SFC Circular on Implementing New Licensing Regime for Virtual Asset Trading Platform Operators

Hong Kong’s Securities and Futures Commission (the SFC) has issued a Circular on the implementation of its new licensing regime for centralised virtual asset trading platform operators which came into effect on 1 June 2023 following publication of the SFC’s Consultation Conclusions on the Proposed Regulatory Requirements for Virtual Asset Trading Platform Operators Licensed by the Securities and Futures Commission. With the implementation of the new licensing regime, all centralised virtual asset trading platforms operated in Hong Kong, or actively marketing their services to the Hong Kong public, must be licensed by the SFC:

• as a Virtual Asset Service Provider (VASP) under the new VASP licensing regime under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (the AMLO) if they provide trading in virtual assets that are not securities (as defined in section 1 of Part 1 of Schedule 1 to the Securities and Futures Ordinance (the SFO) (non-security tokens); and/or
• for regulated activities Type 1 (dealing in securities) and Type 7 (providing automated trading services) under the SFO if they offer trading in virtual assets that are securities (security tokens).

The SFC is recommending that virtual asset trading platform operators and staff conducting regulated activities should obtain licences under both Ordinances given the possibility of virtual assets’ classification changing from non-security tokens to security tokens and vice versa.

The VASP licensing regime requires the licensing of centralised VA trading platforms that provide virtual asset trading services to clients using an automated trading engine which matches client orders and also provide custody services as an ancillary service to their trading services. Accordingly, the provision of virtual asset services without an automated trading engine and ancillary custody services (for instance, over-the-counter virtual asset trading activities and virtual asset brokerage activities) does not require a licence.¹

A 12-month transitional period applies under the AMLO to virtual asset trading platforms that operated in Hong Kong immediately before 1 June 2023 which:

• allows them to trade without a VASP licence until 31 May 2024;
• will deem them to be licensed from 1 June 2024 until the approval, withdrawal or refusal of their VASP licence application which must be submitted on or before 29 February 2024.

The transitional arrangements apply only to the AMLO VASP licensing requirement and not to the requirement to be licensed under the SFO. For further information about the transitional arrangements, please see the SFC’s Circular on transitional arrangements of the new licensing regime for virtual asset trading platform operators.

Hong Kong Regulatory Requirements for Virtual Asset Trading Platform Operators

Virtual asset trading platform operators licensed under both the AMLO and the SFO will need to comply with the regulatory requirements under the SFO and its subsidiary legislation, the AMLO and the codes, guidelines, circulars and frequently asked questions (FAQs) published by the SFC which include:

• the SFC Guidelines for Virtual Asset Trading Platform Operators (VATP Guidelines):
• the SFC Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations and SFC-licensed Virtual Asset Service Providers);
• the Prevention of Money Laundering and Terrorist Financing Guideline issued by the Securities and Futures Commission for Associated Entities of Licensed Corporations and SFC-licensed Virtual Asset Service Providers;
• the SFC’s FAQs on licensing matters; and
• the SFC’s FAQs on conduct-related matters.

For further details of the regulatory requirements for virtual asset trading platform operators, please see Charltons’ newsletters Hong Kong Licensing Regime for Virtual Asset Exchanges to Take Effect on 1 March 2023 and Hong Kong SFC Finalises Regulation of Virtual Asset Trading Platforms.

SFC Guidance Materials for Virtual Asset Trading Platform Operators

The SFC’s latest VATP Circular refers to various documents issued by the SFC to assist licence applicants and provide guidance on the regulatory requirements and ongoing reporting and notification obligations including:

• an SFC Handbook for Virtual Asset Trading Platform Operators (VATP Licensing Handbook) setting out the licensing application process and ongoing obligations of virtual asset trading platform operators after obtaining a licence;
• SFC FAQs on licensing matters; and
• SFC FAQs on conduct-related matters.

Key Points from the VATP Licensing Handbook and FAQs

Conducting VA business outside Hong Kong

A licence obtained under the SFO and/or the AMLO only permits the holder to carry on the business of operating a virtual asset exchange in Hong Kong. VA trading platforms operating outside Hong Kong need to comply with the legal and regulatory requirements of the relevant jurisdiction(s).

