Hong Kong SFC Finalises Regulation of Virtual Asset Trading Platforms

Hong Kong’s Securities and Futures Commission (the SFC) has finalised the detailed regulatory requirements for virtual asset (VA) trading platform operators licensed by the SFC with the publication on 23 May 2023 of its Consultation Conclusions¹ to its Consultation Paper on the Proposed Regulatory Requirements for Virtual Asset Trading Platform Operators Licensed by the Securities and Futures Commission published in February 2023. The highly anticipated consultation conclusions are issued in preparation for Hong Kong’s new licensing regime for operators of centralised virtual asset trading platforms offering trading in non-security tokens which takes effect on 1 June 2023 under new Part 5B of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (the AMLO). For details of the new AMLO licensing regime, please see Charltons’ July 2022 newsletter. Trading platforms intending to provide trading in security tokens need to be separately licensed under the Securities and Futures Ordinance (the SFO) for regulated activities Type 1 (dealing in securities) and Type 7 (providing automated trading services). Given the possibility of virtual assets regulatory classification changing from non-security tokens to security tokens, the SFC recommends that virtual asset trading platforms should be licensed under both ordinances.

The following guidelines setting out the detailed regulatory provisions applicable to operators of centralised virtual asset trading platforms licensed under the AMLO come into effect on 1 June 2023:

• the Guidelines for Virtual Asset Trading Platform Operators;
• the Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations and SFC-licensed Virtual Asset Service Providers);
• the Prevention of Money Laundering and Terrorist Financing Guideline issued by the Securities and Futures Commission for Associated Entities of Licensed Corporations and SFC-licensed Virtual Asset Service Providers; and
• the Disciplinary Fining Guidelines (for regulated persons under Part 5B of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance)

With the exception of the Disciplinary Fining Guidelines, the above guidelines also apply to operators of centralised virtual asset trading platforms licensed under the SFO.

Given the large number of questions received in response to the Consultation Paper, the SFC will issue further guidance in the form of circulars, frequently asked questions (FAQs) and a licensing handbook on the new AMLO licensing regime.

The Guidelines for Virtual Asset Trading Platform Operators (the VATP Guidelines)

The Guidelines for Virtual Asset Trading Platform Operators apply to all centralised virtual asset trading platform operators licensed under the AMLO and the SFO. They are based on, and replace, the existing regulatory requirements applicable to SFO-licensed platform operators (in particular, the Terms and Conditions for Virtual Asset Trading Platform Operations). The new VATP Guidelines contain requirements covering (among others) ensuring safe custody of client money and virtual assets (including secure generation of cryptographic seeds and keys); Know-Your-Client obligations; management of AML/CFT risks through appropriate policies; management of conflicts of interest; admission criteria for virtual assets, prevention of market manipulation and abusive activities, risk management and proper accounting and audit functions. The following summarises the outcome of the various matters on which the Consultation Paper sought views.

A. Retail Access to Hong Kong Licensed VA Trading Platforms

SFC-licensed VA trading platform operators will be allowed to provide services to retail investors provided that they comply with a number of investor protection measures covering client onboarding, platform governance, disclosure and token due diligence and admission. Retail investors are investors other than institutional and qualified corporate professional investors which are defined in Schedule 1 to the VATP Guidelines as follows:

• (i) an institutional professional investor is an investor within paragraphs (a) to (i) of the definition of “professional investor” in section 1 of Part 1 of Schedule 1 to the SFO;
• (ii) a qualified professional investor is a trust corporation, corporation or partnership within sections 4, 6 and 7 of the Securities and Futures (Professional Investor) Rules which the VA trading platform operator has assessed to be a qualified professional investor. To make this assessment, the platform operator needs to be reasonably satisfied that the investor meets the following three criteria:
  • (a) the corporate professional investor has the appropriate corporate structure and investment process and controls (i.e. how investment decisions are made, including whether the corporation has a specialised treasury or other function responsible for making investment decisions);
  • (b) the person(s) responsible for making investment decisions on behalf of the corporate professional investor has(have) sufficient investment background (including the investment experience of such person(s)); and
  • (c) the corporate professional investor is aware of the risks involved, which is considered in terms of the person(s) responsible for making investment decisions.²
  • The assessment of a qualified corporate professional investor must be in writing and platform operators should keep records of all relevant information and documents obtained in the assessment so as to demonstrate the basis of the assessment.³ Platform operators need to undertake a new assessment if a corporate professional investor has ceased to trade in virtual assets for more than two years.⁴

