On 18 December 2024, the Hong Kong Securities and Futures Commission (HK SFC) announced that it had granted licences to four virtual asset trading platforms (VATPs) under its streamlined licensing process. The process follows a comprehensive series of on-site inspections conducted since June 2024. The four newly virtual asset trading licensed platforms, Accumulus GBA Technology (Hongkong) Co. Limited, DFX Labs Company Limited, Hong Kong Digital Asset EX Limited, and Thousand Whales Technology (BVI) Limited, will initially operate under a restricted scope of business while completing mandatory rectifications and assessments as outlined in the SFC’s newly published circular.
The streamlined licensing process as initiated by HK SFC mandates requirements such as rectifying issues identified during the HK SFC’s inspections and conducting independent vulnerability assessments and penetration tests to ensure compliance with security and operational standards. The Hong Kong Securities and Futures Commission has introduced a multi-phase licensing process for virtual asset trading platforms (VATPs), designed to ensure robust regulatory compliance and operational security. The process involves a combination of restricted licensing, independent assessments, and phased evaluations to safeguard investor interests while fostering innovation in the virtual asset ecosystem.
Initially, newly licensed VATPs will operate under a restricted scope of business, which allows the platforms to continue functioning while addressing deficiencies identified during the HK SFC’s risk-based inspections. These restrictions will remain in place until the platforms complete mandatory rectification actions. These actions are informed by the findings of the HK SFC’s comprehensive on-site inspections conducted earlier this year.
As an important requirement of the licensing process, VATPs must conduct thorough vulnerability assessments and penetration tests. These tests are performed by independent third-party assessors and cover a range of systems, including network devices, servers, firewalls, databases, and digital wallet infrastructure. The objective is to identify and address potential security vulnerabilities, ensuring the platforms meet high standards of cybersecurity and operational resilience. Only platforms that achieve satisfactory results in these assessments can proceed to the next phase of licensing.
The second-phase assessment consists of evaluation of a VATP’s operational and compliance systems. It is conducted under a tripartite agreement involving the HK SFC, the VATP, and an independent external assessor. The assessment focuses on the platform’s policies, procedures, and systems, evaluating whether they are adequately designed and effectively implemented.
The process is structured as a direct assurance engagement, requiring certification from a public accountant to confirm compliance with the HK SFC’s regulatory framework, including guidelines on Anti-Money Laundering and Counter-Financing of Terrorism (AML/CFT). The HK SFC supervises this phase closely, ensuring that all assessments meet the required standards. Completion of this phase to the SFC’s satisfaction is a prerequisite for lifting the restrictions on the platform’s operations.
Upon successful completion of the second-phase assessment, VATPs are granted unrestricted licences, allowing them to operate fully under the SFC’s regulatory framework. Platforms with unrestricted licences can expand their service offerings and operate without scope limitations, provided they continue to adhere to the SFC’s ongoing oversight and regulatory standards.
These measures apply to all VATPs seeking licences to operate in Hong Kong, whether they are deemed applicants under the transitional arrangements or new applicants entering the market.
The HK SFC has already issued a circular detailing the roadmap for licensing VATPs and providing additional guidance on the second-phase assessment. New applicants will benefit from updated procedural clarity in early 2025, with the full framework expected to mature throughout the year. The second-phase assessments for existing licensees are expected to conclude in mid-2025, with the unrestricted operations phase contingent on meeting SFC requirements during this period.
(Source: https://apps.sfc.hk/edistributionWeb/gateway/EN/news-and-announcements/news/doc?refNo=24PR211, https://apps.sfc.hk/edistributionWeb/api/circular/openFile?lang=EN&refNo=24EC65)
