Download PDF | Download Word

Hong Kong Virtual Assets Regulation

Hong Kong’s licensing regime for virtual asset trading platform includes provisions covering: (i) the scope of activities that need to be licensed; (ii) the various requirements that must be met for platforms to become licensed, their ongoing obligations and the various restrictions on their activities once they become licensed; and (iii) the statutory offences that cover misconduct involving virtual assets.

There are also interesting recent developments, including a scandal involving unlicensed crypto exchange, JPEX.

LICENSING REGIMES FOR VATPS

Hong Kong has two licensing regimes governing trading platforms. Under Part 5B of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (the AMLO) which came into effect on 1 June 2023, platforms that offer trading in virtual assets that are not securities within the definition of securities set out in Schedule 1 to the Securities and Futures Ordinance (the SFO), for example Bitcoin, must be licensed by the SFC. Platforms that provide trading in virtual assets that are securities under the SFO, on the other hand, need to be licensed under the SFO for regulated activities Type 1, that is dealing in securities, and Type 7, providing automated trading services.

Given the possibility of a virtual asset’s regulatory classification changing from a non-security to a security and vice versa, the SFC is encouraging virtual asset trading platforms and relevant employees to apply for licences under both Ordinances. Applicants for dual licensing can submit a single consolidated application online through the SFC’s WINGs platform indicating that they are simultaneously applying for both licences.

According to the SFC’s website, there are currently only two licensed virtual asset trading platforms – OSL Digital Securities Limited and Hash Blockchain Limited. Both platforms were already licensed by the SFC to trade virtual assets that are “securities”[1] under the SFO licensing regime before the AMLO regime came into effect. The SFC has now licensed them under the AMLO to allow them to offer trading in non-security virtual assets. The SFC has not yet approved any of the licensing applications submitted since 1 June 2023 when the AMLO licensing regime took effect, but there are currently four trading platforms waiting for their licensing applications to be approved, and one licensing application has been withdrawn according to the lists of VA trading platforms on the SFC’s website.[2]

FINANCIAL ACTION TASK FORCE REQUIREMENTS

The implementation of the new AMLO licensing regime means that Hong Kong now complies with certain requirements of the Financial Action Task Force (FATF), which is the international anti-money laundering watchdog. Under FATF’s Interpretative note to FATF Recommendation 15, FATF member jurisdictions, which include Hong Kong, should require virtual asset service providers, commonly referred to as VASPs, to be licensed or registered by a competent authority which must regulate VASPs in relation to anti-money laundering and counter-terrorist financing and monitor their compliance with AML and CTF regulations. FATF also requires countries to apply the so-called “Travel Rule” to virtual asset transfers. This requires originating VASPs to obtain and hold accurate required originator information and required beneficiary information on virtual asset transfers and to submit that information to any beneficiary VASP or financial institution, and make it available on request to appropriate authorities.[3] FATF compliance was one of the drivers behind Hong Kong’s implementation of its regulatory regime for virtual asset trading platforms. Non-compliance would risk Hong Kong being placed on the FATF’s grey list of non-compliant jurisdictions.

The implementation of Hong Kong’s new licensing regime also aligns with the Hong Kong Government’s stated objective of developing Hong Kong as an international hub for Web3 and virtual assets.[4] In April 2023, ahead of the implementation of the new AMLO licensing regime, the Hong Kong Monetary Authority issued a circular to Hong Kong’s banks urging them to provide banking services to SFC-licensed virtual asset trading platforms to support what it described as “their legitimate need for bank accounts”.[5] This was seen as a move aimed at supporting the Government’s objectives and countering banks’ reluctance to open bank accounts for crypto-related businesses. The requirements for licensing virtual asset trading platforms are however stringent and licensed platforms are subject to various continuing obligations, including additional obligations for platforms serving retail investors and individual professional investors.

Hong Kong’s implementation of a regulatory regime for crypto exchanges is also viewed as having created a degree of regulatory clarity in comparison with the United States where regulation is implemented through enforcement actions rather than legislation. Crypto regulation in the US is currently mired in a turf war between the securities regulator, the Securities and Exchange Commission, and the commodities regulator, the Commodity Futures Trading Commission. According to a recent article in Bloomberg, Hong Kong, as well as Singapore, South Korea and Japan which also have crypto regulatory regimes in place, are expected to benefit from crypto exchanges moving out of the United States. The SFC has taken a number of initiatives recently to try and improve investors’ understanding of the risks associated with trading on unregulated platforms in the wake of the scandal involving unlicensed trading platform JPEX. The actions of the Hong Kong police force in arresting a number of individuals involved come as a clear signal that action will be taken against anyone who breaches the regulatory regime. The regulators are clearly determined to prevent the JPEX case from damaging Hong Kong’s ambitions as an international crypto hub. Hong Kong’s desire to establish itself as a crypto hub is part of the Government’s wider efforts to establish the city as a cutting-edge financial centre. Financial Secretary Paul Chan referred to virtual assets as “unstoppable new financial innovations” that Hong Kong needs to embrace while the HKMA’s Fintech Promotion Roadmap sets out its vision of “bolstering Hong Kong’s position as a leading global financial centre offering world-class digitally enabled products and services”. In building its regulatory regime Hong Kong has had the advantage of seeing what has gone wrong in other jurisdictions, for example in the case of failed US-based crypto exchange FTX, and building provisions into its regulatory regime to prohibit regulated platforms from engaging in the types of activities that put investors assets at risk, such as lending client virtual assets. While it is true that JPEX has failed in Hong Kong, JPEX is not a licensed platform. If anything, its activities make the case for stringent regulation of virtual asset trading platforms and strict enforcement of the regulatory regime against those who breach its provisions.

AMLO LICENSING REQUIREMENTS

According to the licensing regime under the AMLO, an entity is required to be licensed if it carries on a business of providing a virtual asset service, which the AMLO refers to as a ‘VA service’, in Hong Kong, or holds itself out as doing so. Licensing under the AMLO is also required for an offshore entity to actively market, either itself or through another person, to the Hong Kong public any service that it provides outside Hong Kong which would be a VA service if it were provided in Hong Kong.[6] Thus an offshore entity that actively markets to the Hong Kong public a VA service that it provides offshore, is required to be licensed. The relevant provision, section 53ZRB(3) of the AMLO, is the equivalent of section 115 of the SFO which applies to securities. In practice, however, the SFC will not license offshore entities since they fall beyond its regulatory remit. The provision therefore operates to prohibit any offshore VA trading platform from actively marketing its VA trading services to the Hong Kong public. Failure to comply with the AMLO’s licensing requirements is an offence which carries maximum penalties of 7 years’ imprisonment, a Hong Kong five million dollar fine, and a daily fine of HK$100,000 for continuing offences.

SFC FAQ ON ACTIVE MARKETING

As to what amounts to “active marketing” for the purposes of section 53ZRD, the SFC’s FAQ states that examples of “active marketing” include frequently calling on Hong Kong investors to market services, including offering products, and mass media programmes and internet activities targeting Hong Kong investors. The FAQ lists various non-exhaustive factors it will consider in determining whether services are actively marketed to the Hong Kong public. These include: whether there is a detailed plan to promote the services; whether the services are extensively advertised using direct mailing, advertisements in local newspapers or broadcasting, or “push” technology over the Internet; and whether the services are packaged to target the Hong Kong public, for example by being written in Chinese and denominated in Hong Kong dollars. However, we need to be cautious in relying on that interpretation since the SFC argued against its own interpretation in the case of Ng Chiu Mui v the SFC[7] when it asserted the term meant “no more than marketing in the primary sense of pro-actively advertising the service to the Hong Kong public”. The meaning of the term “active marketing” was not determined in the case since the services had been extensively advertised in local newspapers.

PROVIDING A VA SERVICE

According to section 53ZRD of the AMLO,[8] the AMLO defines “providing a VA service” as “operating a VA exchange” which is in turn defined[9] as providing services through means of electronic facilities whereby:

• offers to sell or purchase virtual assets are regularly made or accepted in a way that forms or results in a binding transaction; or
• persons are regularly introduced, or identified to other persons in order that they may negotiate or conclude, or with the reasonable expectation that they will negotiate or conclude sales or purchases of virtual assets in a way that forms or results in a binding transaction.

The licensing regime thus applies to virtual asset trading platforms that operate in Hong Kong, or whose offshore services are actively marketed to the Hong Kong public. The SFC has said that the VATP licensing regime applies only to centralised VA trading platforms that provide virtual asset trading services to clients using an automated trading engine which matches client orders and also provide custody services as an ancillary service to their trading services. The provision of virtual asset services without an automated trading engine and ancillary custody services, for instance, over-the-counter virtual asset trading activities and virtual asset brokerage activities, does not require a licence. The Hong Kong licensing regime thus only covers centralised crypto exchanges. It is worth noting that the scope of regulation is narrower than required under the FATF recommendations, under which the businesses that are required to be licensed or registered as VASPs also include businesses that are involved in the safekeeping of virtual assets or instruments creating control over virtual assets, that is cryptographic keys. This would require the licensing of crypto custodians and custodians of cryptographic keys. The FATF VASP definition also covers businesses involved in the transfer of virtual assets such as virtual asset payment businesses. When the consultation on the new AMLO regime was conducted, the Financial Services and Treasury Bureau explained that it had decided to only regulate crypto exchanges as they were the predominant crypto-related businesses in Hong Kong. The number of stand-alone crypto custodian and crypto payment businesses in Hong Kong at the time was negligible.

However, the AMLO gives the Secretary for Financial Services and the Treasury the power to amend the definition of “VA service” by notice published in the Gazette. The Government may therefore choose to extend the scope of the licensing regime in the future if it sees fit.

VIRTUAL ASSETS DEFINITION

‘Virtual assets’ are defined in section 53ZRA of the AMLO. There are three strands to the definition. First, the virtual asset must be a cryptographically secured digital representation of value that is expressed as a unit of account or a store of economic value. Secondly, the virtual asset must either be used, or intended to be used, as a medium of exchange accepted by the public for the payment for goods or services, for the discharge of a debt and/or for investment, or must provide rights, eligibility or access to vote on the management, administration or governance of the affairs in connection with, or to vote on any change of the terms of any arrangement applicable to, any cryptographically secured digital representation of value. The third strand of the definition is that the virtual asset must be transferred, stored or traded electronically.

This definition includes Bitcoin, altcoins and stablecoins, although, the SFC has stated that stablecoins should not be admitted for trading by retail investors until they are regulated in Hong Kong.

EXCLUSIONS FROM VIRTUAL ASSETS DEFINITION

There are a number of specific exclusions from the virtual asset definition. It excludes: digital representations of fiat currencies; central bank digital currencies; financial assets already regulated under the SFO such as securities and futures contracts; and stored value facilities which are separately regulated under the Payment Systems and Stored Value Facilities Ordinance. The definition also excludes “limited purpose digital tokens” which include non-transferable, non-exchangeable and non-fungible closed-loop, limited purpose items, such as air miles, credit card rewards, gift cards, customer loyalty programmes and gaming coins.