Individual professional investors (as defined in section 5 of the Securities and Futures (Professional Investor) Rules) are within the definition of retail investors and must be afforded the same protections as other retail investors.

1. Requirements Prior to Onboarding Retail Investors

Knowledge assessment

Before opening an account for retail investors, trading platform operators are required to assess their knowledge of virtual assets and of the risks of investing in them.⁵ Trading platform operators can only open an account for or provide services to a retail investor who lacks knowledge of virtual assets if they have provided adequate training to the investor. The VATP Guidelines give the following non-exhaustive criteria for assessing whether a retail investor has knowledge of virtual assets:

• (i) whether the investor has undergone training or attended courses on virtual assets;
• (ii) whether the investor has current or previous work experience related to virtual assets; or
• (iii) whether the investor has prior trading experience in virtual assets.

Client’s Suitability for Trading Virtual Assets

As part of the Know-Your-Client procedures, Hong Kong VA trading platform operators offering services to retail investors are required to ensure the suitability of their services for the particular client. Specifically, VA trading platform operators are required to:

• (i) obtain from their retail clients information regarding their financial situation and investment experience and objectives;⁶ and
• (ii) assess the client’s risk tolerance level, determine the client’s risk profile and assess whether they are suitable to participate in virtual asset trading.⁷

Virtual Asset Exposure Limits

VA trading platform operators are also required to set a limit on each retail client’s exposure to virtual assets to ensure that each retail client’s exposure to virtual assets is “reasonable”, given the client’s financial situation (including its net worth) and personal circumstances. Platform operators will be required to notify retail clients of the limit assigned to them and to regularly review clients’ exposure limits to ensure that they remain appropriate.⁸

Further SFC Guidance

In response to requests made during the consultation process, the SFC will issue further guidance in the form of FAQs, for example, on how to assess retail clients’ risk tolerance and exposure to virtual assets.

2. Governance Requirements for Hong Kong Licensed VA Trading Platform Operators

SFC-licensed VA trading platform operators are required to set up a token admission and review committee which should, as a minimum, consist of members of senior management who are principally responsible for managing their key business line, compliance, risk management and information technology functions. The SFC expects members “principally responsible” for the various functions to include the corresponding managers-in-charge (MICs) of the platform operator.⁹ According to the Consultation Conclusions, the SFC will issue guidance in the form of FAQs on a MICs regime to augment accountability of licensed VA trading platforms’ senior management, which will be substantially the same as that for licensed corporations under the SFO.

The responsibilities of the token admission and review committee include:

• (i) establishing, implementing and enforcing the criteria for admitting, suspending and withdrawing, virtual assets for or from trading (which must be disclosed on the platform operator’s website¹⁰) and the rules setting out the obligations and restrictions on virtual asset issuers (e.g. their obligation to notify the licensed platform operator of any proposed hard fork or airdrop, any material change in the issuer’s business or any regulatory action taken against the issuer);
• (ii) making the final decision as to whether to admit, suspend and withdraw a virtual asset for clients to trade based on the criteria; and
• (iii) regularly reviewing the criteria and rules mentioned above.¹¹

The token admission and review committee must report to the board of directors of the VA trading platform operator at least monthly. The committee’s reports must, at a minimum, include details of the virtual assets made available to retail clients for trading.