Active Marketing of Virtual Asset Services from outside Hong Kong

It is an offence under section 115 of the SFO and section 53ZRB of the AMLO for a person to actively market, whether in Hong Kong or from a place outside Hong Kong, to the Hong Kong public any service which would be a regulated activity under the SFO or a VA Service under the AMLO if provided in Hong Kong, unless that person is licensed by the SFC. The SFC has issued an FAQ on the meaning of “actively markets” stating that:

• active marketing may include, for example, those who frequently call on Hong Kong investors and market their services (including offering products); running a mass media programme targeting the investing public in Hong Kong; and Internet activities that target Hong Kong investors; and
• in assessing whether services are actively marketed to the public, the SFC will consider (among others):
  • whether there is a detailed plan to promote the services;
  • whether the services are extensively advertised via marketing means such as direct mailing, advertisements in local newspapers, broadcasting or other ”push” technology over the Internet;
  • whether the related marketing is conducted in a concerted manner and executed in accordance with a plan or a schedule; and
  • whether the services are packaged to target the public of Hong Kong, e.g. written in Chinese and denominated in Hong Kong dollars.

It is worth noting that the SFC has not taken this opportunity to broaden this interpretation of “active marketing” which was previously set out in its FAQ on the meaning of the term in the context of section 115 of the SFO. This is somewhat surprising given that the SFC argued in Ng Chiu Mui v the SFC² that:

“the term ‘actively markets’ when taken in conjunction with the SFC explanatory material, must be taken to mean no more than marketing in the primary sense of pro-actively advertising the service to the Hong Kong public”.

Also worth noting, perhaps, is Lord Justice Stone’s comment “nor do I consider either that the footnoted commentary in the consultative paper presented to the Bills Committee nor the content of the SFC website to represent any more than straws in the interpretative wind”.

SFC Regulatory Sandbox

The SFC Regulatory Sandbox was launched in 2017 to provide a confined regulatory environment for firms conducting regulated activities using Fintech.

According to the VATP Licensing Handbook and SFC FAQs on the SFC Regulatory Sandbox, on becoming licensed, virtual asset trading platform operators will enter the SFC Regulatory Sandbox to allow the SFC to assess and monitor their delivery of services and internal controls systems. The SFC expects this to facilitate dialogue between the SFC and virtual asset platform operators enabling platform operators to identify and address any risks arising from their activities.

Managers-In-Charge of Core Functions (MICs)

The SFC has introduced a Managers-In-Charge of Core Functions regime for licensed virtual asset trading platform operators (details of which are set out in the SFC’s FAQs on Measures for Augmenting Senior Management Accountability in Platform Operators) which is based on the MICs regime applicable to other SFC-licensed entities. Licensed VA trading platform operators need to appoint one or more MICs as individuals principally responsible, either alone or with others, for managing each of the Platform Operator’s “Core Functions” which are:

• Overall Management Oversight – responsible for the day-to-day direction and oversight of the effective management of the platform operator’s overall operations (e.g. Chief Executive Officer or President). The main responsibilities include:
  • developing the platform operator’s business model, objectives, strategies, organisational structure, controls and policies;
  • developing and promoting sound corporate governance practices, culture and ethics; and
  • executing and monitoring implementation of board-approved business objectives, strategies and plans, and the effectiveness of the organisational structure and controls.
• Key Business Line – directing and overseeing a line of business comprising one or more types of SFO-regulated activity and/or a VA Service under the AMLO (e.g. Head of Automated Trading Services, Head of Brokerage Services or Head of Sales);
• Operational Control and Review – responsible for:
  • the establishment and maintenance of adequate and effective systems of controls over the platform’s operations; and
  • reviewing the platform operator’s compliance with, and the adequacy and effectiveness of, its internal control systems (e.g. Chief Operating Officer, Head of Operations, Head of Internal Audit);
• Risk Management – responsible for identifying, assessing, monitoring and reporting of risks arising from the platform operator’s operations (e.g. Chief Risk Officer, Head of Risk Management);
• Finance and Accounting – responsible for ensuring timely and accurate financial reporting and analyses of the platform operator’s operational results and financial positions (e.g. Chief Finance Officer, Financial Controller or Finance Director);
• Information Technology – responsible for the design, development, operation and maintenance of the platform operator’s computer systems (e.g. Chief Information Officer or Head of Information Technology);
• Compliance (e.g. Chief Compliance Officer or Head of Legal and Compliance) – responsible for:
  • setting the policies and procedures for adherence to legal and regulatory requirements in the jurisdiction(s) where the platform operator operates;
  • monitoring the platform operator’s compliance with the established policies and procedures; and
  • reporting on compliance matters to the board and senior management
• Anti-Money Laundering and Counter-Terrorist Financing – responsible for establishing and maintaining internal control procedures to safeguard the platform operator against involvement in money laundering or terrorist financing (e.g. Head of Financial Crime Prevention or Head of Compliance).

Recognising that VA platform operators will adopt different organisational and governance structures, the SFC will allow the appointment of one individual to act as the MIC for two or more Core Functions, or of two or more individuals to jointly manage a Core Function, if appropriate to the scale of the platform’s operations and controls.

