relied upon (without other additional measures) to verify the identity of individual customers who are not physically present. This applies to all financial institutions in Hong Kong that are regulated by the SFC or the Hong Kong Monetary Authority. Transaction monitoring On-chain analytics tools are expected to be used that:
New FAQs On 25 May 2023, the SFC also published new FAQs confirming:
|
|
Fit and proper requirements
|
Key requirement
|
Further detail
|
Example
uses 2
|
|
Fit and proper details - general |
The corporate applicant, officers of the applicant (including ROs, LRs, and directors), and the “ultimate owners” of the applicant must be “fit and proper”. The SFC has set out its prescriptive factors to assess whether a person is “fit and proper”. The criteria largely mirrors existing SFC requirements from the SFO regime, adapted to suit the virtual asset context. Several of the key factors include the financial status of the person, education and qualification and industry experience of the person, the ability to act competently, honestly and fairly, their reputation and character, and any there has been serious convictions (especially relating to AML/CFT or matters going to honesty and probity). The SFC has provided guidance as to what it will consider as part of each of these factors. |
|
|
Guidance on competence |
Competence forms a key pillar of the fit and proper assessment. The SFC has provided detailed guidance on the matters it will ascertain if a person is competent, and therefore “fit and proper”. In particular, in the context of the corporate applicant, the SFC will consider the applicant’s business model, governance arrangements, staff competencies, resources, internal controls, risk management framework, operations, and compliance framework as part of the application process. Licensed persons must be able to demonstrate that they satisfy the following competence requirements, which are more stringent in respect of responsible officers:
The precise exams that need to be taken depend on satisfaction of the other competence requirements and whether the person is a licensed representative or responsible office but by and large, the expectation is that regulated persons will sit the necessary RIQ or LRP, unless an exemption applies. Exemptions to RIQ and LRP requirements The SFC has introduced several exemptions to the RIQ and LRP requirements. The SFC will consider granting discretionary exemptions if the relevant person has comparable qualifications or industry experience, or the person agrees that they will pass an LRP within six months of the approval. Such discretionary relief may include the imposition of conditions. The SFC has also set out a list of full and condition exemptions from RIQ and LRP that responsible officers and licensed representatives may seek to rely on. Most of the exemptions are premised on the person having already the requisite industry qualification or local regulatory knowledge, either through past experience or holding the same licences. |
|
External attestations
Besides audit, the SFC requires external assessment reports (“EARs”) conducted in two parts:
- Phase 1 (attestation of policies and procedures): At the time of application
- Phase 2 (attestation of systems / implementation): Following approval-in-principle
The SFC accepts that EARs can be provided by those assisting applicants with their procedures.
If you are intending to apply for a licence soon, it is essential to start work as soon as possible to ensure your policies and procedures reflect the full gamut of the Regulatory Requirements and then fine-tuned as necessary to reflect the final version, to enable the EARs to be delivered in time. We are already working with several clients and have a full compliance suite available.
Disciplinary action
The SFC also sets out Disciplinary Fining Guidelines under Appendix D of the Consultation Conclusions. The Guidelines indicate the manner in which the SFC will exercise its power to impose fines on regulated persons guilty of misconduct, or where regulated persons are, or were not, fit and proper. The Guidelines are based on both the SFO Fining Guidelines and the AMLO Fining Guidelines. SFO-licensed VA trading platforms and AMLO-licensed VA trading platforms will be subject to the same fining criteria irrespective of the ordinance under which they are licensed.
The SFC does not provide a list of factors for determining whether to take disciplinary action against a corporation, an individual or both. The SFC will consider all the circumstances including the conduct of the corporation and individual in question and, in relation to those involved in the management of a corporation, whether there is any consent, connivance or negligence on their part, any failure in supervision, or the management of business.
Part D – Transitional arrangements
The AMLO contemplates exchanges operating in Hong Kong at the commencement of the VA Licensing Regime will obtain the benefit of certain provisions while they either apply for a licence or wind down their activities.
There are two aspects to the transition arrangements, summarised below:
|
GRACE PERIOD FOR EXISTING OPERATORS
|
DEEMING ARRANGEMENTS
|
Example
uses 2
|
|
A person will not contravene the requirement to hold a licence for the period until 1 June 2024 if the:
|
The VA Licensing Regime proposes a mechanism to deem persons as licensed, while their application is being assessed. An existing virtual asset exchange will not be considered to have contravened the AMLO and SFC rules between 1 June 2023 and 31 May 2024, if certain prescribed conditions are met. This means they will be able to continue to operate until they are licenced. See our alert (here) for a full list of the applicable conditions. Following this, if a person’s application is still being assessed, a person will be deemed licensed from 1 June 2024 until that application is formally approved (unless withdrawn or rejected). |
|
The original SFC Consultation Paper provided further guidance on the eligibility requirements to be deemed licensed, and a breakdown of key dates and implementation details, as we reported here. We also provide a transitional checklist here. The Circular on Implementation and Circular on Transitional Arrangements also provides further guidance.
If a virtual asset exchange is not eligible, then from 1 June 2023, it must not perform any virtual asset services in Hong Kong until its licence application is approved.
SFC registers
The SFC proposes to maintain public registers covering licensed, deemed licensed, closing-down and unlicensed platforms. The last of these is perhaps the most challenging in practice, given the limits of the proposed VA Licensing Regime and complex interpretational questions. We expect this to be a focus area in consultation responses to ensure fairness while still protecting the public from unscrupulous actors.
Part E – Next steps
From here, the next key milestone is for exchanges to get ready to lodge an application.
We encourage those seeking to apply for a licence to take steps to:
- check the nature and scope of your business;
- check that you and your proposed regulated individuals are eligible for the transitional arrangements;
- prepare a high quality licence application – application forms are set out in the Circular on Implementation and all applications must be submitted via the SFC’s “WINGS” portal;
- ensure policies, procedures and operations are in place;
- create all necessary compliant client agreements and disclosures; and
- arrange external legal opinions and EARs.
Other market participants, such as SFC-licensed corporations and HKMA-regulated banks will also need to consider the impacts of the new regime on their relationships with virtual asset exchanges and onboarding procedures.
Please contact us to discuss, anytime.
In this article:
- “Hong Kong” or “Hong Kong SAR” should be construed as a reference to “Hong Kong Special Administrative Region of the People’s Republic of China”.
- The Mainland of China is described as “Mainland China”.
Reference
[1] https://apps.sfc.hk/edistributionWeb/gateway/EN/circular/intermediaries/licensing/doc?refNo=23EC28
[2] https://apps.sfc.hk/edistributionWeb/api/circular/openFile?lang=EN&refNo=23EC27
[3] As defined in paragraph 1.1 of the VATP Guidelines to mean “a company which (i) has notified the Securities and Futures Commission (SFC) that it has become an “associated entity” of a Platform Operator under section 165 of the Securities and Futures Ordinance (Cap. 571) (SFO) and/or section 53ZRW of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) (AMLO); (ii) is incorporated in Hong Kong; (iii) holds a “trust or company service provider licence” under the AMLO; and (iv) is a wholly owned subsidiary of the Platform Operator.”