Hong Kong licensed VA trading platform operators are required to monitor each of the virtual assets admitted for trading on an on-going basis and consider whether to continue to allow them for trading. Regular review reports are required to be submitted to the token admission and review committee. If the committee decides to suspend or withdraw a virtual asset from trading, the platform operator must notify clients as soon as practicable, inform clients holding that virtual asset of the options available, and ensure that clients are fairly treated.¹²

3. Hong Kong Virtual Asset Due Diligence and Admission Criteria

General Token Admission Criteria for Hong Kong Licensed Virtual Asset Trading Platform Operators

The SFC emphasised in its Consultation Paper and Conclusions that virtual assets are not regulated by the SFC per se, meaning that the SFC has not vetted nor reviewed their offering and marketing materials. This is substantially different from the situation where conventional financial products are offered to the public as these are typically subject to the authorisation or registration regime of the regulatory authorities in their respective jurisdictions.

The SFC therefore requires licensed VA trading platform operators to perform reasonable due diligence on all virtual assets, irrespective of whether they will be made available to retail clients, before admitting them for trading to ensure that they meet the token admission criteria established by their token admission and review committee. The non-exhaustive factors which platform operators must consider for all virtual assets include:

• the background of the management or development team of the virtual asset or any of its known key members;
• the regulatory status of the virtual asset in Hong Kong and whether its regulatory status would also affect the regulatory obligations of the platform operator;
• the supply, demand, maturity and liquidity of the virtual asset, including its track record period which for non-security tokens must be at least 12 months;
• the technical aspects of the virtual asset;
• the development of the virtual asset;
• the market and governance risks of the virtual asset;
• the legal risks associated with the virtual asset and its issuer;
• whether the virtual asset’s offered utility, novel use case, innovation or administrative control “clearly appears” to be fraudulent or illegal, or whether its continued viability depends on attracting continuous inflow into the virtual asset;
• the enforceability of rights extrinsic to the virtual asset (e.g. rights to any underlying assets) and the potential impact of trading activity in the virtual asset on the underlying markets; and
• the money laundering and terrorist financing risks associated with the virtual asset.¹³

Specific Token Admission Criteria – Relevant Virtual Asset Must Be “Highly Liquid”

Hong Kong licensed VA trading platform operators intending to make virtual assets available to retail investors must additionally ensure that the relevant virtual assets satisfy the specific token admission criteria set out in paragraphs 7.7 and 7.8 of the VATP Guidelines.

The key requirement is that the relevant virtual asset must be “highly liquid”.¹⁴ For a virtual asset to be considered “highly liquid”, it must, at a minimum, be an “eligible large-cap virtual asset”, i.e. a virtual asset that is included in a minimum of two acceptable indices issued by at least two independent index providers. An “acceptable index” is an index with a clearly defined objective to measure the performance of the largest virtual assets in the global market (for example, an index which measures the top 10 largest virtual assets¹⁵) which is: (i) investible, meaning that the constituent virtual assets should be sufficiently liquid; and (ii) objectively calculated and rules-based. In addition, the index provider must have the necessary expertise and technical resources to construct, maintain and review the methodology and rules of the index, which should be well-documented, consistent and transparent.

The two index providers must be independent of each other, the virtual asset trading platform operator and the issuer of the virtual asset (if relevant). At least one of the index providers must comply with the IOSCO Principles for Financial Benchmarks and have experience of publishing indices for the conventional securities market.

Noting that large market capitalisation does not necessarily correlate with high liquidity, the SFC has said that inclusion in two acceptable indices is a minimum criterion, rather than the sole criterion, for virtual assets to be eligible for trading by retail investors.¹⁶ Trading platform operators are therefore expected to conduct additional due diligence to ensure that eligible large-cap virtual assets admitted for retail trading are in fact highly liquid.

Trading platform operators are also required to ensure that a virtual asset to be admitted for retail trading is not security (as defined in Part 1 of Schedule 1 to the SFO) except where the offering of the virtual asset to retail investors complies with the Hong Kong regulatory requirements for public offers of shares and debentures under the Companies (Winding Up and Miscellaneous Provisions) Ordinance and/or does not breach the restrictions on offers of investments under Part IV of the SFO.

