New Regulatory Requirements for Virtual Asset Trading Platform Operators come into effect

INTRODUCTION

The Securities and Futures Commission (SFC) has been administering an opt-in licensing regime for operators of virtual asset trading platforms (VATPs) since 2019. The opt-in regime only applies to VATP operators that offer trading services in at least one “security” (as defined under the Securities and Futures Ordinance (SFO)) (the SFO regime). This was regarded as a first step until Hong Kong could introduce specific legislative provisions (housed within the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO)) that would require the licensing of VATP operators that offer trading services in non-security tokens (the AMLO regime).

The SFC issued, on 23 May 2023, consultation conclusions on the regulatory requirements for licensed VATP operators.  The conclusions confirmed, among other things, that licensed VATPs may grant access to retail investors subject to additional safeguards (such as requiring any virtual asset available for retail trading to be “large-cap” and approved by the SFC in advance). The key conduct requirements are set out in the “Guidelines for Virtual Asset Trading Platform Operators” (the VATP Guidelines), with general information on licensing matters summarised in a licensing handbook[1].

The AMLO regime and the VATP Guidelines came into effect on 1 June 2023.

The SFO regime and the AMLO regime will operate side by side (with the former regulating the trading of security tokens and the latter non-security tokens) and the VATP Guidelines will apply to all licensed VATP operators. The SFC expects all VATP operators to be dually licensed under both the SFO and AMLO if they operate (or actively market to investors) in Hong Kong.

To date, only two VATP operators have opted into the SFO regime[2]. The new AMLO regime will require more VATP operators to become licensed if they wish to continue to operate (or actively market to investors) in Hong Kong.         

KEY FEATURES OF THE LICENSING REGIMES

Dual licences

Broadly speaking, the SFC will regulate the trading of security tokens on VATPs under the SFO regime, and non-security tokens under the AMLO regime. [3][4]

However, as the features / terms of a virtual asset may evolve, its classification may change from a non-security token to a security token (or vice versa). To avoid contravention of the licensing regimes and ensure business continuity, the SFC expects VATP operators (together with their proposed responsible officers (ROs) and licensed representatives (LRs)) to be licensed under both regimes.

Applicants will be able to submit a single consolidated application for both licences. For post-licence notifications or applications, it is expected that a single submission will satisfy the requirements under both regimes.

What activities require licensing?

KEY CONDUCT REQUIREMENTS

The VATP Guidelines will apply to all licensed VATP operators and will replace the “Terms and Conditions for Virtual Asset Trading Platform Operators” (T&Cs) previously applicable to VATP operators licensed under the SFO regime. The VATP Guidelines are essentially a modified form of the T&Cs.

Some of the key requirements under the VATP Guidelines are highlighted below.

In addition to the conduct requirements under the VATP Guidelines, licensed VATP operators must also comply with the SFC’s Guideline on Anti-Money Laundering and Counter-Financing of Terrorism, which has been updated to include a new stand-alone chapter addressing AML/CFT risks relating to virtual assets.

Retail investor protection measures

Licensed VATPs may allow retail investors to access their trading services, but only if they comply with additional safeguards. Retail investors mean all investors except for institutional professional investors and qualified corporate professional investors – this means the additional protections also apply to professional investors who are individuals. The additional safeguards include:

• Client onboarding:
  • ensure a retail investor has the requisite knowledge in virtual assets and the relevant risks associated with them[6];
  • assess the financial situation, investment experience /objectives and risk tolerance level of a retail investor; and
  • set a limit for each retail investor to ensure their exposure is reasonable with reference to their financial situation, net-worth and personal circumstances.
• Token admission – virtual assets eligible for retail trading should be “eligible large-cap” virtual assets (i.e. included in at least two different acceptable indices on virtual assets)[7] and fall outside the definition of “securities”. Stablecoins are unlikely to be considered eligible for retail trading at this stage. The SFC’s written approval is required prior to any inclusion, suspension or removal of virtual asset for trading by retail clients[8].
• When dealing with retail clients, ensure suitability of any (i) recommendation or solicitation of a virtual asset or (ii) transaction in complex products.
• Disclosure obligations – additional risk disclosures apply when dealing with retail investors.

General requirements

General token admission

• VATP operators must set up a token admission and review committee which will be responsible for (among other things) establishing, implementing and enforcing the criteria for any virtual asset to be admitted for / withdrawn from trading.
• VATP operators should perform reasonable due diligence on all virtual assets prior to their inclusion, taking into account the factors set out in the VATP Guidelines (which are in addition to those outlined above applicable to virtual assets eligible for retail trading). The SFC expects a non-security token to have at least a 12-month track record.

Safe custody of client assets

• Client virtual assets should be held by either the VATP operator or its subsidiary, not by third-party custodians.
• VATP operators should store 98% of client virtual assets in cold storage (such as Hardware Security Module based cold storage).
• VATP operators should establish and implement internal controls and governance procedures for private key management to ensure all cryptographic seeds and private keys are securely generated, stored and backed up.