SFO LICENSING

As to the licensing regime under the SFO, virtual asset trading platforms that provide trading in virtual assets that are securities within the SFO definition and provide automated traded services in those virtual assets, or hold themselves out as doing so, need to be licensed under the SFO for regulated activities Type 1, that is dealing in securities, and Type 7, that is providing automated trading services. As is the case for the AMLO licensing regime, the SFC has indicated that licensing is required only for centralised virtual asset trading platforms, i.e. trading platforms that provide trading, clearing and settlement services for virtual assets and have control of clients’ assets. The SFC does not license platforms which provide peer-to-peer trading in virtual assets between clients where the trades take place off-exchange and the clients retain custody of their virtual assets. As is the case under the AMLO, the SFO also prohibits an offshore entity from actively marketing to the Hong Kong public any services it offers offshore that would constitute SFO-regulated activities if they were provided in Hong Kong under section 115 of the SFO. That prohibition applies whether the offshore entity conducts the active marketing itself or through another person and whether the active marketing is conducted from offshore or in Hong Kong. The provision means that offshore virtual asset trading platforms cannot actively market their offshore services to the Hong Kong public. What constitutes “active marketing” is the same under the AMLO and the SFO.

REGULATORY REQUIREMENTS FOR LICENSED VATP OPERATORS

While the AMLO and SFO set out the key regulatory provisions for VA trading platforms, the detailed obligations and requirements are set out in various SFC codes, guidelines and frequently asked questions (FAQs). Many of the detailed obligations on VA trading platforms are set out in the SFC’s Guidelines for Virtual Asset Trading Platform Operators or VATP Guidelines.

The SFC has also issued a Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations and SFC-licensed Virtual Asset Service Providers) and a Prevention of Money Laundering and Terrorist Financing Guideline for Associated Entities of Licensed Corporations and SFC-licensed Virtual Asset Service Providers, as well as FAQs on licensing matters and on conduct-related matters.

ELIGIBILITY FOR LICENSING UNDER AMLO & SFO

As regards the eligibility requirements for licensing, Hong Kong incorporated companies that have a permanent place of business in Hong Kong, and overseas companies that are registered in Hong Kong under the Hong Kong Companies Ordinance, are eligible for licensing under the AMLO and SFO licensing regimes. Businesses that do not have a separate legal personality, such as partnerships and sole traders, individuals and overseas companies that are not registered in Hong Kong, are not eligible to be licensed as VA trading platforms in Hong Kong.

PLATFORM OPERATORS’ FITNESS & PROPERNESS

An entity applying to be licensed must be “fit and proper” which means that it must not be subject to any receivership, administration, liquidation or other similar proceedings; have failed to meet any judgment debt; or be unable to meet any financial or capital requirements that apply to it.

PLATFORM OPERATORS’ FINANCIAL RESOURCES REQUIREMENTS

The VATP Guidelines set out financial resources requirements that licensed platform operators must meet on a continuing basis. First, they must have at least HK$5 million of paid-up share capital and liquid capital of the higher of HK$ 3 million and the “basic amount” as defined in Division 2 of Part 4 of the Securities and Futures (Financial Resources) Rules. They are also required to beneficially own assets that are sufficiently liquid, such as cash, deposits, treasury bills and certificates of deposit, but not virtual assets, that are equivalent to at least 12 months of their actual operating expenses calculated on a rolling basis.[10]

PLATFORM OPERATORS’ COMPETENCY REQUIREMENTS

The SFC also needs to be satisfied as to the competency of the VA trading platform operator and will consider various key elements including its business model, corporate governance, internal controls, operational review, risk management and compliance, in addition to the combined competence of its senior management and other staff members.

A licence applicant will need to have a clear business model, detailing its modus operandi and target clientele, as well as written policies and procedures to ensure continuous compliance with the relevant legal and regulatory requirements. The applicant has to demonstrate to the SFC that it has a proper business structure, good internal control systems and qualified personnel to ensure the proper management of the risks it will encounter carrying on its proposed business as detailed in its business plan. Licensing applicants need to include detailed information on these points in their business plan, compliance manual and other internal policies and procedures.

RESPONSIBLE OFFICER REQUIREMENTS

Platform operators are required to appoint a minimum of two responsible officers to supervise their licensed business, who must be approved by the SFC. The main requirements for responsible officers are that at least one responsible officer must also be an executive director of the company and, if the company has more than one executive director, they must all be appointed as responsible officers. In addition, at least one responsible officer must be ordinarily resident in Hong Kong and at least one responsible officer must be available at all times to supervise each regulated activity or business.

Where a platform is dual-licensed under the AMLO and SFO, it is required to have two, rather than four, dually-licensed responsible officers to meet the minimum statutory requirement for two responsible officers under each Ordinance.

The SFC states in its Licensing Handbook for VATP operators that it will only license overseas residents if they will come to Hong Kong to conduct regulated activities on behalf of a licensed platform operator to which they are accredited. It will not license individuals who only conduct business activities outside Hong Kong. If a responsible officer will be stationed overseas, and will visit Hong Kong from time-to-time to conduct regulated activities, the SFC will impose a non-sole condition on the responsible officer’s licence. The non-sole condition means that when the responsible officer actively participates in or supervises the platform’s licensed business, they must do so under the advice of another responsible officer who is not subject to the non-sole condition. However, itinerant professionals who will only spend short periods in Hong Kong for specific purposes should not be appointed as responsible officers because this is incompatible with their responsibilities for supervising the virtual asset trading platform’s business. The SFC has also said that responsible officers must participate in supervising the platform’s regulated activities and that licensed platforms should not hire individuals who act as responsible officers in name only and have no real supervisory role.

RESPONSIBLE OFFICERS’ FITNESS AND PROPERNESS

Responsible officers need to be fit and proper persons to act in this capacity. The factors relevant to the SFC’s assessment of an individual’s fitness and properness to be a responsible officer include: their financial status and solvency; their educational or other qualifications and experience; their ability to carry on regulated activities competently, honestly and fairly; and their reputation, character, reliability and financial integrity.

The SFC will also take into account a person’s convictions for offences under the AMLO, the United Nations (Anti-Terrorism Measures) Ordinance, the Drug Trafficking (Recovery of Proceeds) Ordinance or the Organized and Serious Crimes Ordinance and comparable offshore convictions, as well a person’s previous breaches of the AMLO.

RESPONSIBLE OFFICERS’ EDUCATIONAL QUALIFICATIONS AND EXPERIENCE

The SFC’s VATP Guidelines set out the SFC’s requirements in terms of responsible officers’ academic or professional qualifications, relevant industry experience, recognised industry qualifications, management experience and the Hong Kong Securities Institute papers they are required to have passed. There are three routes to meeting these requirements. If a person has a relevant university degree, that is a degree in accounting, business administration, economics, finance or law, or internationally-recognised professional qualifications in those subjects, they must also have at least 3 years’ direct relevant industry experience acquired in the previous 6 years; 2 years’ management experience and have passed Hong Kong Securities Institute Papers 1 and 2.

Secondly, individuals who have degrees in other subjects are required to have at least 3 years’ direct relevant industry experience over the previous 6 years, 2 years’ management experience, have passed HKSI papers 1 and 2, and have either passed Hong Kong Securities Institute papers 7 and 8, or completed an additional 5 hours of continuous professional training within the 6 months before they apply to be licensed.

The last route is for individuals who have attained Level 2 in either English or Chinese and Maths in the Hong Kong Diploma of Secondary Education Exams or equivalent overseas qualifications. These individuals are required to have 2 years’ management experience and to have passed Hong Kong Securities Institute Papers 1 and 2. They also need direct relevant industry experience of 3 years over the previous 6 years or 5 years over the previous 8 years. They additionally need to have passed Hong Kong Securities Institute papers 7 and 8, or have completed an additional 5 hours of continuous professional training in the 6 months before they apply to be licensed.

RESPONSIBLE OFFICERS’ INDUSTRY EXPERIENCE

The SFC will recognise an individual’s industry experience as direct relevant industry experience if they were a key person involved in the development, or in ensuring the proper functioning of, a technology, platform or system that is central to the virtual asset trading platform for which the person will be a responsible officer. Merely providing system support, on the other hand, will not be recognised as relevant industry experience.

Where a responsible officer applicant’s industry experience largely relates to non-security virtual assets and the person has no experience of dealing in securities, or vice versa, the SFC has said that it is prepared to be flexible given that this is a new industry. In other words, the SFC will consider industry experience dealing in non-security virtual assets as industry experience relevant to Type 1 dealing in securities regulated activity under the SFO, although it will impose a licensing condition on the person’s Type 1 licence that they can only provide Type 1 regulated activity services for the business of an SFC-licensed platform operator. Likewise it will recognise industry experience of dealing in securities as industry experience relevant to providing a VA service under the AMLO, but will impose a “non-sole” condition on the responsible officer’s licence to provide a VA service.

This arrangement is intended as a temporary measure which has been adopted for pragmatic reasons due to a lack of talent with both virtual asset and securities-related experience at this early stage. The SFC will will review whether this provision needs to be retained as the market develops.

In terms of what the SFC will recognise as “management experience”, this needs to be “hands on” experience of supervising and managing the business’ regulated functions in a business setting. Managing the platform’s staff who conduct the regulated functions or engage in its projects can also be regarded as “management experience”. Under the VATP Guidelines, the SFC will also accept management experience gained in the financial industry, unless it is purely administrative, for example involving human resources or office administration.

LICENSED REPRESENTATIVES

Individuals who will provide regulated services on behalf of a VA trading platform, including its responsible officers, need to be licensed by the SFC as licensed representatives accredited to the VA trading platform. In practice, licensed representative and responsible officer applications can be submitted simultaneously.

Licensed representatives can only act for the platform operator to which they are accredited for conducting regulated activities. If a licensed representative ceases to act for their principal, the principal must notify the SFC through WINGS within 7 business days. The licensed representative can then apply for a transfer of their accreditation to another platform operator within 180 days. If a licensed representative has previously received a regulatory warning, this must be disclosed in the application form.

LICENSED REPRESENTATIVES REQUIRED EDUCATIONAL QUALIFICATIONS & EXPERIENCE

The SFC expects individuals applying to be licensed representatives to have a basic understanding of the market and of the relevant legal and regulatory requirements. There are also three different routes to licensing. An individual with a relevant degree or professional qualification only needs to have passed HK Securities Institute Paper 1. Individuals with other degrees need to have passed Paper 1, and have at least 2 years’ relevant industry experience over the past 5 years, or have either passed Hong Kong Securities Institute papers 7 and 8, or completed an additional 5 hours of continuous professional training within the 6 months before they apply to be licensed. The third route to licensing requires individuals with Level 2 in English or Chinese and Maths in the Hong Kong Diploma of Secondary Education Exams or equivalent to have passed HK Securities Institute Paper 1 and have 2 years’ of direct relevant industry experience over the previous 5 years. They also need to have completed 5 additional continuous professional training hours in the 6 months before applying for licensing, or have passed Hong Kong Securities Institute papers 7 and 8.