The SFC’s prior written approval is required for the admission of any virtual asset for trading by retail clients and the suspension of trading or removal of any such virtual asset.¹⁷

If a licensed platform operator wants to make available for retail trading a virtual asset that fulfils the general token admission criteria but not the specific token admission criteria, it can make a submission to the SFC which will be considered on a case-by-case basis.¹⁸

Admissibility of Stablecoins for Retail Trading

The SFC stated in the Consultation Conclusions that stablecoins should not be admitted for retail trading until they are regulated in Hong Kong. The Hong Kong Monetary Authority has proposed a new regulatory regime for various activities relating to stablecoins in its January 2023 Conclusion of its Discussion Paper on Crypto-assets and Stablecoins. For details of the proposed regulatory regime, please see Charltons’ newsletter “HKMA to Adopt Licensing Regime for Stablecoins in 2023/24”.

Other Token Due Diligence to be Performed

Before admitting virtual assets for trading, licensed platform operators must:

• (i) ensure that their internal controls, systems, technology and infrastructure (e.g. their anti-money laundering monitoring and market surveillance tools) are able to support and manage any risks specific to the virtual assets to be made available for trading on their platforms;¹⁹ and
• (ii) appoint an independent assessor to conduct a smart contract audit for virtual assets based on smart contracts, unless the platform operator can demonstrate that it would be reasonable to rely on a smart contract audit already conducted by an independent assessor engaged by a third party. The purpose of the audit is to check that smart contracts are not subject to any contract vulnerabilities or security flaws.²⁰

4. Hong Kong Licensed Virtual Asset Trading Platform Operator Disclosure Obligations

As part of their disclosure obligations, Hong Kong licensed VA trading platform operators are required to provide clients with adequate product information to enable them to evaluate their investments.²¹ This information must be made available on the platform operator’s website and include: (i) the price and trading volume of virtual assets on the platform, for example, in the last 24 hours and since their admission for trading on the platform; (ii) information about the management or development team of the virtual assets; (iii) the issuance date; (iv) the material terms and features of the virtual assets; (v) the platform operator’s affiliation with the issuer, management or development team of any virtual asset; (vi) links to the virtual assets’ official websites and Whitepapers (if any); (vii) links to the smart contract audit reports and other bug reports of the virtual assets (if any); and (vii) where the virtual assets have voting rights, how these voting rights will be handled by the platform operator.²²

Platform operators must take all reasonable steps to ensure that any product-specific materials and other materials posted on the platform do not contain false, biased, misleading or deceptive information.²³ Moreover, upon request, platform operators must disclose their financial condition to clients by providing a copy of their latest audited balance sheet and profit and loss account required to be filed with the SFC. If there have been any material changes that adversely affect their financial condition after the date of the accounts, these changes must also be disclosed to the clients.²⁴

Platform operators dealing with retail clients must provide prominent disclosure of the nature of virtual assets and the risks of trading them, including the risk disclosure statements set out in Schedule 2 to the VATP Guidelines.²⁵

5. Virtual Asset Trading Platform Operator Obligations re. Handling Client Virtual Assets

A licensed virtual asset trading platform operator can only hold client assets (i.e. client virtual assets and client money) through an associated entity,²⁶ i.e. a Hong Kong-incorporated subsidiary of the virtual asset trading platform operator which is a licensed trust or service company provider under the AMLO and has notified the SFC that it is an associated entity of the licensed virtual asset trading platform operator under section 53ZRW of the AMLO and/or section 165 of the SFO. Client virtual assets must be held in wallet address(es) established by the platform operator’s associated entity and must be segregated from the assets of the platform operator and its associated entity.²⁷ At least 98% of client virtual assets must be held in cold storage²⁸ which is less vulnerable to hacking and other cybersecurity risks, except in limited circumstances allowed by the SFC on a case-by-case basis to minimise losses resulting from the platform being hacked or compromised.

