After much anticipation, draft legislation has been released to provide a framework for licensing virtual asset exchanges in Hong Kong.
This alert tells you what you need to know about the licensing regime (VA Licensing Regime), and what it means for your business.
It is structured as follows:
- Part A – Snapshot of VA Licensing Regime
- Part B – VA Licensing Regime: the detail
- Part C – Implementation and transition arrangements
- Part D – What you need to do, and keep an eye out for?
The Securities and Futures Commission (SFC) will be the key regulator of the VA Licensing Regime and will be publishing implementing guidelines in the coming months. The SFC is a member of the International Organization of Securities Commissions (IOSCO) which has also just published its own roadmap for the sector (IOSCO Roadmap). The IOSCO Roadmap is likely to shape Hong Kong’s future trajectory so will be highly relevant to business planning. We provide a brief summary at the end.
Part A – Snapshot of the VA Licensing Regime
The draft bill to amend the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) (AMLO) provides a framework to licence companies that operate virtual asset exchanges in, or market them to, Hong Kong (Draft Law). The SFC will oversee the VA Licensing Regime.
The VA Licensing Regime builds on proposed framework published by the Financial Services and the Treasury Bureau (FSTB) in May 2021 set out in their consultation conclusions (see our previous alert here) (Consultation Conclusions). There are no drastic changes from the Consultation Conclusions, but some critical details are now available.
The Legislative Counsel brief (LegCo Brief) accompanying the Draft Law makes clear that the key drivers of the VA Licensing Regime are to bring Hong Kong up to speed with Financial Action Task Force (FATF) standards and other jurisdictions in respect of virtual asset regulation. A summary of the FATF standards that are driving a swathe of changes globally is set out in our KWM FATF 2019 synopsis. We delved into the most recent FATF focus areas in our Building a Legal Architecture for the Metaverse Report.
The VA Licensing Regime commences on 1 March 2023, with transition arrangements set out in the Draft Law (see Part C for further details). As noted above, the SFC will be the key regulator - its standards will be pivotal to the precise operation of the regime. Those details will come later this year.
Part B – VA Licensing Regime: the detail
In this section, we explore:
- the scope and key concepts
- licensing requirements
- ongoing requirements
- ancillary offences
Scope and key concepts
The overarching licensing requirement underpinning the VA Licensing Regime is as follows:
It is an offence for a person to carry on the business of operating a virtual asset exchange (VA Service) in respect of in-scope ‘virtual assets’ (VAs or Virtual Assets), unless licensed under the AMLO.
Licensing will carry structural, governance, anti-money laundering and counter-terrorist financing (AML/CTF) and conduct requirements, described further below.
In the following table, we unpack several of the key concepts associated with this core licensing requirement. We also include commentary regarding how these concepts compare to existing SFC and FATF concepts.
Term / concept
|
WHAT THIS MEANS |
FURTHER DETAIL |
HOW DOES THIS COMPARE WITH FATF AND OTHER SFC INITIATIVES? |
VA
|
A VA means a cryptographically secured digital representation of value that:
In addition, the Secretary for FSTD may prescribe a virtual asset as a digital representation of value by notice in the Gazette. What virtual assets are excluded? The Draft Law expressly excludes central bank digital currencies, securities or futures contracts already regulated as financial products by the SFC, stored value facilities that are already regulated, as well as in-game assets and loyalty or reward points that are not intended to be convertible into money and operate in a closed-loop system. The SFC has a broad power to declare a certain asset as out of scope. |
The VA definition captures a broad array of utility tokens, payment tokens and governance tokens, and unregulated stablecoins. Certain in-game assets and loyalty type tokens are also excluded, as these virtual assets pose lower anti-money laundering / counter terrorist financing (ML/TF) risks when they are not tradable. The Draft Law does not expressly refer to non-fungible tokens (NFTs). There remains a possibility that a NFT could fall within the definition of VA if used for investment purposes, for example. Finally, the SFC has retained a degree of flexibility to declare certain assets as digital representations of value, as needed. |