SUBSTANTIAL SHAREHOLDERS AND ULTIMATE OWNERS

The substantial shareholders and ultimate owners of a VA trading platform operator are also required to be fit and proper[11] and must be approved in writing by the SFC. A “substantial shareholder” is a person who has an interest of 10% or more in the platform operator’s issued shares or a person with an interest in the platform operator’s shares which entitles them, either alone or with their associates, to control the exercise, directly or indirectly, of 10% or more of the voting power at its general meetings. A person will also be a substantial shareholder of a VA trading platform operator if they hold shares in another company which entitles them, alone or with their associates, to control the exercise of 35% or more of the voting power at general meetings of that company, or of a further company, which can exercise, either alone or with its associates, 10% of the voting power at general meetings of the platform operator.[12]

An “ultimate owner” is an individual who owns or controls more than 25% of the issued share capital of the VA trading platform operator; controls more than 25% of the voting rights at its general meetings; or controls its management.[13]

SFC APPROVAL OF A VATP’S ULTIMATE OWNER

The factors that the SFC takes into consideration in determining whether a person is fit and proper include: the person’s financial status or solvency, their educational or other qualifications and experience; evidence of their competence, honesty and financial integrity; their conviction in Hong Kong or elsewhere for any money laundering or terrorist financing offence or other offence involving fraudulent, corrupt or dishonest conduct; and failure to comply with the AML/CTF obligations or other obligations of licensed VA trading platforms.

Any person who proposes to become an ultimate owner of a licensed VA trading platform must be approved in writing by the SFC. The SFC needs to be satisfied that the platform will continue to be fit and proper if the ultimate owner is approved. In granting its approval, the SFC can impose conditions on the licensed trading platform or the ultimate owner. A person who becomes the ultimate owner of a VA trading platform without the SFC’s approval, without a reasonable excuse, will commit an offence for which the maximum penalty is a HK$1 million fine and two years’ imprisonment and a further fine of HK$5,000 for every day that the offence continues.

MANAGERS-IN-CHARGE OF CORE FUNCTIONS (MICS)

The SFC has also introduced a Managers-In-Charge of Core Functions regime for licensed virtual asset trading platform operators, the details of which are set out in the SFC’s FAQs on Measures for Augmenting Senior Management Accountability in Platform Operators, which are based on the manager in charge regime applicable to other SFC-licensed entities. The purpose of the regime is to implement the requirement for the trading platform’s senior management to assume primary responsibility for ensuring that the platform has appropriate standards of conduct and that those standards are adhered to. Licensed VA trading platform operators need to appoint one or more managers in charge as individuals who are principally responsible, either alone or with others, for managing each of the Platform Operator’s “Core Functions”.

There are eight Core functions.

The first of these is Overall Management Oversight which involves responsibility for the day-to-day direction and oversight of the effective management of the platform operator’s overall operations. The manager in charge of this function could for example be the trading platform’s Chief Executive Officer or President. The person’s main responsibilities include developing the platform operator’s business model, objectives, strategies, organisational structure, controls and policies; developing and promoting sound corporate governance practices, culture and ethics; and executing and monitoring implementation of board-approved business objectives, strategies and plans, and the effectiveness of the organisational structure and controls

The second Core Function is Key Business Line which involves directing and overseeing a line of business comprising one or more types of SFO-regulated activity and/or a VA service under the AMLO. Examples of job titles of individuals the SFC gives for persons suited for this role are the Head of Automated Trading Services, Head of Brokerage Services or Head of Sales.

The third of the core functions is Operational Control and Review which is responsible for the establishment and maintenance of adequate and effective systems of controls over the platform’s operations and reviewing the platform operator’s compliance with, and the adequacy and effectiveness of, its internal control systems. The manager in charge of this function could for example be the Chief Operating Officer, Head of Operations, or Head of Internal Audit.

The fourth Core Function is Risk Management which involves responsibility for identifying, assessing, monitoring and reporting risks arising from the platform operator’s operations. Examples of individuals who could perform the role are the Chief Risk Officer, or Head of Risk Management.

The fifth Core Function is Finance and Accounting which involves responsibility for ensuring timely and accurate financial reporting and analyses of the platform operator’s operational results and financial positions. The manager in charge could, for example, be the Chief Finance Officer, Financial Controller or Finance Director.

Sixth among the Core functions is Information Technology which relates to the design, development, operation and maintenance of the platform operator’s computer systems. A suitable person to be the manager in charge could be the Chief Information Officer or Head of Information Technology.

Compliance is the seventh core function for which the manager in charge could be the Chief Compliance Officer or Head of Legal and Compliance. That function is responsible for setting policies and procedures for complying with the legal and regulatory requirements in the jurisdictions in which the platform operator operates; monitoring the platform operator’s compliance with its policies and procedures; and reporting on compliance matters to the board and senior management. Anti-Money Laundering and Counter-Terrorist Financing is the eighth Core function and relates to establishing and maintaining internal control procedures to prevent the platform operator from being involved in money laundering or terrorist financing. The manager in charge could be the Head of Financial Crime Prevention or Head of Compliance. These job titles are given by way of examples only and other persons with sufficient seniority and experience could be appointed.

The managers in charge of the Overall Management Oversight and Key Business Line functions are generally required to be responsible officers of the activities they oversee. They can be located offshore provided they are accountable to the platform operator. The board of a licensed platform operator needs to ensure that each manager in charge acknowledges their appointment as manager in charge and the particular Core Function(s) for which they are primarily responsible. Any change in managers in charge must be notified to the SFC within seven business days of the change.

VATP COMPLAINTS OFFICER & EMERGENCY CONTACT PERSON

Virtual asset trading platform operators also have to appoint a Complaints Officer[14] to deal with complaints made to the platform operator, and an emergency contact person to be contacted by the SFC in the case of a market emergency or other urgent matter.[15] These individuals do not need to be licensed.[16]

Applicants for licensing as a VA trading platform operator also have to obtain the SFC’s approval of the premises they will use for keeping records or documents required to be kept under the Securities and Futures (Keeping of Records) Rules and the VATP Guidelines. The premises must be non-domestic premises which are suitable for storing the relevant documents and records. The SFC will normally only approve premises that are located in Hong Kong. One of the reasons for this is that a Hong Kong location is necessary to enable the SFC to exercise its power to enter premises to inspect a VA trading platform operator’s records.

VATP LICENSING APPLICATION PROCESS

To apply for licensing, applicants need to submit: Form 1 – the Corporation’s Licence Application; Form 5 – the New Licence Application for Licensed Representatives and Responsible Officers for at least two proposed responsible officers; Questionnaire 1 – the General Business Profile and Internal Controls Summary; Questionnaire 2 for VA Trading Platform Operators; the first external assessment report; and the licence application fee. Application forms, supplements & questionnaires should be submitted to the SFC through WINGS-LIC.

EXTERNAL ASSESSMENT REPORTS

Applicants for VA trading platform licences have to engage an external assessor to assess their business and submit two assessor’s reports to the SFC. Different external assessors can be appointed to review different areas of an applicant’s business. External assessors are expected to be independent, that is to say that service providers for the system used by a licence applicant should not be appointed as the external assessor of that system.

The external assessor’s “Phase 1 Report” needs to be submitted with the trading platform’s licence application. The areas of assessment include the design effectiveness of the VA trading platform’s proposed structure, governance, operations, systems and controls, with a focus on key areas such as governance and staffing, token admission, custody of virtual assets, KYC, AML/CTF, market surveillance, risk management and cybersecurity.

The external assessor’s “Phase 2 Report” must be submitted after the SFC grants approval-in-principle of the licence. This report needs to assess the effectiveness and implementation of the policies, procedures, systems and controls adopted by the licence applicant. Any deviation from the planned policies and procedures must be clearly set out and explained. The areas covered by the second assessment include verification and confirmation that all external service providers, such as providers of market surveillance tools, AML/CTF tools and KYC tools, have been engaged and that the systems provided by them are fully adopted as planned and are in operation. It is also required to cover the conduct of a vulnerability assessment to identify, rank and report potential vulnerabilities that may compromise a system and should include internal and external vulnerability scans, as well as the performance of penetration tests on network devices, firewalls, servers, databases, wallets, and web applications to identify any vulnerabilities or potential issues. The Phase 2 Report must also confirm that major or critical rectification steps have been taken for all medium to high risk items identified in the penetration and vulnerability tests. The SFC will only grant its final licensing approval when it is satisfied with the findings of the Phase 2 Report.

SUBMISSION OF PLATFORM OPERATORS’ BANK ACCOUNT INFORMATION

VA trading platform operators need to submit their bank account details to the SFC before their licensing application is approved. The HKMA issued a Circular to Hong Kong’s banks in April 2023 urging them to provide banking services to SFC-licensed virtual asset trading platforms. Supporting the Hong Kong Government’s push to become a global Web3 and crypto hub, the HKMA Circular urges banks to adopt “a forward looking approach … and strengthen their understanding of new and developing sectors” and a risk-based approach, rather than “a wholesale de-risking approach”.

The Circular also confirmed that the additional CDD measures for VATPs set out in the HKMA Circular “Regulatory Approaches to Authorized Institutions’ Interface with Virtual Assets and Virtual Asset Service Providers” of 28 January 2022, apply only when banks offer correspondent services, for example an account to settle clients’ transactions, to overseas VATPs. In other words, the additional CDD measures are not required for SFC-licensed VA trading platforms. It also stated that banks can consider opening an account once a VA trading platform applicant has received the SFC’s “approval-in-principle” of its licence application, rather than insist on waiting until the actual grant of the licence.

SFC REGULATORY SANDBOX

According to the VATP Licensing Handbook and the SFC FAQs on the SFC Regulatory Sandbox, on becoming licensed, virtual asset trading platform operators will enter the SFC Regulatory Sandbox to allow the SFC to assess and monitor their delivery of services and internal controls systems. The SFC expects this to facilitate dialogue between the SFC and VA trading platform operators enabling platform operators to identify and address any risks arising from their activities.

If the SFC decides to refuse a licensing application, the applicant will be given the opportunity to be heard and the SFC will consider the applicant’s representations before making a final decision. If the SFC then proceeds to refuse the application, the applicant has a right to apply for a review of its decision to the Anti-Money Laundering and Counter-Terrorist Financing Review Tribunal and the Securities and Futures Appeals Tribunal.

VATP LICENSING CONDITIONS

The licences of VA trading platform operators are granted subject to a number of licensing conditions. These include requirements that the platform operator must comply with the VATP Guidelines and must immediately notify the SFC and cease operating a VA trading platform if it becomes aware that it cannot maintain, or ascertain whether it maintains the required amounts of liquid capital and paid-up share capital.

The licensing conditions also require VA trading platforms to provide the SFC with monthly reports on their business activities within two weeks of the end of each calendar month and any other information requested by the SFC. Licensed platforms must also engage an independent professional firm acceptable to the SFC to conduct an annual review of their activities and operations, and prepare a report confirming that they have complied with the licensing conditions and all relevant legal and regulatory requirements. The first report must be submitted within 18 months of the approval of the platform operator’s licence. Subsequent reports are required to be submitted within four months of the end of each financial year and upon request by the SFC.