Licensed trading platform operators must have robust internal controls and governance procedures to ensure that cryptographic seeds and private keys are securely generated, stored and backed up. They must also ensure that their associated entities implement the same controls and procedures which must (among others) restrict access to seeds and private keys for client virtual assets to authorised personnel who have been appropriately screened and trained and provided for seeds and private keys to be securely stored in Hong Kong.²⁹

B. Insurance or Compensation Arrangements

Licensed virtual asset trading platform operators must establish a compensation arrangement that is approved by the SFC to cover potential losses (arising from, among others, hacking incidents on the platform or default on the part of the licensed platform operator or its associated entity) of 50% of client virtual assets held in cold storage and 100% of client virtual assets held in hot and other storages. The compensation arrangement can include any or a combination of:

• third-party insurance;
• funds (held in the form of a demand deposit or time deposit maturing within six months) of the platform operator or any of its group of companies which are set aside on trust and designated for that purpose; and
• a bank guarantee provided by a Hong Kong authorised financial institution.³⁰

Licensed platform operators are required to monitor the total value of client virtual assets under their custody daily. If a licensed platform operator becomes aware that the total value of client virtual assets under custody exceeds the amount covered under the approved compensation arrangement, and it expects this to continue, it must inform the SFC and take prompt remedial action to re-comply with the VATP Guidelines.³¹

Platform operators need to use verifiable and quantifiable criteria when selecting an insurance company. These include a valuation schedule of assets insured, maximum coverage per incident and overall maximum coverage, as well as any excluding factors.

C. Trading in Virtual Asset Derivatives

Under the SFO regime, Hong Kong licensed VA trading platform operators are not allowed to offer, trade or deal in virtual asset futures contracts or related derivatives. However, the SFC acknowledges that there has been increasing interest in virtual asset derivative products, particularly among institutional investors, including for hedging of risks. The SFC’s Consultation Paper therefore sought views on the business models parties would adopt, the types of virtual asset derivatives they would want to offer, and the types of investors they would want to target.

Respondents to the Consultation Paper were generally supportive of allowing licensed virtual asset trading platforms to offer trading in virtual asset derivatives. Business models suggested included an order-matching engine or over-the-counter trading using leverage and with clients providing margin or premium (with client positions subject to automatic terminations). Interest was expressed in trading simple delivery futures, margined perpetual futures contracts, options with settlement dates and other structured products. Some suggested starting with products having major virtual assets (e.g. Bitcoin and Ether) as the underlying assets. The majority of respondents favoured restricting trading in virtual asset derivatives to professional investors. Given institutional interest in virtual asset derivative products, the SFC proposes to carry out a separate review of allowing their trading in due course.

Other Restrictions on Licensed Virtual Asset Trading Platforms

Some of the key restrictions on licensed virtual asset trading platform operators are that:

• they and their group companies are prohibited from providing any financial accommodation for clients to acquire virtual assets;³²
• they cannot provide trading in virtual asset futures contracts or related derivatives;³³
• they cannot enter into arrangements with their clients to use clients’ virtual assets to generate returns.³⁴ This prevents licensed trading platform operators from providing services such as earning, deposit-taking, lending and borrowing;³⁵
• they cannot offer clients any gift (other than a discount to fees or charges) for trading a specific virtual asset;³⁶
• they cannot post adverts for a specific virtual asset;³⁷
• they cannot provide algorithmic trading services to clients;³⁸
• they cannot engage in proprietary trading for their own account or any account in which they have an interest, except for off-platform back-to-back transactions where no market risk is taken by the platform operator;³⁹
• they cannot engage in market making activities on a proprietary basis;⁴⁰ and
• the group companies of licensed virtual asset trading platform operators are prohibited from conducting proprietary trading in virtual assets through the platform operator on or off-platform.⁴¹

D. Other Adaptations to Existing Requirements Incorporated into the VATP Guidelines

The following changes have been made to the requirements of the Terms and Conditions for Virtual Asset Trading Platform Operations (currently imposed on SFO-licensed platform operators) now incorporated into the VATP Guidelines:

• the requirement for security tokens to be: (i) asset-backed; (ii) approved or registered for trading in comparable jurisdictions; and (iii) have a 12-month post-issuance track record, have not been incorporated;
• platform operators are no longer required to provide a written legal opinion or memorandum on the regulatory status of virtual assets even where they are made available to retail clients. However, platform operators must ensure that retail trading of virtual assets does not breach the public offering regimes under the Companies (Winding Up and Miscellaneous Provisions) Ordinance or Part IV of the SFO. The SFC also notes in the Consultation Conclusions that it may ask for legal opinions on specific tokens as part of its approval process;⁴²
• platform operators are only required to disclose how they will handle voting rights rather than require their facilitation of such exercise;
• exceptions to the prohibition on proprietary trading allow platform operators to conduct back-to-back transactions off-platform or in prescribed circumstances approved by the SFC; and
• where virtual assets are made available to professional investors only, licensed platform operators only need to notify the SFC in advance of any plans to add, suspend or remove such products from their trading platform.⁴³ However, where virtual assets are made available to retail clients, platform operators must obtain the SFC’s approval before admitting them for trading, or suspending trading in, or removing, them.⁴⁴

Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations and SFC-licensed Virtual Asset Service Providers)

SFC-licensed virtual asset trading platform operators must comply with virtual asset-specific AML/CFT requirements set out in new Chapter 12 of the renamed Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations and SFC-licensed Virtual Asset Service Providers) in addition to the guideline’s general AML/CFT requirements applicable to SFC-licensed entities. The revised and renamed Prevention of Money Laundering and Terrorist Financing Guideline issued by the Securities and Futures Commission for Associated Entities of Licensed Corporations and SFC-licensed Virtual Asset Service Providers requires associated entities of SFC-licensed virtual asset trading platform operators to comply with the Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations and SFC-licensed Virtual Asset Service Providers).

Application of the Travel Rule to Virtual Asset Transfers

Financial institutions, which are defined in the AMLO to include virtual asset trading platform operators licensed under the AMLO and/or the SFO, must comply with Section 13A of Schedule 2 to the AMLO which applies the requirements for wire transfers under FATF Recommendation 16 (the Travel Rule) to transfers of virtual assets. Chapter 12 of the Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations and SFC-licensed Virtual Asset Service Providers) sets out detailed guidance on the statutory obligation. This requires that:

• when acting as an ordering institution of virtual asset transfers, a licensed platform operator must obtain, record and submit the required information of the originator and recipient to the beneficiary institution immediately and securely;⁴⁵
• when acting as a beneficiary institution, a licensed platform operator must obtain and record the required information submitted by the ordering institution or intermediary institution;⁴⁶ and
• a licensed platform operator must conduct due diligence on a virtual asset transfer counterparty (i.e. the ordering institution, intermediary institution or beneficiary institution involved in a virtual asset transfer) to identify and assess the associated ML/ TF risks so as to apply risk-based AML/CFT measures.⁴⁷

Chapter 12 also sets out requirements relating to identifying suspicious transactions and conducting sanctions screening of all relevant parties involved in a virtual asset transfer.⁴⁸

The travel rule requirements for virtual asset transfers take effect on 1 June 2023. However, the obligation on ordering institutions to submit the required information to the beneficiary institution immediately (meaning before or when the virtual asset transfer is conducted)⁴⁹ will be delayed until 1 January 2024. In the interim, the SFC will allow ordering institutions to submit the required information to the beneficiary institution as soon as practicable after the virtual asset transfer, although they must comply with all other travel rule requirements from 1 June 2023, including the requirement to submit the required information securely.