The VA definition broadly draws from FATF Glossary definition, but it is more expansive. Specifically, the FATF definition refers to: “A virtual asset is a digital representation of value that can be digitally traded, or transferred, and can be used for payment or investment purposes. Virtual assets do not include digital representations of fiat currencies, securities and other financial assets that are already covered elsewhere in the FATF Recommendations.” The key differences therefore relate to (a) capturing a broader range of purposes – notably including participation in centralised and decentralised protocols and platforms, including decentralised autonomous organisations (DAOs) and pseudo-DAOs; and (b) the flexibility for Hong Kong authorities to designate certain assets as being in-scope. Alignment will be needed in other Hong Kong rulebooks. For example, the SFC and Hong Kong Monetary Authority (HKMA) “Joint circular on intermediaries’ virtual asset-related activities” dated 28 January 2022 definition of virtual assets is not as specific, and in a way speaks to the overall intent of Hong Kong regulators – if it looks and feels like a virtual asset, it will probably be in scope. There will be important lines to draw and challenging areas to examine closely such as NFTs – as to which, see our recent NFT Alert. |
VA Service
|
Licensing attaches to carrying on business in a VA Service. A “VA Service” means operating a “VA exchange”, which in turn means providing services through means of electronic facilities:
|
The definition of “VA exchange” very much focuses on centralised virtual asset exchanges. In comparison, the definition does not seem to capture brokers or persons who deal in virtual asset transactions. For example, negotiations in respect of virtual assets do not appear to be captured unless the exchange is used to enter or result in binding transactions. That means if the binding transaction is entered off-platform, then the definition is not met. That may be the case for certain bulletin boards, OTC trades and DeFi protocols. Similarly, the requirement for possession of client money or virtual assets means that several peer-to-peer protocols or OTC desks may not fall within the scope of a VA Service, depending on their functionality and services. We will be working with industry over the coming months to further clarify these definitions as there remains a significant latitude for interpreting the VA exchange definition. |
The VA Licensing Regime only seeks to apply to VA exchanges. It does not capture the broad range of Virtual Asset Service Providers (VASPs) (e.g. custodians or other financial services re virtual assets) that FATF recommends be licensed. LegCo has been clear it only wishes to initially regulate VA exchanges as they represent the highest ML/TF risk. In saying this, the Draft Law includes a mechanism whereby the Secretary for FST may add to or vary what are “VA Services” through notice in the Gazette, which gives it flexibility to add more VASP services in the future. Note however that Hong Kong already has a broad regime for custody, for example, also under the AMLO. This is the “trust or company service provider” (TCSP) regime administered by the Companies Registry. Ties to the SFO The definition of VA stems from the definition of ‘automated trading service’, a term used in the Securities and Futures Ordinance (SFO) to define stock / futures exchanges and similar systems. The similarity between these definitions supports the view that the binding transaction needs to be concluded on the exchange itself. However, the definition is not precisely the same, so care is required not to equate them. In our experience, platform transaction flows vastly differ across the crypto industry, so close inspection is key. |
Key jurisdictional triggers
Carrying on business
|
The key offence relates to carrying on a business of providing a VA Service without a licence. The term also appears in the context of eligibility for the transition arrangements. See Part C. ‘Carrying on business’ is not defined, but it is a common term in Hong Kong legislation. See the adjacent columns for further details. |
Whether the provision of a VA Service amounts to ‘carrying on a business’ is a question of fact to be answered upon a consideration of all the circumstances. There is case law examining both what amounts and does not amount ‘carrying on business’. We recommend close analysis of the VA Services provided in Hong Kong to ascertain this. |
Carrying on business is the key trigger in the SFO for regulated activities. The VA Licensing Regime draws from this existing concept. The concept is also aligned with the FATF Recommendations which refer to VASPs who carry on certain activities as a business. Generally speaking, this threshold is easily satisfied because most platforms charge fees or earn profit through spreads or other mechanisms. However, in some cases, this may well be in question. As with the SFO, merely carrying on business in Hong Kong is not enough to trigger the rules. It must be carrying on a business of providing the VA Service. This distinction is important, particularly for service companies that only provide administrative and back-end support in Hong Kong. |
Holding out
|
The VA Licensing Regime extends to persons holding themselves out as carrying on a business in a VA Service. As with ‘carrying on business’, this term is not defined. |
It is a question of fact that depends on the circumstances whether a person holds themselves out as carrying on business in a VA Service – in general, it refers to how a person markets themselves or their business. Importantly, the person does not to actually provide the VA Service – only represent that they do. |
As above, holding out is the key trigger in the SFO for regulated activities. The VA Licensing Regime draws from this existing concept. It does not appear in the FATF Recommendations as such, but supports a prudent measure from a consumer protection standpoint. |