Under the licensing conditions, VA trading platforms must obtain the SFC’s written approval before introducing or offering a new or incidental service or activity or making a material change to an existing service or activity, including the long suspension or termination of an existing service or activity. The licensing conditions also restrict trading platforms to operating a centralised online virtual asset trading platform for trading of virtual assets on its platform and carrying on off-platform virtual asset trading business and incidental services provided by it to its clients and activities conducted in relation to that off-platform business.

TOKEN ADMISSION AND REVIEW COMMITTEE REQUIREMENTS

SFC-licensed VA trading platform operators are required to set up a Token Admission and Review Committee which must be made up of members of senior management who are principally responsible for managing the key business line, compliance, risk management and information technology functions. The SFC expects members “principally responsible” for the various functions to include the corresponding managers-in-charge of the platform operator.[17]

The responsibilities of the token admission and review committee include establishing, implementing and enforcing the criteria for admitting, suspending and withdrawing, virtual assets for or from trading and the rules containing the obligations and restrictions on virtual assets. The committee is also responsible for making the final decision as to whether to admit, suspend and withdraw a virtual asset for clients to trade based on the adopted criteria. These criteria and rules must be regularly reviewed by the committee. It must also report at least monthly to the board of directors of the VA trading platform operator and its reports must, at a minimum, include details of the virtual assets made available to retail clients for trading.

VATP OBLIGATIONS

Hong Kong licensed VA trading platform operators are required to monitor each of the virtual assets admitted for trading on an on-going basis and consider whether to continue to allow them for trading. Regular review reports are required to be submitted to the Token Admission and Review Committee. If the committee decides to suspend or withdraw a virtual asset from trading, the platform operator must notify clients as soon as practicable, inform clients holding that virtual asset of the options available, and ensure that clients are fairly treated.[18]

RESPONSIBILITY FOR CONDUCT AND ADHERENCE TO PROCEDURAL REQUIREMENTS

Under the VATP Guidelines, a trading platform’s senior management is primarily responsible for ensuring that the trading platform and its associated entity have appropriate standards of conduct and procedures in place for their employees and that employees adhere to those standards and procedures. In particular, senior management is responsible for ensuring that effective policies and procedures are in place to identify and manage the risks associated with the business of the trading platform and its associated entity. The term ‘senior management’ refers to a platform operator’s directors, responsible officers and Managers-in-Charge of Core Functions.

GENERAL TOKEN ADMISSION CRITERIA

The SFC requires licensed VA trading platform operators to perform reasonable due diligence on all virtual assets, irrespective of whether they will be made available to retail clients, before admitting them for trading to ensure that they meet the token admission criteria established by their Token Admission and Review Committees. The non-exhaustive factors that platform operators must consider for all virtual assets include: the background of the management or development team of the virtual asset or any of its known key members; the regulatory status of the virtual asset in Hong Kong and whether its regulatory status would affect the platform operator’s regulatory obligations; supply and demand for the virtual asset and its maturity and liquidity, including the length of its track record period which must be at least 12 months for virtual assets that are not securities. This effectively prevents platforms from offering ICO tokens for trading. Other factors that VA trading platform operators have to consider are the technical aspects of the virtual asset; its development and market and governance risks associated with it, and the legal risks associated with the virtual asset and its issuer.

SPECIFIC TOKEN ADMISSION CRITERIA – “HIGH LIQUIDITY” REQUIREMENT

Hong Kong licensed VA trading platform operators intending to make virtual assets available for trading by retail investors must additionally ensure that the relevant virtual assets satisfy the specific token admission criteria set out in paragraphs 7.7 and 7.8 of the VATP Guidelines. ‘Retail investors’ are defined in the guidelines as persons other than professional investors as defined in the SFO and the Securities and Futures (Professional Investor) Rules.

The key requirement is that the relevant virtual asset must be “highly liquid”.[19] For a virtual asset to be considered “highly liquid”, it must, at a minimum, be an “eligible large-cap virtual asset”, i.e. a virtual asset that is included in a minimum of two acceptable indices issued by at least two independent index providers. An “acceptable index” is an index with a clearly defined objective to measure the performance of the largest virtual assets in the global market (for example, an index which measures the top 10 largest virtual assets[20]) which is investible, which means that the constituent virtual assets must be sufficiently liquid, and objectively calculated and rules-based. The index providers must also have the necessary expertise and technical resources to construct, maintain and review the methodology and rules of the index, which need to be well-documented, consistent and transparent.

The two index providers have to be independent of each other, the virtual asset trading platform operator and the issuer of the virtual asset. In addition, at least one of the index providers must comply with the IOSCO Principles for Financial Benchmarks and have experience of publishing indices for the conventional securities market.

Noting that large market capitalisation does not necessarily correlate with high liquidity, the SFC has said that inclusion in two acceptable indices is a minimum criterion, rather than the sole criterion, for virtual assets to be eligible for trading by retail investors.[21] Trading platform operators are therefore expected to conduct additional due diligence to ensure that eligible large-cap virtual assets admitted for retail trading are in fact highly liquid.

Trading platform operators are also required to ensure that a virtual asset to be admitted for retail trading is not a security (as defined in Part 1 of Schedule 1 to the SFO) except where the offering of the virtual asset to retail investors complies with the Hong Kong regulatory requirements for public offers of shares and debentures under the Companies (Winding Up and Miscellaneous Provisions) Ordinance and/or does not breach the restrictions on offers of investments under Part IV of the SFO.

The SFC’s prior written approval is required for the admission of any virtual asset for trading by retail clients and the suspension of trading or removal of any such virtual asset.[22]

If a licensed platform operator wants to make available for retail trading a virtual asset that fulfils the general token admission criteria, but not the specific token admission criteria, it can make a submission to the SFC which the SFC will consider on a case-by-case basis.[23]

The SFC stated in its Consultation Conclusions that platforms should not admit stablecoins for retail trading until they are regulated in Hong Kong. The Hong Kong Monetary Authority proposed a new regulatory regime for various activities relating to payment-related stablecoins in its January 2023 Conclusion of its Discussion Paper on Crypto-assets and Stablecoins which it is planning to implement in 2024.

PROVIDING VA TRADING SERVICES TO RETAIL INVESTORS

SFC-licensed VA trading platform operators are allowed to provide services to retail investors provided that they comply with a number of investor protection measures covering client onboarding, platform governance, disclosure and token due diligence and admission.

Under the VATP Guidelines, platform operators have to implement a number of measures when serving investors other than institutional professional investors and qualified corporate professional investors.

Institutional professional investors are defined in paragraphs (a) to (i) of the definition of professional investors in Schedule 1 to the SFO.

Qualified corporate professional investors are corporate professional investors (that is a trust corporation, corporation or partnership within sections 4, 6 or 7 of the Securities and Futures (Professional Investor) Rules) which the licensed platform operator has assessed to meet certain criteria. The first of these criteria is that the corporate professional investor has an appropriate corporate structure and investment process and controls for making investment decisions. The second is that the persons making investment decisions on its behalf have sufficient investment experience, and the third criteria is that the corporate professional investor is aware of the risks involved, which needs to be considered in terms of the persons who make investment decisions on its behalf.

The platform operator’s assessment of whether a corporate professional investor is a qualified corporate professional investor must be in writing and the platform operator must keep records of all relevant information and documents obtained in the assessment to demonstrate the basis of its assessment. Platform operators need to undertake a new assessment if a corporate professional investor has not traded virtual assets for more than two years.

These provisions mean that platform operators must treat individual professional investors, that is individuals with investment portfolios worth HK8 million or more, and corporate professional investors that are not “qualified” corporate professional investors in the same way as retail investors.

TRADING IN VIRTUAL ASSET DERIVATIVES

Hong Kong licensed VA trading platform operators are not allowed to offer, trade or deal in virtual asset futures contracts or related derivatives.[24]

OTHER RESTRICTIONS ON LICENSED VIRTUAL ASSET TRADING PLATFORMS

Some of the key restrictions on licensed virtual asset trading platform operators are that they and their group companies are prohibited from providing any financial accommodation for clients to acquire virtual assets.[25] This prevents them offering margin financing to their clients. Licensed platforms are also prohibited from entering into arrangements with their clients to use clients’ virtual assets to generate returns.[26] This prevents licensed trading platform operators from providing services such as earning, deposit-taking, lending and borrowing.[27] They cannot offer clients gifts, other than a discount to fees or charges, for trading any specific virtual asset,[28] and cannot post adverts for a specific virtual asset.[29] They are also prohibited from providing algorithmic trading services to clients[30] and from conducting proprietary trading for their own account or any account in which they have an interest, except for off-platform back-to-back transactions where no market risk is taken by the platform operator.[31] Licensed platforms are also prohibited from conducting market making activities on a proprietary basis[32] and their group companies are prohibited from conducting proprietary trading in virtual assets through the platform operator on or off-platform.[33] Platform operators are not allowed to open multiple accounts for a single client, except sub-accounts.

PRIOR SFC APPROVAL REQUIRED FOR INCLUSION, SUSPENSION OR WITHDRAWAL OF VA FOR RETAIL TRADING

Platform operators must obtain the SFC’s written approval before offering any virtual asset for trading by retail clients, and before suspending trading of, or removing from trading, any virtual asset available to retail clients, that is non-professional investors.[34]

CLIENTS’ SUITABILITY FOR TRADING VIRTUAL ASSETS

Before opening an account for investors other than institutional professional investors and qualified corporate professional investors, trading platform operators are required to assess their knowledge of virtual assets and of the risks of investing in them.[35] Trading platform operators can only open an account for, or provide services to, investors who lack knowledge of virtual assets if they have provided adequate training to the investor. The VATP Guidelines set out non-exhaustive criteria for assessing whether an investor can be regarded as having knowledge of virtual assets. These are whether the investor has undergone training or attended courses on virtual assets or has virtual asset-related work experience or prior trading experience in virtual assets.

For clients other than institutional investors and qualified corporate professional investors, VA trading platform operators must also assess clients’ risk tolerance level and determine their risk profile and whether they are suitable to trade virtual assets.[36] Clients’ risk profile needs to be determined based on an assessment of their financial situation and investment experience and objectives.[37]

Virtual Asset Exposure Limits for Certain VA Clients

Except for institutional and qualified corporate professional investors, VA trading platform operators are also required to set a limit on each client’s exposure to virtual assets to ensure that the client’s exposure to virtual assets is “reasonable”, given the client’s financial situation (including its net worth) and personal circumstances. Platform operators will be required to notify these clients of the limit assigned to them and to regularly review clients’ exposure limits to ensure that they remain appropriate.[38]

SUITABILITY OBLIGATIONS

When making a recommendation or solicitation with respect to virtual assets, Platform Operators are required (except when dealing with institutional and qualified corporate professional investors) to ensure the suitability of the recommendation or solicitation for the client is reasonable in all the circumstances, having regard to information about the client of which the platform operator is or should be aware through the conduct of due diligence.

Platform operators need to establish a proper mechanism for assessing the suitability of virtual assets for clients. The suitability assessment needs to be made on a holistic basis (taking into account the client’s personal circumstances and concentration risk) and the risk return profile of the recommended virtual asset should match the client’s personal circumstances.