• VATP operators should have in place a compensation arrangement to cover potential loss of 50% of client virtual assets in cold storage and 100% of client virtual assets in hot and other storages.
• The arrangement should include any or a combination of the options below:
  • third party insurance;
  • funds or virtual assets of the VATP operator or any corporation within the same group; and
  • bank guarantee provided by an authorized financial institution in Hong Kong.

Other requirements

The VATP Guidelines also impose other requirements relating to fitness and properness, competence, continuous professional training, conduct of business principles, financial soundness, operations, prevention of market manipulative and abusive activities, dealing with clients, management, supervision and internal control, cybersecurity, conflicts of interest, record keeping, auditors and ongoing reporting and notification.

TRANSITIONAL ARRANGEMENTS

• Transitional arrangements apply to qualifying pre-existing VATP operators (trading in non-security tokens) i.e. those in operation in Hong Kong prior to 1 June 2023 and with meaningful and substantial presence (assessed by reference to factors including place of incorporation, location of physical office, central management and key personnel, and whether it has independent clients with genuine trading volume in Hong Kong).
• Pre-existing VATP operators that qualify will: (a) benefit from a “non-contravention period” between 1 June 2023 and 31 May 2024, during which it can remain unlicensed as a VATP; and (b) be granted a deemed licence from 1 June 2024[9] provided it has: (i) submitted a licence application on or before 29 February 2024; (ii) demonstrated in its application that it has a reasonable prospect of successfully showing that it is capable of complying with the regulatory requirements applicable to a licensed VATP from 1 June 2024. This includes submitting at least two RO applications together with its VATP licence application to show it can meet the minimum of two licensed ROs requirement; and (iii) has not received a non-deeming notice from the SFC.
• The above transitional arrangements do not affect the applicability of the SFO regime. VATPs that provide trading in security tokens will continue to be subject to the SFO regime. However, existing SFO-licensed VATP operators will have a 12-month transitional period to comply with the VATP Guidelines (which will supersede the T&Cs).

• ROs and LRs – individuals may perform a regulated function in Hong Kong for Pre-existing VATPs during the non-contravention period. ROs are deemed licensed from 1 June 2024 if they: (i) performed a regulated function for any VATP immediately before 1 June 2023; (ii) are performing a regulated function in Hong Kong for the Pre-existing VATP at the time of application; and (iii) demonstrate they have a reasonable prospect of complying with the regulatory requirements applicable to them from 1 June 2024[10]. LRs only have to comply with (ii) and (iii) in order to benefit from the deeming arrangement.
• The SFC has issued a circular to provide further information on the transitional arrangements.

PRACTICAL IMPLICATIONS

• From 1 June 2023, an operator of, and individuals performing regulated functions for, a Non Pre-existing VATP must be duly licensed if they wish to operate a centralised VATP which either carries on business in Hong Kong or actively markets its services to Hong Kong investors.
• Pre-existing VATP operators intending to become licensed should submit licence applications by 29 February 2024 in order to qualify for the deeming arrangement (ideally, well before the deadline in case the SFC raises any fundamental issues which may take time to resolve).
• In relation to its ROs, a Pre-existing VATP should consider onboarding more than the minimum two ROs (including onshore ROs) who will have complied with all the RO competence requirements on or before 1 June 2024. This will mitigate the risk of scenarios, such as RO resignation, impacting on the ability for the operator to qualify for the deeming arrangement. Pre-existing VATPs who will be onboarding ROs who do not qualify for the deeming arrangement (i.e. did not perform a regulated function in Hong Kong for a VATP before 1 June 2023) is advised to submit its VATP licence application (together with its RO applications) as early as possible in order to give the SFC sufficient time to assess and grant licences to the proposed ROs by 1 June 2024.
• Pre-existing VATP operators that do not intend to apply for the licences should close down its business in Hong Kong by 31 May 2024 at the latest. The SFC expects such operators to cease any active marketing to Hong Kong investors from 1 June 2023.
• VATP operators that do not wish to be subject to the VATP regime in Hong Kong will need to ensure that their activities remain outside of the SFC’s regulatory net. An offshore operator without operations in Hong Kong may nonetheless trigger licensing requirements if, for example, it holds itself out as carrying on such a business in Hong Kong, or actively markets to the public in Hong Kong, whether by itself or by other entities on its behalf.
• The SFC’s FAQ on “Actively markets" under section 115 of the SFO and section 53ZRB of the AMLO” sets out a number of non-exhaustive factors that the SFC would consider when determining whether or not a person “actively markets” its services to the public in Hong Kong, such as whether the services are packaged to target the public of Hong Kong (e.g. written in Chinese and denominated in Hong Kong dollars) and whether the services are extensively advertised via marketing means such as direct mailing, advertisements in local newspapers, broadcasting or other “push” technology over the internet.