MICs of the Overall Management Oversight and Key Business Line functions are generally required to be responsible officers of the activities they oversee. They can be located offshore provided they are accountable to the platform operator.

VASP Responsible Officers

Licence applicants must appoint at least two responsible officers who will be generally responsible for overseeing the operation of the licensed VASP and ensuring compliance with the AML/CFT and other regulatory requirements. VA trading platform operators dual-licensed under AMLO and the SFO only need to have two dual-licensed responsible officers (not four) in order to meet this requirement.³

The requirements for VASP responsible officers mirror those of responsible officers of other licensed corporations under the SFO and require that:

• at least one responsible officer must be an executive director of the VASP;
• if the VASP has more than one executive director, they must all be appointed as responsible officers;
• at least one responsible officer must be ordinarily resident in Hong Kong; and
• at least one responsible officer must be available at all times to supervise the business of the VA service.

Responsible officers must be “fit and proper”, the criteria for which include the person’s financial status/ solvency; their educational or other qualifications and experience; their competence, honesty and financial integrity; lack of convictions for money laundering or terrorist financing offences or other offences involving fraudulent, corrupt or dishonest conduct; and compliance with the AML/CFT obligations and other obligations of licensed VASPs. In practice, the SFC’s questions can extend to the source of funds of shareholders (including ultimate owners) and could involve extensive evidence being provided, particularly if funds originated in or are derived from non-FATF jurisdictions.

The specific competence criteria for responsible officers are summarised below:⁴

In relation to the industry experience requirement under paragraph 3.16 of the VATP Guidelines, where an individual applies for dual licensing under the AMLO and SFO:

• for responsible officer applicants who only have experience of dealing in non-security tokens

  That experience will count as industry experience relevant to Type 1 (dealing in securities) regulated activity, although a condition will be imposed on the responsible officer’s licence restricting the individual to providing Type 1 services only for an SFC- licensed VA trading platform operator.

• for responsible officer applicants who only have experience in Type 1 (dealing in securities) regulated activity

  That experience will count as industry experience relevant to the provision of a VA Service under the AMLO. However, the responsible officer’s licence will be subject to a “non-sole” condition.⁶

The above pragmatic approach is intended as a temporary measure and is subject to review by the SFC.

Overseas Residents

The SFC will impose a non-sole condition on the licence of responsible officers based offshore who occasionally visit Hong Kong to conduct regulated activities. Itinerant professionals who only spend short periods in Hong Kong from time to time cannot be responsible officers due to responsible officers’ obligation to supervise the business of the relevant regulated activity in Hong Kong.

Submission of Platform Operators’ Bank Account Information

VA trading platform operators need to submit their bank account details to the SFC before their licensing application is approved. They are also required to notify the SFC of their financial year-end within one month of becoming licensed.

Further Guidance for Licensed Representatives

The SFC requires applicants to become licensed representatives before they apply for approval as a responsible officer. In practice, these applications can be submitted simultaneously.

Licensed representatives can only act for the platform operator to which they are accredited for conducting regulated activities. If a licensed representative ceases to act for their principal, the principal must notify the SFC through WINGS-LIC within 7 business days. The licensed representative can then apply for a transfer of accreditation to another platform operator within 180 days. If a licensed representative has previously received a regulatory warning, this must be disclosed in the application form.

Licensed representatives with a conviction which was later spent, dismissed, or expunged who wish to keep the conviction confidential, can select “No” in relevant sections of the application form. However, the Rehabilitation of Offenders Ordinance protection does not extend to proceedings in relation to a person’s suitability for a licence. Applicants must separately provide the SFC with details of the offence and conviction within two business days of the date the licensing application is submitted.

Guidance for Substantial Shareholders

The substantial shareholders and ultimate owners of a licensed VASP are required to be fit and proper.⁷ The SFC allows certain substantial shareholders without a “close link” with a platform operator to provide less information in the application form. The SFC will generally consider a “close link” to be absent if the substantial shareholder:

• alone, does not have a direct or indirect interest in the corporate licence applicant as described in section 6 of Part 1 of Schedule 1 to the SFO, i.e. does not:
  • hold more than 10% of the corporate licence applicant’s issued shares entitling the person (alone or with their associates) to control more than 10% of the votes in general meetings; or
  • hold shares in any other corporation entitling the person (alone or with their associates) to control 35% or more of the votes in general meetings of that other corporation, or of a further corporation which can control (alone or with its associates) more than 10% of the votes in general meetings of the corporation.
• together with any of its associates, has a direct or indirect interest in the corporate licence applicant as described in section 6 of Part 1 of Schedule 1 to the SFO;
• is and will be controlled or influenced by other existing or potential substantial shareholder(s); and
• does not and will not have any involvement in the management and operation of the corporate licence applicant.