SUITABILITY OBLIGATIONS IN THE CONTEXT OF COMPLEX PRODUCTS

Except when dealing with institutional or qualified corporate professional investors, trading platform operators must ensure that any transaction in a virtual asset that is a complex product is suitable for the relevant client (even if the transaction has not been recommended or solicited by the platform operator).

A complex product is a virtual asset whose terms, features and risks are not likely to be understood by a retail investor because of its complex structure.[39] The factors to be taken into account in determining whether a virtual asset is a complex product include: whether the virtual asset is a derivative product; whether a secondary market is available for the virtual asset at publicly available prices; whether there is adequate and transparent information about the virtual asset available to retail investors; whether there is a risk of losing more than the amount invested; whether any features or terms of the virtual asset could fundamentally alter the nature or risk of the investment or pay-out profile or include multiple variables or complicated formulas to determine the return, for example where the investment carries the right for the issuer to convert it into a different investment; and whether the virtual asset’s features might render the investment illiquid, difficult to value or both.

Platform operators also need to provide prominent and clear warnings about complex products before and reasonably proximate to the point of sale for, or advice regarding, complex products.

VIRTUAL ASSET TRADING PLATFORMS’ DISCLOSURE OBLIGATIONS

Risk Disclosure Statements

Except when dealing with institutional and qualified corporate professional investors, VA trading platform operators must take all reasonable steps to prominently disclose the nature of virtual assets and the risks that clients may be exposed to in trading virtual assets on the trading platform. Disclosure must include the risk disclosure statements specified in Schedule 2 to the VATP Guidelines.[40]

VA Trading Platforms’ Website Disclosure Obligations

VA trading platform operators are required to disclose a significant amount of information on their websites relating to their business and the rights of their clients. The information required to be disclosed includes: information about the platform’s business and the services offered to clients and its contact details; its trading and operational rules, its token admission and removal rules and criteria, including the criteria for admitting, suspending and withdrawing a virtual asset for or from trading and the “acceptable indices” referenced by the platform operator for admitting virtual assets for trading by non-professional investors; and its admission and trading fees and charges. Websites also need to disclose any services that are only available to professional investors; the rights and obligations of the platform operator and the client under the client agreement required to be entered into with clients, other than institutional and qualified corporate professional investors; the client’s liability for unauthorised virtual asset transactions; its right to stop payment of a pre-authorised virtual asset transfer; when the platform operator can disclose the client’s personal information to third parties, including regulators and auditors; and the available dispute resolution mechanisms, including the complaints procedures.

Disclosure of Information for each Virtual Asset Traded

Licensed platform operators need to post information about each virtual asset traded on their platforms. That information includes: the virtual asset’s price and trading volume on the platform, for example in the last 24 hours and since its admission for trading on the platform; background information about the virtual asset’s management or development team or any of its known key members; the virtual asset’s issue date and its material terms and features; the platform operator’s affiliation with the issuer and its management or development team, or any of its known key members; a link to the virtual asset’s official website and any Whitepaper; a link to any smart contract audit report and other bug reports of the virtual asset; and where the virtual asset has voting rights, how those voting rights will be handled by the platform operator. Platform operators need to take all reasonable steps to ensure that product-specific and other information posted on their platforms is not false, misleading or deceptive. They are also required to disclose their financial condition upon request to clients by providing their latest audited balance sheet and profit and loss account filed with the SFC and any material changes adversely affecting their financial condition since the date of the accounts.

VIRTUAL ASSET TRADING PLATFORM OPERATOR OBLIGATIONS RE. HANDLING CLIENT VIRTUAL ASSETS

A licensed virtual asset trading platform operator can only hold client assets, that is client virtual assets and client money, through an associated entity.[41] An associated entity is a Hong Kong-incorporated subsidiary of the virtual asset trading platform operator which is a licensed trust or service company provider under the AMLO which has notified the SFC that it is an associated entity of the licensed virtual asset trading platform operator under section 53ZRW of the AMLO and section 165 of the SFO. The associated entity is not allowed to conduct any business other than that of receiving or holding client assets on behalf of the trading platform operator.

Client virtual assets must be held in wallet address(es) established by the platform operator’s associated entity and must be segregated from the assets of the platform operator and its associated entity.[42] At least 98% of client virtual assets must be held in cold storage[43] which is less vulnerable to hacking and other cybersecurity risks, except in limited circumstances allowed by the SFC on a case-by-case basis to minimise losses resulting from the platform being hacked or compromised.

Licensed trading platform operators must have robust internal controls and governance procedures to ensure that cryptographic seeds and private keys are securely generated, stored and backed up. They must also ensure that their associated entities implement the same controls and procedures which must, among others, restrict access to seeds and private keys for client virtual assets to authorised personnel who have been appropriately screened and trained and provide for seeds and private keys to be securely stored in Hong Kong.[44]

LICENSED PLATFORM OPERATORS: INSURANCE AND COMPENSATION PROVISION

Licensed virtual asset trading platform operators must establish a compensation arrangement that is approved by the SFC to cover potential losses arising from, among others, hacking incidents on the platform or default on the part of the licensed platform operator or its associated entity. The compensation arrangement must cover 50% of client virtual assets held in cold storage and 100% of client virtual assets held in hot and other storages. The compensation arrangement can include any or a combination of: third-party insurance; funds held in the form of a demand deposit or time deposit maturing within six months of the platform operator or any of its group companies, which are set aside on trust and designated for that purpose; and a bank guarantee provided by a Hong Kong authorised financial institution, that is a bank regulated by the HKMA.

Licensed platform operators are required to monitor the total value of client virtual assets under their custody daily. If a licensed platform operator becomes aware that the total value of client virtual assets under custody exceeds the amount covered under the approved compensation arrangement, and it expects this to continue, it must inform the SFC and take prompt remedial action to re-comply with the VATP Guidelines.[45] Platform operators need to use verifiable and quantifiable criteria when selecting an insurance company. These include a valuation schedule of assets insured, maximum coverage per incident and overall maximum coverage, as well as any excluding factors.

ANTI-MONEY LAUNDERING AND COUNTER-TERRORIST FINANCING OBLIGATIONS

VATPs are subject to the AML and CTF requirements of the AMLO, including the customer due diligence and record-keeping requirements set out in Schedule 2 of the AMLO. In the case of non-compliance with the statutory AML and CTF obligations, both the VATP and its responsible officers commit an offence carrying maximum penalties of a HK$1 million fine and two years’ imprisonment or seven years’ imprisonment if the non-compliance is committed with intent to defraud.

SFC-licensed virtual asset trading platform operators must comply with virtual asset-specific AML/CTF requirements set out in new Chapter 12 of the renamed Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations and SFC-licensed Virtual Asset Service Providers) in addition to the guideline’s general AML/CTF requirements applicable to SFC-licensed entities. The revised and renamed Prevention of Money Laundering and Terrorist Financing Guideline issued by the Securities and Futures Commission for Associated Entities of Licensed Corporations and SFC-licensed Virtual Asset Service Providers requires associated entities of SFC-licensed virtual asset trading platform operators to comply with the Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations and SFC-licensed Virtual Asset Service Providers).

APPLICATION OF THE TRAVEL RULE TO VIRTUAL ASSET TRANSFERS

Financial institutions, which are defined in the AMLO to include virtual asset trading platform operators licensed under the AMLO and/or the SFO, must comply with Section 13A of Schedule 2 to the AMLO which applies the requirements for wire transfers under FATF Recommendation 16, which is the Travel Rule, to transfers of virtual assets. Chapter 12 of the Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations and SFC-licensed Virtual Asset Service Providers) sets out detailed guidance on the statutory obligation. This requires that when acting as an ordering institution of virtual asset transfers, a licensed platform operator must obtain, record and submit the required information of the originator and recipient to the beneficiary institution immediately and securely.[46] When acting as a beneficiary institution, a licensed platform operator must obtain and record the required information submitted by the ordering institution or intermediary institution.[47] Licensed platform operators also have to conduct due diligence on virtual asset transfer counterparties, that is the ordering institution, intermediary institution or beneficiary institution involved in a virtual asset transfer, to identify and assess the associated money laundering and terrorist financing risks so as to apply risk-based AML/CTF measures.[48]

Chapter 12 also sets out requirements relating to identifying suspicious transactions and conducting sanctions screening of all relevant parties involved in a virtual asset transfer.[49]

The Travel Rule requirements for virtual asset transfers took effect on 1st June 2023. However, the obligation on ordering institutions to submit the required information to the beneficiary institution immediately, which means before or when the virtual asset transfer is conducted,[50] has been delayed until 1 January 2024. In the interim, the SFC will allow ordering institutions to submit the required information to the beneficiary institution as soon as practicable after the virtual asset transfer, although they must comply with all other travel rule requirements from 1st June 2023, including the requirement to submit the required information securely.

AUDITOR APPOINTMENT AND SUBMISSION OF AUDITED ACCOUNTS/ FINANCIAL RESOURCES RETURNS

Licensed VA trading platforms and their associated entities, that is their Hong Kong incorporated wholly-owned subsidiaries that receive or hold client assets, are required to appoint an auditor within one month of the grant of the VA trading platform licence and file audited financial statements with the SFC within four months of the end of their financial year. Corporations licensed under the SFO must also submit monthly financial resources returns to the SFC. Licensed VA trading platforms are also required to notify the SFC of their financial year end within one month of the grant of their licence.

LICENSED VIRTUAL ASSET TRADING PLATFORM OPERATORS’ ONGOING REPORTING AND NOTIFICATION OBLIGATIONS

The submission of notifications, regulatory filings and annual returns should be made through the WINGS website.

CHANGES TO VATP LICENCES REQUIRING PRIOR SFC APPROVAL

The SFC’s prior approval is required for certain licence changes including (among others): a change or waiver of a licensing condition; a change of financial year or the adoption of a period exceeding 12 months as the financial year; the use of new premises for keeping records or documents; cessation of business; and a person becoming a substantial shareholder and/or an ultimate owner of a VA trading platform operator.

Application for approval is generally made on Form VA2, except for approval of changes to the licensed entity’s substantial shareholders and ultimate owners for which Form VA4 should be used.

CHANGES AND EVENTS REQUIRING NOTIFICATION TO THE SFC

The SFC must also be given notice of certain events within seven business days. These events include (among others): (i) a person ceasing to act as a licensed representative or a responsible officer; (ii) a change in the name of a VA trading platform operator, a substantial shareholder or ultimate owner; (iii) a change in the business address of a VA trading platform operator or its associated entity; (iv) a change in director of the VA trading platform operator or its associated entity or their particulars, and a change in the complaints officer or the emergency contact person or their particulars.

Other changes that must be notified to the SFC include any change in the share capital or shareholding structure of the VA trading platform operator, its substantial shareholder(s) and associated entity and any significant changes in the nature of business carried on and types of services provided by the trading platform operator and any significant changes in its business plan.

Changes in Managers-In-Charge of Core Functions or their particulars must also be notified to the SFC as well as a change in bank accounts, a change of auditor or of a motion to change the auditor in general meeting.