Disciplinary Fining Guidelines

Virtual asset trading platform operators licensed under the AMLO may be disciplined by the SFC under section 53ZSP of the AMLO, while those licensed or registered under the SFO can be disciplined under section 194 or 196, respectively, of the SFO. In each case, the SFC can impose various sanctions on regulated persons who are guilty of “misconduct” or considered not fit and proper. Misconduct is defined to include contravention of any provision of the relevant ordinance or any licence condition and an act or omission relating to the provision of VA services which is, or is likely to be, prejudicial to the interests of the investing public or to the public interest.⁵⁰ The maximum fine that the SFC can impose is HK$10 million or three times the profit gained or loss avoided as a result of the misconduct or conduct that led to the SFC considering the person to be not fit and proper.⁵¹

The Disciplinary Fining Guidelines (for regulated persons under Part 5B of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance) set out the various factors the SFC will take into account (such as whether the act was reckless, intentional or negligent) in determining appropriate fines in the case of entities and individuals regulated under the AMLO. The fining criteria for entities and individuals licensed or registered under the SFO are substantially the same and are set out in the SFC Disciplinary Fining Guidelines (for regulated persons under the Securities and Futures Ordinance).

Transitional Arrangements under the AMLO Licensing Regime for Virtual Asset Trading Platform Operators

The AMLO licensing regime for virtual asset trading platform operators trading non-security tokens takes effect on 1 June 2023. From 1 June 2023, any unlicensed virtual asset trading platform trading non-security tokens and carrying on business in Hong Kong or actively marketing its services to Hong Kong investors will breach the licensing requirements under the AMLO licensing regime, unless the transitional arrangements below apply.

Under the transitional arrangements, virtual asset trading platforms trading non-security tokens which were operating in Hong Kong before 1 June 2023 and have a meaningful and substantial presence can continue to operate in Hong Kong without a licence until 31 May 2024. When considering whether a VA trading platform has a “meaningful and substantial presence in Hong Kong”, the SFC will consider, among others, whether:

• it is incorporated in Hong Kong;
• it has a physical office in Hong Kong;
• central management, control over the platform and key personnel are based in Hong Kong; and
• the trading platform is live with a considerable number of clients and volume of trading activities in Hong Kong.

Operators of pre-existing trading platforms which apply online for a licence under the AMLO between 1 June 2023 and 29 February 2024 will automatically be deemed to be licensed from 1 June 2024 until their licence application is approved, withdrawn or refused. When submitting a licensing application, pre-existing virtual asset trading platform operators need to confirm and demonstrate that:

• they operated a virtual asset trading platform in Hong Kong immediately before 1 June 2023; and
• on being deemed to be licensed, they will comply with, and have arrangements in place to ensure compliance with, the regulatory requirements applicable to licensed platform operators.

If the SFC finds that a licence applicant does not meet the necessary conditions or does not have a reasonable prospect of showing that it is capable of complying with the relevant legal and regulatory requirements, it will notify the trading platform that the deeming provision will not apply to it. The virtual asset trading platform must then close down its business by 31 May 2024 or within three months of the date of the SFC notice, whichever is the later.

Similar provisions apply to individuals performing regulated functions for a virtual asset trading platform operating in Hong Kong before 1 June 2023. They can continue to perform regulated functions without a licence and will be subject to a deeming arrangement from 1 June 2024. To be eligible for the deeming arrangement, individuals applying to be responsible officers of a pre-existing VA trading platform must have been performing the relevant regulated function for a VA trading platform (whether operating in or outside Hong Kong) immediately before 1 June 2023 and, at the time of application, must be performing a regulated function in Hong Kong for the pre-existing VA trading platform.

To be eligible for the deeming arrangement, licensed representatives of a pre-existing VA trading platform must be performing a relevant regulated function in Hong Kong at the time of application.

Once platforms and individuals are deemed to be licensed or approved as responsible officers, they must comply with all legal and regulatory requirements under the AMLO regime for licensed virtual asset trading platforms.

The transitional arrangements under the AMLO licensing regime apply only to the trading of non-security tokens by virtual asset trading platforms. There are no transitional arrangements under the SFO. Virtual asset trading platforms intending to offer trading in security tokens need to be separately licensed under the SFO for Type 1 (dealing in securities) and Type 7 (providing automated trading services) regulated activities.