Actively markets
|
‘Actively market’ and ‘actively marketing’ are not defined in the Draft Law. Actively marketing a service, which if provided in Hong Kong would be a VA Service, to the Hong Kong public is to be regarded as:
These deeming provisions apply irrespective of whether:
|
This is a critical jurisdictional trigger given many VA exchanges have a global presence and may very often be based offshore. ‘Actively markets’ is a familiar term to the SFC, as there is SFC guidance in the context of the financial product regime. We recommend close analysis of the VA exchange’s activities and degree of connection to the Hong Kong to ascertain if there is any ‘active marketing’. |
As stated in the adjacent column, ‘actively markets’ is a term borrowed from the SFO. The SFC is familiar with assessing ‘actively markets’ in the context of the securities and futures regime. We expect its current guidance to be expanded to this new regime in due course. The concept does not appear in the FATF Recommendations, but as with holding out, it is a prudent consumer protection measure, particularly given many platforms are domiciled offshore. This will inevitably leave some offshore platforms out of scope of the new regime, for the sole reason that they do not trigger Hong Kong’s jurisdictional nexus. |
No exemptions or passporting for licensed entities
There are no exemptions to requiring a VA Service licence.
LegCo’s rationale for this is that VA exchanges are a ‘new line of business distinct from the traditional services provided by entities regulated under the AMLO, [and it is therefore] … not proposed to grant any exemption in respect of the … licensing requirement[s]’. This position varies from that expressed in the Consultation Conclusions, which suggested that persons who hold licences as part of the SFC’s virtual asset “opt-in” regime will not require a licence.
The implications are that if an existing VA exchange falls within the scope of VA Licensing Regime, it will need to obtain a licence. This is irrespective of other licences it may hold. Inevitably, there will be regulatory overlap, but holding a licence may put VA exchanges in good stead to comply with some of the regulatory requirements imposed by the VA Licensing Regime.
Licensing requirements
The SFC is the key regulator under the VA Licensing Regime and will be responsible for assessing licensing applications and supervising licensed VA exchanges (Licensed Providers) under the VA Licensing Regime.
The table below provides an overview of the key licensing requirements.
Applicant entity requirements
Requirement
|
Details
|
Example
uses 2
|
Corporate structure and location |
The applicant must either be:
This is good news for the industry as it will enable global platforms to enter or continue operating in the Hong Kong market without necessarily requiring major systemic changes. Natural persons or entities without a legal personality (e.g. sole proprietors, unincorporated DAOs, partnerships etc.) and foreign incorporated companies not registered in Hong Kong are ineligible.
|
|
Financial resources |
The applicant is required to maintain adequate financial resources, including paid-up share capital and liquid capital. However, the amounts have not been specified yet. They are likely to be released along with future rules and guidelines (the timing of which is unknown).
|
|
Fit and proper |
The applicant, officers of the applicant (including responsible officers, licensed representatives, and directors), and the ‘ultimate owner’ (defined below) must be ‘fit and proper’. At a high level, the following matters are taken into account to determine whether a person is fit and proper. This criteria draws from existing SFC regulation with a more AML/CTF focus:
This factor is especially important in relation to the assessing whether a person is competent to act as a responsible officer or a licensed representative. Prescriptive guidance regarding the qualification standards of a person under this regime have not been issued yet. However, we expect that the standards may differ from the existing SFO regulatory requirements, particularly given the AML/CTF focus of this regime and the fact that there is not a long track record for blockchain and virtual asset experience.
|
|
Licensing conditions |
On granting a licence to the applicant, the SFC may impose licensing conditions. The Draft Law lists the areas of potential coverage. They are very broad and cover most aspects of the Licensed Provider’s operations and activities. Importantly, it is expected that Licensed Providers will be subject to a licensing condition to only provide VA Services to ‘professional investors’ (as defined under the SFO). This is not expressly set out in the Draft Law, but mentioned in the LegCo Brief. The fact that the professional investor is not hard-wired which is a positive as it means that there is flexibility to relax this licensing condition in the future if the SFC considers it appropriate.
|
|
Premises approval |
Premises for keeping records and documents must be approved by the SFC. We expect it is likely that the SFC’s current rules relating to the use of external data storage providers (including use of cloud) for the securities sector may also apply.