A change in the platform’s associated entity or its particulars must be notified to the SFC, as well as changes to the associated entity’s wallet addresses and any change in a trading platform’s or licensed representative’s authorisation to carry on any regulated activity by any authority or regulatory organisation in Hong Kong or elsewhere.

CONTINUOUS PROFESSIONAL TRAINING REQUIREMENTS FOR LICENSED INDIVIDUALS

SFC-licensed virtual asset platform operators are responsible for planning and implementing a continuous education programme appropriate to the training needs of their licensed employees. Training programmes can be designed with reference to the licensed corporation’s size, structure, scope of business activities and risk management system. Licensed platforms should assess their training programmes annually to determine whether any adjustments are required.

Responsible Officers need to complete 12 CPT hours per calendar year, of which two CPT hours should cover regulatory compliance topics. Licensed Representatives are required to complete 10 CPT hours per calendar year.

The Guidelines for Virtual Asset Trading Platform Operators require VA trading platform operators and their associated entities to immediately notify the SFC of various matters. These include: any material failure, error or defect in the operation or functioning of the platform operator’s or its associated entity’s trading, custody, accounting, clearing and settlement systems or equipment; and any material breach or non-compliance, or suspected material breach or non-compliance, with the SFO, the AMLO, or any SFC rules, regulations, codes, circulars, FAQs or guidelines (including the VATP Guidelines) by the platform operator, its associated entity or any person appointed to conduct business with clients on their behalf. To accommodate this requirement, the SFC has upgraded its existing paragraph 12.5 notifications online portal to enable reports of incidents of material breach and non-compliance to be submitted to the SFC electronically.

The SFC must also be notified immediately of any resolution passed, proceedings initiated, or order made which may result in the appointment of a receiver, provisional liquidator, liquidator or administrator or the winding-up, re-organisation, dissolution or bankruptcy of the platform operator, its associated entity, substantial shareholder or ultimate owner, or any receiving order or arrangement or composition with creditors. The bankruptcy of any director of the platform operator or its associated entity and the exercise of any disciplinary measure against the platform operator or its associated entity by any regulatory or other professional or trade body, or the refusal, suspension or revocation of any regulatory licence, consent or approval required in connection with the platform operator’s or its associated entity’s business, must also be notified to the SFC immediately.

THE MARKET MISCONDUCT REGIME UNDER THE AMLO

The AMLO creates various offences in relation to activities in virtual assets that are not-securities. Firstly, making a fraudulent or reckless misrepresentation to induce an acquisition or disposal of a virtual asset is an offence, whether the transaction takes place on a licensed VA exchange or not, under section 53ZRG of the AMLO. The offence carries maximum penalties of a HK$1 million fine and seven years’ imprisonment.

In addition, in a transaction involving virtual assets, it is an offence for a person to employ any device, scheme or artifice with intent to defraud or deceive or engage in any fraudulent or deceptive act, practice or business under section 53ZRF of the AMLO. The maximum penalties for this offence are a HK$10 million fine and 10 years’ imprisonment. The maximum penalties for this offence are a HK$10 million fine and 10 years’ imprisonment.

It is also an offence for an unlicensed person to issue, or possess for the purpose of issue, an advertisement which holds the person out as prepared to provide a VA service under section 53ZRE of the AMLO. The offence carries sanctions of a HK$50,000 fine and six months’ imprisonment.

THE SFO’S MARKET MISCONDUCT REGIME

Comparable offences exist under the SFO in relation to the same conduct in virtual assets that are securities within the statutory definition.

OFFENCE TO FRAUDULENTLY OR RECKLESSLY INDUCE OTHERS TO INVEST MONEY

It is an offence under section 107 of the SFO to make any fraudulent or reckless misrepresentation to induce another person, among others, to deal in securities which includes acquiring, disposing, subscribing for or underwriting securities. Any person found guilty of an offence under Section 107 of the SFO is liable to a maximum fine of HK$1 million and up to seven years’ imprisonment.

OFFENCE INVOLVING FRAUDULENT OR DECEPTIVE DEVICES

It is an offence under Section 300 of the SFO for a person in a transaction involving securities, including an offer or invitation, however that is expressed, to employ any device, scheme or artifice with intent to defraud or deceive or engage in any act or practice which is fraudulent or deceptive. An offence under Section 300 is punishable by a fine of up to HK$10 million and imprisonment for up to 10 years by virtue of Section 303 of the SFO.

OFFENCE TO ISSUE ADVERTISEMENTS TO THE HK PUBLIC TO ACQUIRE, DISPOSE OF, SUBSCRIBE FOR OR UNDERWRITE SECURITIES

A further offence exists under section 103 of the SFO where a person issues, whether in Hong Kong or elsewhere, an advertisement, invitation or other document containing an invitation to the Hong Kong public to enter into, or offer to enter into, an agreement to acquire, dispose of, subscribe for or underwrite securities, unless the issue of the advertisement, invitation or document has been authorised by the SFC under section 105(1) of the SFO or an exemption applies. The exemptions most commonly relied on include those for invitations with respect to securities that are or are intended to be disposed of only to professional investors or only to persons outside Hong Kong under sections 103(3)(j) and (k) of the SFO.

SFC SANCTIONING POWERS: S53ZSP AMLO & S194 SFO

The SFC’s disciplinary powers against licensed VA trading platforms and their officers are extensive. The provisions under the AMLO relating to VA trading platforms offering trading in non-security virtual assets have equivalent provisions in the SFO for platforms trading virtual asset securities.

DISCIPLINARY ORDERS FOR MISCONDUCT & NOT BEING FIT AND PROPER

Under section 53ZSP of the AMLO and section 194 of the SFO, the SFC can exercise its disciplinary powers to sanction a regulated person if the person is, or was at any time, guilty of misconduct or is considered not fit and proper to be or to remain the same type of regulated person. The term “regulated person” is defined as a person who is, or was at the relevant time: a licensed VA trading platform, a licensed representative or responsible officer of a licensed trading platform, or a person involved in the management of the business of a licensed trading platform irrespective of whether that person is licensed.[51] This means that all members of a licensed trading platform’s senior management are subject to the SFC’s disciplinary powers even if they are not licensed, because of their involvement in the management of the trading platform’s business.

“Misconduct” is defined in section 53ZSR(2) of the AMLO and section 193 of the SFO to include a breach of any provision of the AMLO or SFO; a breach of the terms or conditions of a person’s licence; and an act or omission relating to the carrying on of any regulated activity or VA service for which a person is licensed which, in the opinion of the SFC, is or is likely to be prejudicial to the interest of the investing public or to the public interest.[52] Before forming any opinion for this purpose, the SFC is required to take into account its prevailing codes and guidelines on the matter.[53]

In determining whether a regulated person, is a “fit and proper” person for the purpose of considering taking disciplinary action, the SFC can, among other matters, take into account the past or present conduct of the person.[54] In its FAQs, the SFC gives as an example of a situation where the SFC could consider bringing disciplinary proceedings against a manager-in-charge, the situation where the manager-in-charge fails to ensure the licensed platform’s compliance with the SFC’s codes and guidelines.

As to the sanctions that the SFC can impose against a regulated person, these are set out in section 53ZSP of the AMLO and section 194 of the SFO. They include a public or private reprimand and a fine of up to the greater of HK$10 million or three times the amount of profit gained or loss avoided by the person as a result of their misconduct, or the conduct which led the SFC to believe that they were not fit and proper to be or to remain the same type of regulated person. The SFC can also revoke or suspend the licence of a licensed trading platform or licensed representative and revoke or suspend the approval of a responsible officer. The SFC has the power to order the regulated person to take any action specified by the SFC to remedy the person’s breach of the relevant Ordinance, or their act or omission in carrying on any regulated activity or VA service for which the person is licensed which the SFC considers to be prejudicial to the public interest. If the person fails to comply with that order, the SFC can fine the person a further HK$100,000 for each day the failure continues after the deadline for compliance imposed by the SFC. Finally, the SFC can prohibit a regulated person for the duration of a specified period from applying to be licensed or to be approved as a responsible officer. Under the AMLO, the regulated person will be prohibited from applying to be licensed to provide a VA service, while under the SFO, the regulated person will be prohibited from applying to be licensed or registered in relation to a regulated activity or applying to be a responsible officer of an SFC-licensed corporation or an executive officer of an SFC-registered institution.

As regards the SFC’s ability to impose fines under sections 53ZSP of the AMLO and section 194 of the SFO, it has published disciplinary fining guidelines under both Ordinances. The guidelines state that the factors the SFC will take into account in determining whether to impose a fine, and the amount of a fine, include the seriousness of the conduct and whether the person’s conduct was intentional, reckless or negligent. In assessing this, the SFC will give consideration to whether a firm obtained prior advice on the legality or acceptability of the relevant conduct from its advisers, or in the case of an individual, whether they sought such advice from their supervisors or the firm’s compliance staff. Other factors the SFC takes into account in exercising its power to impose fines include whether the person’s conduct causes loss to others, or benefits to the firm or individual who engaged in that conduct or any other person, and more general factors such as whether the misconduct will cause any reputational damage to Hong Kong. In the case of a licensed VA trading platform, the SFC will also consider whether the misconduct is the result of serious or systemic weaknesses in the firm’s management systems or internal controls. The SFC noted in its Consultation Conclusions on the AMLO disciplinary fining guidelines that it will take into account the level of sophistication of market participants affected by the misconduct, the positions held by the persons who committed misconduct, and the remedial actions taken by those involved, which it says are reflected in the Disciplinary Guidelines in the specific considerations under the items they refer to as “the nature and seriousness of the conduct” and “other circumstances of the firm or individual”.

INDIVIDUALS’ LIABILITY: SECTIONS 53ZSR(5) AMLO & 193(2) SFO

Section 53ZSR(5) of the AMLO and section 193(2) of the SFO further provide that responsible officers and persons involved in the management of licensed VA trading platforms may also be considered to be guilty of misconduct, and thus liable to disciplinary sanction, where the licensed VA trading platform operator is, or was, guilty of misconduct. Responsible officers and persons involved in the management of licensed VA trading platforms will be regarded as guilty of misconduct, if the licensed VA trading platform’s commission of misconduct occurred with their consent or connivance, or was attributable to neglect on their part.

SECTIONS 53ZTH AMLO & 213 SFO

Section 53ZTH of the AMLO and section 213 of the SFO also allow the SFC to apply to the Court of First Instance to make various orders against a person who has breached any provision of the relevant Ordinance; any condition of their SFC licence; or any other condition or requirement imposed or notice given under any provision of the relevant Ordinance. The AMLO additionally allows the SFC to apply for orders against a person who has breached any provision of any code or guideline published under the AMLO which would include a breach of any provision of the VATP Guidelines. The SFC tried to include a similar provision in the SFO when it published its Consultation Paper on Proposed Amendments to Enforcement-related Provisions of the SFO in June 2022 which consulted the market on various amendments to the SFO. The amendment would have allowed the SFC to seek orders, including orders for the payment of compensation, against a person in breach of the various SFC Codes, including the Code of Conduct for Persons Licensed by or Registered with the SFC. The SFC however dropped that proposal in the face of widespread opposition from the market which had concerns regarding the courts being able to impose legal remedies for breaches of SFC codes and guidelines which are non-statutory and the fairness of the proposed amendment.