The ultimate owner of a corporate licence applicant is an individual who: (i) controls, directly or indirectly, more than 25% of the corporation’s issued share capital or more than 25% of the voting rights at general meetings of the corporation; or (ii) exercises ultimate control over the corporation’s management.

Virtual Asset Trading Platform Operators: Licensing Conditions

The licences of VA trading platform operators will be subject to a number of conditions including requirements that a platform operator:

• must comply with the VATP Guidelines;
• must immediately notify the SFC and cease operating a virtual asset trading platform if it becomes aware that it cannot maintain, or ascertain whether it maintains:
  • liquid capital of the higher of HK$3 million and the basic amount as defined in section 2 of the Securities and Futures (Financial Resources) Rules; and
  • paid-up share capital of HK$5 million;
• must provide the SFC with monthly reports on its business activities within two weeks of the end of each calendar month and any other information requested by the SFC;
• must engage an independent professional firm acceptable to the SFC to conduct an annual review of its activities and operations, and prepare a report confirming that it has complied with the licensing conditions and all relevant legal and regulatory requirements. The first report must be submitted within 18 months of the approval of the platform operator’s licence. Subsequent reports are required to be submitted within four months of the end of each financial year and upon request by the SFC;
• must obtain the SFC’s written approval before introducing or offering a new or incidental service or activity or making a material change to an existing service or activity (including long suspension or termination of an existing service or activity); and
• is restricted to operating a centralised online virtual asset trading platform for trading of virtual assets on its platform and carrying on: (i) off-platform virtual asset trading business and incidental services provided by it to its clients; and (ii) activities conducted in relation to that off-platform business.

Licensed Virtual Asset Trading Platform Operators’ Reporting & Notification Obligations

Corporate and individual licence applicants should submit their application forms, supplements and questionnaires to the SFC through WINGS-LIC. This portal is also designated for the submission of notifications, regulatory filings and annual returns. For more information, see the WINGS website.

Financial returns and other documents should be submitted using the following electronic forms available on the SFC’s website:

• Financial Returns
• Audit Questionnaire
• Business and Risk Management Questionnaire for Licensed Corporation
• Business and Risk Management Questionnaire for Associated Entity
• Analysis of Client Assets for Associated Entity

Changes to VASP Licences Requiring Prior SFC Approval

The SFC’s prior approval is required for the licence changes listed in the table below. Application for approval is generally made on Form VA2, except for approval of changes to the licensed entity’s substantial shareholders and ultimate owners for which Form VA4 should be used.

The SFC’s written approval is additionally required for including any virtual asset for trading by retail clients (i.e. clients who are not “professional investors” as defined in Schedule 1 to the SFO and the Securities and Futures (Professional Investor) Rules) and suspending trading of or removing any virtual asset available to retail clients.

Changes and Events Required to be Notified to the SFC

The various events of which notice must be given to the SFC are summarised below.

Notification of Material Breaches

The Guidelines for Virtual Asset Trading Platform Operators require VA trading platform operators and their associated entities to immediately notify the SFC of various matters, including:

• any material failure, error or defect in the operation or functioning of the platform operator’s or its associated entity’s trading, custody, accounting, clearing and settlement systems or equipment;
• any material breach or non-compliance, or suspected material breach or non-compliance, with the SFO, the AMLO, or any SFC rules, regulations, codes, circulars, FAQs or guidelines (including the VATP Guidelines) by the platform operator, its associated entity or any person appointed to conduct business with clients on their behalf. To accommodate this requirement, the SFC has upgraded its existing paragraph 12.5 notifications online portal to enable reports of incidents of material breach and non-compliance to be submitted to the SFC electronically;
• the passing of any resolution, the initiation of any proceedings, or making of any order which may result in the appointment of a receiver, provisional liquidator, liquidator or administrator or the winding-up, re-organisation, reconstruction, amalgamation, dissolution or bankruptcy of the platform operator or its associated entity or any of the platform operator’s substantial shareholders or ultimate owners, or the making of any receiving order or arrangement or composition with creditors;
• the bankruptcy of any director of the platform operator or its associated entity; and
• the exercise of any disciplinary measure against the platform operator or its associated entity by any regulatory or other professional or trade body or the refusal, suspension or revocation of any regulatory licence, consent or approval required in connection with the platform operator’s or its associated entity’s business.

Dedicated SFC Webpage and Email for Virtual Asset Activities

The SFC has launched a dedicated webpage providing access to the above information and documents, and all relevant regulatory requirements and guidance materials in relation to virtual asset activities regulated by the SFC.

Licence applicants should send any enquiries to vatp-licensing@sfc.hk.