|
|
Personnel requirements
Directors / executive directors |
There must be at least one natural person director. More than one director is possible. Each director must be fit and proper. All executive directors must be responsible officers. An executive director is a director that actively participates in, or is directly responsible for supervising, the VA Service business.
|
|
Responsible officers |
Responsible officers are responsible for overseeing the operation of the Licensed Provider and ensuring it complies with AML/CTF requirements. The applicant must appoint at least two responsible officers. One must be:
Each responsible officer must be:
Importantly, the SFC must assess and approve each responsible officer.
|
|
Licensed representatives |
A licensed representative is an individual that may provide VA Services on behalf of the Licensed Provider. As with other SFC-regulated activities, guidance may support an assessment of what amounts to regulated functions that require a licence. The SFC will grant a licence to an individual to become a licensed representative if the individual is a fit and proper. Importantly, the SFC must assess and approve each licensed representative.
|
|
Ultimate ownership
Ultimate owners |
The ultimate owners of the VA exchange must be approved by the SFC. The ownership threshold adopts the existing term in relation to a corporation under the AMLO, which makes sense given the AML/CTF focus of the VA Licensing Regime. It differs from the ‘substantial shareholder’ threshold under the SFO. The SFC will only grant an approval for a person to be an ultimate owner if the person is fit and proper.
|
|
Ongoing requirements
The Draft Law sets out ongoing obligations that must be complied with after the licensing application is approved. More rules and guidelines will be released closer to commencement, which will add to Licensed Providers’ compliance requirements.
At this stage we have not seen any specific requirements regarding the creation of a separate Hong Kong specific order books, although it is expected that client money and virtual assets will need to be segregated from that of the Licensed Provider’s own assets.
We set out some of the more substantial ongoing requirements below:
Compliance with AMLO and related AML/CTF requirements.
A Licensed Provider is considered a ‘financial institution’. This means that schedule 2 of the AMLO, and specific identification, verification, screening, and monitoring requirements apply to Licensed Providers. Without limitation, this includes:
- CDD requirements: The Licensed Provider must carry out customer due diligence (CDD) procedures to identify and verify clients, beneficial owners of its clients, and persons purporting to act on behalf of the clients. Screening must comply with the standards prescribed in the AMLO.
- Record keeping. Records of evidence obtained on clients’ identity and evidence of transactions effected by clients must be maintained in accordance with the AMLO. Records must be retained for at least 5 years following the end of a business relationship.
- Travel rule compliance. The Draft Law requires a Licensed Provider to obtain and pass on information in relation to a transfer of virtual assets that amount to at least HKD8,000. The originating financial institution must obtain and record the originator and the recipient’s information and submit the information to the beneficiary institution. A financial institution acting as an intermediary institution is also required to transmit all the information that it receives.
FATF has been monitoring the progress of technology development to support travel rule compliance. According to a July 2021 review by FATF, [2] several standards and protocols have been launched to enable interoperability that assists with exchanging travel rule data. However, the FATF review continues to acknowledge that most jurisdictions and VASPs are not complying with the travel rule, mainly due to the lack of implementation the lack of globally available, comprehensive technological solutions for supporting the travel rule.
Notification obligations of the Licensed Provider, its licensed personnel, associated entities, and approved ultimate owners.
This includes notification of changes to key particulars disclosed as part of the application, the intention to cease business, changes in directors, and details of the associated entity of the Licensed Provider.[3]
What else?
We expect a range of additional conduct requirements will apply. However, the detail will be housed in the SFC’s implementing guidelines and the conditions that will be imposed (such as the professional investor limitation noted in the table above). For many clients with whom we have spoken already, that detail will be important to determining whether or not to pursue a licence. Please also see our summary of IOSCO developments that will also likely shape the Hong Kong regime.
Ideally, we hope to see recognition of a “primary regulator” (or at equivalence principles) to sensibly deal with multi-jurisdictional platforms. This is one of FATF’s own recent principles, as we summarised in our Building a Legal Architecture for the Metaverse Report - namely, if a VASP operates across multiple jurisdictions, a primary supervisor could be identified if the VASP has a significant proportion of its business operations in that jurisdiction. This approach, if adopted, will greatly benefit efficient risk-based regulation and Hong Kong being an attractive destination for global crypto players.