Under sections 53ZTH of the AMLO and section 213 of the SFO, the SFC can seek orders not only against the person who has committed the relevant breach, but also against others who have, for example, assisted or conspired with the wrongdoer to commit the breach, or been knowingly involved in its commission. The orders that the court can impose include an order to freeze the assets of the relevant person and so-called restoration orders. A restoration order is an order for the wrongdoer to restore the counterparties to relevant transactions to the positions they were in before entering into the transactions. There have been a number of cases in recent years where the SFC has been successful in using section 213 of the SFO to obtain orders freezing the assets of persons involved in insider dealing, for example, to ensure that those assets remain available for future restoration orders compensating the victims of the insider dealing. In the landmark Tiger Asia case which involved it insider dealing in the shares of two banks, the court first imposed an injunction freezing the assets of Tiger Asia and three of its senior officers pending the grant of the final orders. It then ordered the unwinding of transactions between Tiger Asia and 1,800 sellers of the banks’ shares, and ordered Tiger Asia and two of its senior officers to pay around HK$45.3 million to the sellers to restore them to their position before the share sales to Tiger Asia. This was the first time the SFC obtained a restoration order for insider dealers to compensate investors for losses resulting from insider dealing. Since the Tiger Asia decision, Section 213 has become the SFC’s weapon of choice for obtaining investor compensation in insider dealing and other market misconduct cases. Other orders that can be imposed by the Court of First Instance include injunctions prohibiting the contravening conduct, orders appointing an administrator of a person’s property, orders declaring a contract relating to virtual assets to be void, and ancillary orders.

SFC POWERS WITH RESPECT TO LICENSED VIRTUAL ASSET PLATFORM OPERATORS

The SFC has broad powers under the SFO and AMLO to enter the business premises of licensed VA trading platforms and their associated entities to conduct routine inspections; request production of documents and records; investigate breaches and sanction licensed persons involved in the breaches. Possible sanctions include a reprimand, an order for remedial action, a fine and suspension or revocation of a person’s licence.

The SFC can also appoint an auditor to conduct an investigation into the affairs of a licensed VATP and its associated entities where it has reason to believe that there has been a breach of the AMLO or any code or guideline published under it. The SFC also has intervention powers to impose restrictions and prohibitions on the operations of a licensed VATP and its associated entity in certain circumstances, for example where it is necessary to protect client assets.

TRANSITIONAL ARRANGEMENTS FOR VA EXCHANGES OPERATING IN HONG KONG BEFORE 1ST JUNE 2023

The AMLO licensing regime for virtual asset trading platform operators trading virtual assets that are not securities commenced on 1st June 2023. From 1st June 2023, any unlicensed virtual asset trading platform trading non-security virtual assets and carrying on business in Hong Kong or actively marketing its services to Hong Kong investors will breach the licensing requirements under the AMLO licensing regime, unless the AMLO’s transitional arrangements apply.

The AMLO’s transitional arrangements allow virtual asset trading platforms trading non-security tokens which operated and had a meaningful and substantial presence in Hong Kong before 1st June 2023 to continue to operate in Hong Kong without a licence until 31st May 2024. When considering whether a VA trading platform has a “meaningful and substantial presence in Hong Kong”, the SFC will consider, among others, whether it is incorporated in Hong Kong, whether it has a physical office in Hong Kong; whether its central management and control and key personnel are based in Hong Kong; and whether the trading platform is live with a considerable number of clients and volume of trading activities in Hong Kong.

Operators of pre-existing trading platforms which apply online for a licence under the AMLO between 1st June 2023 and 29th February 2024 will also be deemed to be licensed from 1st June 2024 until the earlier of the approval, withdrawal or refusal of their licence application.

When submitting a licensing application, pre-existing virtual asset trading platform operators need to confirm and demonstrate that they operated a virtual asset trading platform in Hong Kong immediately before 1st June 2023 and that, on being deemed to be licensed, they will comply with, and have arrangements in place to ensure compliance with, the regulatory requirements applicable to licensed platform operators. If the SFC finds that a licence applicant does not meet the necessary conditions or does not have a reasonable prospect of showing that it is capable of complying with the relevant legal and regulatory requirements, it will notify the trading platform that the deeming provision will not apply to it. The virtual asset trading platform must then close down its business by 31st May 2024 or within three months of the date of the SFC notice, whichever is later.

Similar provisions apply to individuals performing regulated functions for a virtual asset trading platform operating in Hong Kong before 1st June 2023. They can continue to perform regulated functions without a licence and will be subject to a deeming arrangement from 1st June 2024.

To be eligible for the deeming arrangement, individuals applying to be responsible officers of a pre-existing VA trading platform must have been performing the relevant regulated function for a VA trading platform (whether operating in or outside Hong Kong) immediately before 1st June 2023 and, at the time of application, must be performing a regulated function in Hong Kong for the pre-existing VA trading platform. To be eligible for the deeming arrangement, licensed representatives of a pre-existing VA trading platform must be performing a relevant regulated function in Hong Kong at the time of application.

Once platforms and individuals are deemed to be licensed or approved as responsible officers, they must comply with all legal and regulatory requirements under the AMLO regime for licensed virtual asset trading platforms.

The transitional arrangements under the AMLO licensing regime apply only to the trading of non-security tokens by virtual asset trading platforms. There are no transitional arrangements under the SFO. Virtual asset trading platforms intending to offer trading in security tokens need to be separately licensed under the SFO for Type 1, that is dealing in securities, and Type 7, providing automated trading services, regulated activities before they commence operations in Hong Kong.

SFC WARNING: VATPS ENGAGING IN IMPROPER PRACTICES – 7 AUGUST 2023

The SFC issued a warning statement on 7th August 2023 entitled ‘Warning: Virtual asset trading platforms engaging in improper practices’ warning unlicensed virtual asset trading platforms of the potential legal and regulatory consequences of false claims to have applied for SFC-licensing, and providing prohibited services, such as virtual asset deposit-taking paying a return to depositors. The statement also warned investors of the risks of trading crypto on unlicensed exchanges which may not comply with Hong Kong’s regulatory requirements for licensed virtual asset trading platforms. Hong Kong currently has only two licensed trading platforms.

According to the warning statement, some unlicensed trading platforms operating in Hong Kong claim to have submitted a licensing application to the SFC, when this is not true. If that is the case, these platforms risk committing an offence under section 53ZRG of the AMLO, that is the offence of making a fraudulent or reckless misrepresentation in order to induce an acquisition or disposal of a virtual asset. According to the SFC, false claims to have applied for SFC licensing can mislead the investing public into believing that the crypto exchange complies with the regulatory requirements for licensing, when this is not the case. If the exchange subsequently applies for a licence, the SFC says that it will take any misrepresentation as to the exchange’s licensed status into account in determining its fitness and properness to be licensed.

The SFC’s August warning statement also noted that some unlicensed trading platforms have tried to take advantage of the AMLO’s transitional arrangements. Some unlicensed platforms apparently set up new entities to provide virtual asset services in Hong Kong before the 1st of June 2003 and announced their intention to apply for licences for these new entities. As mentioned earlier, trading platforms with a substantial presence in Hong Kong before 1st of June 2003 can continue their operations without a licence until 31st May 2024, but need to apply for a licence by February 29th 2024 to be able to continue operating from 1st June 2024. These platforms will need to comply with all the requirements of the AMLO from the date of grant of their licence, or from 1st June 2024, if their licence application has not been approved by that date and they are ‘deemed’ to be licensed under the transitional provisions’ deeming arrangements. The SFC reminds these trading platforms that the deeming arrangement does not automatically apply to platforms operating in Hong Kong before 1st June 2023. If the SFC considers that a platform does not satisfy the relevant legal and regulatory requirements, or does not have a reasonable prospect of demonstrating compliance with those requirements, it will give notice to the trading platform that the deeming provision will not apply to it under section 3 of Schedule 3G to the AMLO. The platform will then have to close down its business by 31st May 2024, or within three months of the date of the SFC notice, whichever is the later. Investors therefore need to be aware that exchanges that claim to have submitted a licence application may not in fact do so, and may not be complying with the AMLO’s requirements. In fact, before they are actually licensed, or become deemed to be licensed on 1st June 2024, there is no obligation on a trading platform relying on the transitional provisions to comply with the AMLO’s regulatory regime. However, the SFC may refuse to grant a platform a licence, or allow it to rely on the deeming provisions, if the SFC does not consider it to be fit and proper, for example if it conducts activities that are prohibited under the AMLO. The SFC states in the warning statement that some unlicensed trading platforms are offering services and products that do not comply with the applicable legal and regulatory requirements. These include offering to retail investors virtual assets that are unsuitable for retail trading; offering services in virtual asset derivatives; and offering products such as “virtual asset deposits”, “savings” or “earnings”, all of which are prohibited under the AMLO regime. The SFC warns that in assessing VATPs’ licensing applications, it will take into account any previous non-compliant activities that could have been avoided. Specifically, the SFC states that it will take a negative view of non-compliant activities that result in client transactions having to be unwound, or a virtual asset being removed from retail trading, if that could have been avoided. Separately, in assessing these platforms’ licensing applications, the SFC will also consider whether the platforms genuinely intend to rectify non-compliant activities, and unwind prohibited transactions in an orderly manner.

The SFC has published various lists showing the licensed status of trading platforms operating in Hong Kong or actively marketing their services in Hong Kong. These lists do not however include a list of trading platforms that are relying on the AMLO’s transitional provisions to operate without a licence. They do however include a list of trading platforms that have applied to the SFC for licensing and a list of suspicious virtual asset trading platforms.

The warning statement reminds unlicensed crypto exchanges that they cannot operate in Hong Kong until they have been licensed by the SFC, unless they can rely on the transitional arrangements for exchanges with a substantive presence in Hong Kong before 1st June 2023. It also warns investors that, with the exception of platforms on the SFC’s list of licensed virtual asset trading platforms, of which there are currently only two, all trading platforms currently operating, or promoting their activities, in Hong Kong are not regulated by the SFC. The SFC warns investors to be wary of the risks of trading virtual assets on an unregulated trading platform and that they may face the risks of losing their entire investment held on the platform if it ceases to operate, collapses, is hacked or its virtual assets are otherwise misappropriated.

POLICE ARRESTS RELATING TO UNLICENSED VATP – JPEX

JPEX, which was one of the crypto exchanges the SFC was alluding to in its August warning statement. The Hong Kong police have reportedly arrested 36 people allegedly involved in suspected fraud on the part of unlicensed crypto exchange, JPEX, allegedly involving more than 2,500 victims and losses of over HK$1.58 billion (as at 27th October 2023).[55] Other individuals believed to be involved have reportedly fled Hong Kong. The main allegations against JPEX are that it made false claims to be regulated and conducted activities that are prohibited under the AMLO regulatory regime. The SFC apparently started investigating JPEX in March 2022 and put it on the SFC alert list in July 2022 when JPEX failed to respond to its requests for information. From then on, the SFC and the Investor and Financial Education Council together issued investor alerts on at least nine occasions on their respective websites, social media platforms and via TV/radio channels, warning of the risks of dealing with unlicensed platforms and related malpractices.

