October 13, 2022

New Regulatory Regime for Virtual Asset Service Providers in Hong Kong – Are You Ready?

Author:

Alan H. Linning

Introduction

Virtual assets and blockchain technology have the potential to radically change the way financial transactions and payments are effected, giving rise to money laundering and terrorist financing (ML/TF) risks. Accordingly, such risks have been the subject of the Financial Action Task Force's guidance and recommendations.

Hong Kong recently announced the framework of a new regulatory regime for virtual assets and associated products and services to combat ML/TF risks. This Legal Update provides an overview of the new regulatory regime for virtual asset service providers (VASPs), which is scheduled to take effect on 1 January 2023, and suggests steps on how to prepare for it.

In a previous Legal Update, we highlighted the publication of the Anti-Money Laundering and Counter-Terrorist Financing (Amendment) Bill 2022 (the Bill) on 24 June 2022 that introduced amendments to the Anti-Money Laundering and Counter Terrorist Financing Ordinance (Cap. 615) (AMLO).

The AMLO amendment introduced new regulatory regimes for VASPs and dealers of precious metals and stones in Hong Kong which are scheduled to come into effect on 1 January 2023, except for the following provisions which will be effective on 1 March 2023:¹

provisions relating to restrictions on carrying on activities involving VAs; and
the transition arrangement for pre-existing VASPs.

In summary, the VASP regulatory regime consists of new licensing and regulatory requirements for VASPs' operations. The Financial Services and the Treasury Bureau noted in the Legislative Council Brief on 22 June 2022 that the licensing requirements of the new VASP regime are highly specialised and technical. VASPs should therefore set aside time and resources to prepare the requisite licence applications.

Overview of the New Regulatory Regime for VASPs

The Bill defines a virtual asset (VA) as:

a cryptographically secured digital representation of value that is expressed as a unit of account or a store of economic value;
an asset that functions (or is intended to function) as a medium of exchange accepted by the public as payment for goods or services or for the discharge of a debt, or for investment purposes; and
can be transferred, stored or traded electronically.²

The Hong Kong Securities and Futures Commission (SFC) may, through a Gazette notice, prescribe any characteristics necessary for, or precludes, a digital representation of value to be a VA.³ In addition, the Secretary for Financial Services and the Treasury may, by notice published in the Gazette, prescribe any digital representation to be a VA, or not.⁴

a. Licensing Requirements

Any person who seeks to carry on a VA service business must obtain a VASP licence from the SFC, failing which an offence is committed.⁵ 'VA service' is defined as the operation of a VA exchange providing services through means of electronic facilities where:

offers to sell or purchase VAs are regularly made or accepted in a way that forms or results in a binding transaction; or
persons are regularly introduced or identified to other persons to allow them to negotiate or conclude sales or purchases of VAs in a way that forms or results in a binding transaction; and
where client money or client VAs come into direct or indirect possession of the person providing such services.⁶

The VASP licence will only be granted if the applicant passes the fit-and-proper person test.⁷ In addition, only locally incorporated companies with a permanent place of business in Hong Kong or companies incorporated elsewhere but registered in Hong Kong under the Companies Ordinance (Cap. 622) will be considered for a VASP licence.⁸

VA exchanges that are already regulated under the SFC’s existing opt-in regime will be exempted from the licensing requirements of the new regime.⁹ The existing opt-in regime was introduced by the SFC through the Position Paper on the Regulation of virtual asset trading platforms published on 6 November 2019, where VA trading platforms that wish to be regulated by the SFC may bring themselves within the regulator’s ambit by offering at least one “security”¹⁰ virtual asset or token for trading.¹¹

In addition, two classes of designated personnel of a VASP are subject to licensing requirements under the new regime: responsible officers and licensed representatives.¹² To date, the designated personnel's qualification requirements have not been published. However, existing VA operators may rely on the Bill's transition arrangements (discussed below) to carry on operations.