Ancillary offences
The Draft Law includes several offences in addition to the overarching offence of providing VA Services without a licence. These include:
- advertising offences, where an advertiser issues an advertisement in which an unlicensed exchange holds itself out as a Licensed Provider, and the advertiser knows the exchange is not licenced.
- fraud and deception offences, in connection with a virtual asset transaction and the fraudulent or reckless inducement of other to invest in virtual assets.
These ancillary offences are intended to provide a degree of investor protection from risks associated with fraud in the virtual asset space. The SFC will also have other disciplinary powers to support the new regime.
Part C – Implementation and transition arrangements
The VA Licensing Regime commences on 1 March 2023. Given the short timeframe to commencement, the Draft Law contemplates a transition period for existing exchange operators comply with the VA Licensing Regime and obtain a licence.
There are two aspects of the transition arrangement:
Further details: deeming arrangements
The conditions that VA exchange needs to satisfy to be eligible to be a deemed Licensed Provider are listed below:
a. The corporate applicant must provide a VA Service in Hong Kong immediately before 1 March 2023.
b. Before 1 December 2023, the corporate applicant must lodge a compliant application.
Specifically, the applicant must:
- submit an application for a VA Service licence. This requirement is only satisfied once the SFC acknowledges receipt of the application; and
- confirm it has provided a VA Service in Hong Kong immediately before 1 March 2023 (as per item (a) above) and that it will, upon being deemed licenced, comply with, and have arrangements in place to comply with the regulatory requirements under the VA Licensing Regime.
There are a similar deeming provisions that apply to licenced representative and responsible officer applications, with the key addition that the confirmation from the individual must show that the licensed person performed activities for the corporate application, and that they were performing regulated functions in Hong Kong at the time of the application.
During the deeming period:
- ultimate owners are not required to be pre-approved, and the applicant’s premises are deemed to be approved;
- the AMLO and the VA Licensing Regime will apply, including the SFC’s supervisory powers.
The deeming arrangement ends once the SFC approves or rejects the licence, or if the applicant withdraws the application.
The SFC can also decide not to deem an applicant or person, or unwind the deeming allowance. It may do so if the SFC believes the applicant will not satisfy the deeming conditions, or is unlikely to be able to comply with the regulatory requirements under the VA Licensing Regime. In such instances, the SFC will issue a notice to the applicant to wind-down its business within 3 months (during which there will not be a contravention of the requirement to hold a licence). An extension for additional time can be sought from the SFC if needed.
Part D – What you need to do, and keep an eye out for?
What’s next?
From here, the Draft Law will follow the LegCo legislative process before it is ultimately enacted. There may be changes, but expect these to be in the form of refinements, rather than material changes.
What you need to do
VA exchanges should take stock and assess whether their activities fall within the VA Licensing Regime. If the answer is ‘yes’, there are two broad options:
a. Obtain a licence: this will involve include getting applicable policies and procedures in place, hiring necessary personnel, implementing necessary controls, and otherwise ensuring certain measures are in place before 1 March 2023.
b. Structure any Hong Kong related activity so they are provided in a compliant way.
Keeping an eye out on IOSCO and other transnational developments
The SFC is a member of IOSCO. Like other major transnational bodies, IOSCO has a close eye on crypto sector developments. In the IOSCO Roadmap, it signalled two key workstreams.
Market integrity and consumer protection are front of mind for each of these workstreams. Reports are with policy recommendations are expected in Q4 of 2023.
We strongly suggest keeping a watching brief on the development of the IOSCO Roadmap as you build medium- and long-term plans.
How can we help you?
We are already working with multiple clients to plan for the new regime. We can assist to provide end-to-end support on advice, corporate structuring, licensing support and associated documentation (both internal and customer facing) needed for licensing. We are uniquely positioned as industry leaders in virtual asset regulation, with a strong track record of obtaining SFC licences, including for virtual asset providers.
Please send us an email or call us anytime to discuss further.
[1] This factor will not apply to the fit and proper assessment of an ultimate owner.
[2] Second 12-month Review of the Revised FATF Standards on Virtual Assets and Virtual Asset Service Providers; available here
[3] An ‘associated entity’ under the Draft Law refers to a wholly owned subsidiary of the licensed VASP that holds or receives Hong Kong client assets.