JPEX hit the headlines in September 2023, when the SFC issued two public announcements warning investors that JPEX’s claims to be regulated are false, and that some of its activities, including offering high returns on various virtual asset products, are prohibited under the AMLO. It also noted that it had referred the matter to the police due to suspected fraud.

ALLEGATIONS AGAINST JPEX

The SFC issued its first warning statement with respect to JPEX on 13th September 2023. The statement warned investors that JPEX’s claims to be a regulated platform are false. JPEX allegedly claims on its website and in multiple advertisements to be “a licensed and recognised platform to facilitate the trading of digital asset and virtual currency”. The SFC statement warns investors that neither JPEX, nor any of its group companies, has been, or applied to be, licensed as a virtual asset trading platform by the SFC. JPEX also allegedly claims on its website and in local advertorials to have obtained licences from certain overseas regulators to operate a virtual asset trading platform, which is not true. Although JPEX is registered as a business entity in various jurisdictions, the SFC states that these registrations do not allow it to conduct virtual asset trading services. JPEX additionally makes false claims on its website to be regulated by VARA, the Virtual Assets Regulatory Authority of Dubai, and to be subject to what it describes as VARA’s “stricter regulatory standards”. Although JPEX does have its headquarters in Dubai, it is not on VARA’s list of licensed virtual asset service providers. JPEX apparently also falsely claimed on its website to have a business cooperation with a Hong Kong-listed company when that cooperation was actually terminated in 2022 without the listed company making any investments.

According to the SFC, various other parties, including social media influencers, “key opinion leaders” and over-the-counter virtual asset money changers, which it refers to as OTC Shops, have actively promoted JPEX’s products and services to the Hong Kong public. They have also allegedly made false or misleading statements on social media suggesting that JPEX had applied for a VATP licence in Hong Kong. The SFC has apparently asked these parties to stop all activities promoting JPEX and its products and services.

JPEX allegedly offered unusually high returns on virtual asset “deposits”, “savings” and “earnings” products, reportedly marketing its savings product as providing annual interest or return of 21% for ETH, 20% for BTC and 19% for USDT. If proven, these activities would put JPEX in breach of Paragraph 7.26(b) of the VATP Guidelines which prohibit even licensed virtual asset trading platforms from using clients’ virtual assets to generate returns for their clients or any third party.

The SFC also noted in the warning statement that it has received, and that there have been reports in the media about, complaints from retail investors that they could not withdraw their virtual assets from their JPEX accounts, or that their account balances had been reduced or altered. There have also been media reports that JPEX increased its fees for handling withdrawals from 995 to 999 Tether tokens for every 1,000 USDT withdrawn,2 in order to disincentivise clients from withdrawing their virtual assets.

SFC “WARNING ON JPEX” OF 20 SEPTEMBER 2023

The SFC issued its second warning statement on the 20th of September 2023 reiterating its suspicions about JPEX. It also criticised JPEX’s publication of confidential correspondence between it and the SFC’s Enforcement Division on its website, in breach of the secrecy and confidentiality provisions of the SFO and the AMLO. Section 378 of the SFO and section 76B of the AMLO require persons assisting the SFC in a statutory investigation or enquiry to keep information confidential.

The SFC’s statements also warn investors of the risks of trading virtual assets on unregulated crypto exchanges and highlight the difficulty of seeking recourse against, and obtaining legal remedies from, exchanges that have no nexus with Hong Kong. The SFC advises investors to check crypto exchanges’ licensing status on the SFC’s list of licensed virtual asset trading platforms. The SFC also warned investors against relying on investment advice posted on social media and influencers’ instant messaging applications given that influencers are often paid promoters rather than investment professionals.

If the allegations against JPEX and the various third parties referred to in the warning statement, the provisions of the AMLO that have potentially been breached include section 53ZRF AMLO which, as we saw earlier, makes it an offence to directly or indirectly employ any device, scheme or artifice with intent to defraud or deceive or engage in any act, practice or course of business that is fraudulent or deceptive or would operate as a fraud or deception in a transaction involving virtual assets. The other potential offence to which the SFC warning statements refer is the offence under section 53ZRG AMLO which makes it an offence for a person to make a fraudulent or reckless misrepresentation to induce another person to enter into, or offer to enter into, an agreement to acquire, dispose of, subscribe for or underwrite virtual assets. For a statement to be a fraudulent misrepresentation, the person making it must know that it is false or misleading. Both offences carry custodial sentences of up to 10 years’ imprisonment in the case of section 53ZRF and up to seven years’ imprisonment in the case of section 53ZRG.

Section 53ZTH of the AMLO and section 213 of the SFO also allow the SFC to apply to the Court of First Instance for various orders against those who have breached the provisions of the Ordinance, and in the case of the AMLO those who breach any provision of the VATP Guidelines. JPEX and those who conspired or were knowingly involved in its breach of the AMLO and the VATP Guidelines, if proven, may therefore be ordered under these provisions to compensate any victims of JPEX’s non-compliant activities.

In a sign that the SFC plans to enforce the virtual asset licensing regimes strictly, the SFC said in its warning statements regarding JPEX, that it will not hesitate to bring enforcement action against individuals and entities that breach the provisions of the VATP licensing regime, including those who are involved in any contravention. Although there has been no official statements of the offences with which individuals involved in the JPEX case have been charged, media reports suggest that they were arrested on charges of conspiracy to defraud.

SFC LISTS OF VATPS

On 29th September 2023, the SFC announced its publication of lists of virtual asset trading platforms on its website disclosing the licensing status of various VATPs operating in Hong Kong or actively promoting their services to investors in Hong Kong. Six lists have been published of licensed virtual asset trading platforms; applicants for virtual asset trading platform licences; applicants whose licence applications have been returned, refused or withdrawn; closing-down virtual asset trading platforms; trading platforms that are deemed to be licensed; and a list of suspicious virtual asset trading platforms.

The SFC advises investors to verify the licensed status of VATPs by reference to its list of licensed platforms and to be wary of the risks of investing in unregulated VATPs. However, it notes that while it will update the lists regularly, they may not be completely up-to-date as changes to the regulatory status of trading platforms may occur between updates.

The SFC’s list of licensed virtual asset trading platforms sets out the names of platform operators that are licensed by the SFC to offer trading in virtual assets. Investors can access detailed information about licensed platforms including: the regulated activities they are licensed for, their business address, the names of their responsible officers, licensed representatives and complaints officer, the conditions attached to their licences, and public disciplinary actions against them in the past five years, Trading platforms’ previous names and their past licence records are also available. These details can also be accessed through the SFC’s public register of licensed persons. Licence applicants will be transferred to this list from the list of VATP applicants if their licensing applications are successful.

The SFC reminds investors that the list only confirms that the VA trading platforms are formally licensed by the SFC, and that the SFC does not guarantee the performance or creditworthiness of any SFC-licensed VA trading platform.

The list of virtual asset trading applicants sets out the names of trading platform operators that have applied to the SFC to be licensed and are waiting for their applications to be approved by the SFC. The SFC’s aim in publishing the list is to allow investors to check whether a VA trading platform has applied to be licensed and verify the accuracy of claims it has made to have applied for licensing. However, the SFC makes clear that licence applicants on this list are not yet licensed or regulated by the SFC, and that their presence on this list does not mean that they comply with the AMLO’s regulatory requirements. The SFC also warns investors that a licence applicant’s inclusion in the list does not mean that[56] it will: meet the conditions under Schedule 3G to the AMLO for being deemed to be licensed from 1st June 2024 if it was operating in Hong Kong before the 1st of June 2023 and eligible to rely on the AMLO’s transitional provisions, or that there is a reasonable prospect of it successfully demonstrating to the SFC that it is capable of complying with the legal and regulatory requirements applicable to licensed VA trading platforms. Nor does a licence applicant’s inclusion in the list mean that they will be licensed by the SFC, and that their applications will not be returned or refused by the SFC.

As regards the list of applicants whose licence applications have been returned, refused, or withdrawn, the SFC will return an application that is incomplete, for example one that fails to submit all the required information and documents including external assessment reports, or if there are unresolved fundamental issues. The SFC will also refuse a licence applicant that it does not consider to be “fit and proper” to be licensed.

The list of closing down VA trading platforms sets out the names of platforms that are required to close down by law within a specified period. For instance, under the new licensing regime’s transitional arrangements, a pre-existing trading platform can be deemed to be licensed from 1st June 2024 until its licence is granted or rejected provided that it submits its licence application before 29th February 2024. However, if a pre-existing trading platform applies for a licence by the February 2024 deadline, and the SFC notifies it that the deemed licensing provision will not apply to it, it must close down by the later of the date falling three months after the date of the SFC’s notification and the 31st of May 2024. When a trading platform is closing down, it cannot provide any services unless the operations facilitate the closing down of its business. During the closing down period, all marketing activities targeting Hong Kong investors are required to cease.

The list of VA trading platforms that are deemed to be licensed sets out the names of trading platforms that are deemed to be licensed as of 1st June 2024. Where the licence application of a deemed to be licensed platform is approved, withdrawn or refused, its name will be transferred to either the list of licensed VATPs or the list of closing-down VATPs. The SFC reminds investors that it has not vetted the fitness and properness of these deemed to be licensed VATPs, and they may not eventually be licensed.

The SFC’s list of suspicious virtual asset trading platforms is a list of entities which have come to the attention of the SFC because they are unlicensed in Hong Kong and are believed to be, or to have been, targeting Hong Kong investors or claiming to have an association with Hong Kong. The SFC is encouraging anyone who has been contacted by an unlicensed firm to notify the SFC by completing a complaint form on the SFC’s website.

SFC AND HK POLICE JOINT WORKING GROUP

On the 4th of October 2023, SFC announced its establishment of a joint working group with the Hong Kong Police Force after a high-level meeting on the 28th of September 2023.[57] The working group is made up of representatives from the Hong Kong Police Force’s Commercial Crime Bureau, its Cyber Security and Technology Crime Bureau and its Financial Intelligence and Investigations Bureau, and from the SFC’s Enforcement and Intermediaries Divisions. The mission of this working group is to facilitate the exchange of information regarding suspicious activities and VA trading platforms’ breaches of the regulatory regime applicable to them and to improve coordination and collaboration in investigating illegal activities.

On the 25th of September 2003, the SFC announced that it is worked with the Investor and Financial Education Council to educate and warn investors about the risks of trading virtual assets on unregulated platforms. These initiatives include the publication of the various lists as mentioned previously. The SFC is also proposing to launch a public campaign to raise investor awareness of the risks associated with virtual assets and the potential for fraud through education talks and through the media and social media.

These latest developments as at 31 October 2023 indicate that the Hong Kong regulators will not hesitate to enforce the provisions of Hong Kong’s virtual asset trading platform regulatory regime against those who contravene its requirements.