Pre-existing Virtual Asset Trading Platforms Not Intending to Apply for a Licence

If pre-existing VA trading platforms do not intend to apply for a licence, they must close down their businesses in Hong Kong by 31 May 2024 at the latest. The SFC expects these VA trading platforms to stop active marketing of their services to Hong Kong investors and to start shutting down their Hong Kong operations

Virtual Asset Trading Platforms Not Operating in Hong Kong before 1 June 2023

Virtual Asset trading platforms that did not operate in Hong Kong before 1 June 2023 cannot carry on business in Hong Kong, or actively market their services to Hong Kong investors, until they are formally licensed under the AMLO.

Transitional Arrangements for Existing SFO-licensed Platform Operators

Virtual asset trading platform operators already licensed under the SFO have 12 months from 1 June 2023 to comply with the VATP Guidelines and the Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations and SFC-licensed Virtual Asset Service Providers).

SFC to Issue Further Information on Transitional Arrangements

The SFC will issue a circular on the transitional arrangements given the number of enquiries it received on this subject.

Publication of Hong Kong Virtual Asset Trading Platform Lists

To avoid confusion in relation to Hong Kong VA trading platform status, the SFC will publish lists on its website to inform the public of the regulatory status of Hong Kong VA trading platforms. The SFC will publish lists of Hong Kong licensed virtual asset trading platforms, deemed Hong Kong licensed virtual asset trading platforms, closing-down VA trading platforms and unlicensed “illegal” virtual asset trading platforms.

Licensing Applications

Given that virtual assets classification may change from non-security tokens to security tokens or vice versa, the SFC encourages VA trading platforms, their responsible officers and licensed representatives to apply for licences under both the existing SFO regime and the new AMLO regime.

The SFC has streamlined the application process so that:

• applicants for dual licensing can submit a single consolidated application online and should indicate that they are applying for both licences simultaneously; and
• SFO-licensed platform operators which currently provide trading in non-security tokens and platforms that have already applied for licences under the SFO regime, only need to submit the additional information required under the AMLO regime.

As regards responsible officers, a single individual can be approved under both the SFO and AMLO regimes meaning that dual-licensed trading platform operators only need two approved responsible officers, not four.⁵²

External Assessment Reports

The SFC requires virtual asset trading platform applicants to engage an external assessor to assess their business and submit two assessor’s reports to the SFC. Different external assessors can be appointed to review different areas of an applicant’s business.

The external assessor’s “Phase 1 Report” needs to be submitted with the trading platform’s licence application. It will cover several areas including the design effectiveness of the VA trading platform’s proposed structure, governance, operations, systems and controls, with a focus on key areas such as governance and staffing, token admission, custody of virtual assets, KYC, AML/CFT, market surveillance, risk management and cybersecurity.

The external assessor’s “Phase 2 Report” is required to be submitted after approval-in-principle of the licence is granted by the SFC. This will assess the effectiveness and implementation of the actual adoption of the planned policies, procedures, systems and controls. Any deviation from the planned policies and procedures must be clearly set out and explained. The second assessment should cover several key areas, including:

• verification and confirmation that all external service providers (such as market surveillance tools, AML/CTF tools, and KYC tools) have been engaged and the systems provided by them are fully adapted as planned and are in operation;
• the conduct of a vulnerability assessment to identify, rank and report potential vulnerabilities that may compromise a system and should include internal and external vulnerability scans;
• the performance of penetration tests on network devices, firewalls, servers, databases, wallets, and web applications to identify any vulnerabilities or potential issues; and
• confirmation that major/critical rectification steps have been taken for all medium to high risk items identified in the penetration and vulnerability tests.

The SFC will grant final approval only upon being satisfied with the findings of the Phase 2 Report.

Selection and Appointment of External Assessors

When selecting and appointing an external assessor to produce the required reports:

• the VA trading platform operator applicant should exercise due skill, care and diligence and should consider its expertise, experience and track record in reviewing the areas concerned;
• the VA trading platform operator could engage separate external assessors to review different areas of the business, depending on their expertise, experience and track records;
• the external assessor should be independent of the applicant, its group or group companies;
• the service provider of a particular system should not act as the external assessor for the same system; and
• the external assessor’s capability statement should be submitted to the SFC together with the external assessment report.