b. Regulatory Requirements

Full details of the regulatory requirements for VASPs have yet to be announced. The Legislative Council Brief dated 22 June 2022 stated that the SFC, as the relevant authority of licensed VASPs according to the Bill, will exercise its power under section 7 of the AMLO to impose additional regulatory requirements upon VASP licensees. At present, the known regulatory requirements are that the licensee should have adequate financial resources, knowledge and experience, and have in place policies and procedures on risk management, financial reporting and disclosure, and conflicts of interest.¹³ Detailed requirements will be provided in codes and guidelines to be published by the SFC, subject to consultation, prior to the commencement of the new regime.¹⁴

Importantly, the Bill states that VASP licensees can only provide services to professional investors at the initial stage.¹⁵

The SFC, as the relevant authority under the new VASP regime, is vested with supervisory powers to enforce AML/CTF and other regulatory requirements. This includes the power to investigate and impose disciplinary sanctions on VASP licensees.¹⁶ The SFC will also have intervention powers to impose prohibitions and requirements on the operations of a licensed VASP.¹⁷

c. AML/CTF Requirements for VASPs

The definition of 'financial institution' in Schedule 1 of the AMLO will be amended to cover a licensed VASP.¹⁸ Licensed VASPs will be subject to all AML/CTF requirements in AMLO that apply to regulated financial institutions, unless provided otherwise. This includes customer due diligence and record-keeping requirements.

The definition of 'pre-existing customer' in Schedule 2 to AMLO has been amended to cater for licensed VASPs to mean a customer with whom the licensed VASP has established a business relationship before 1 March 2023. In addition, the Bill contains new provisions relating to the disciplinary and intervention powers of the SFC with respect to VASPs.

d. Transitional Arrangements for Pre-existing Operators of VA Exchanges

Schedule 3G of the Bill sets out the transitional arrangements for pre-existing operators of VA exchanges. If a pre-existing operator files an application with the SFC within the first nine months after the commencement of the new regime and confirms that it will comply with the regulatory requirements set by the SFC, the operator would be deemed to be licensed until the SFC has made a decision on its licence application.¹⁹ The Bill sets out similar transitional arrangements for responsible officers and licensed representatives of pre-existing operators.²⁰

e. Next Steps for VASPs

As the industry is still waiting for further details of the regulatory requirements for VASPs, there is a limit to the extent of preparation work that VASPs can undertake in the interim. Potential VASP licence applicants may wish to consider taking the following recommended next steps in the lead up to 1 January 2023:

Review the definition of 'VA service' and consider whether a VASP licence is required for business operations in Hong Kong.
If a VASP licence is required, consider whether corporate structure changes are required to ensure that the applicant for the VASP licence is incorporated or registered in Hong Kong.
Prepare the preliminary information and paperwork required for the SFC licensing applications of the individuals who will fulfil the roles of responsible officer(s) and licensed representative(s) of the VASP licensee.
Prepare draft internal policies and procedures to address:
- the AML/CTF requirements in AMLO, taking the cue from AML/CTF requirements that apply to traditional financial institutions;
- risk management issues;
- financial reporting and disclosure; and
- conflicts of interest.
Watch out for consultations, guidelines and other related guidance from the SFC on the regulatory regime for VASPs and update the intended VASP licensee's internal policies accordingly.

VA-related Sanctions Risks

A growing number of companies and financial institutions have embraced virtual currencies, a common form of VA, by creating offerings for their customers to trade cryptocurrencies, allowing customers to purchase cryptocurrencies through their bank accounts, or investing in cryptocurrency exchanges. Whilst sanctions are not expressly covered by the Bill, It is important for potential VASP licensees to consider the sanctions risks arising from VA services as well.

The key sanctions legislation in Hong Kong are the United Nations (Anti-Terrorism Measures) Ordinance (Cap. 575) (UNATMO), the United Nations Sanctions Ordinance (Cap. 575) (UNSO), and the Weapons of Mass Destruction (Control of Provision of Services) Ordinance (Cap. 526). As these Ordinances apply to all persons, potential VASP licensees are also required to comply with these Ordinances and to keep up to date with the lists of individuals and entities designated under UNATMO and UNSO.

Foreign regulators, such as the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) and The UK Office of Financial Sanctions Implementation (OFSI), have recognised the sanctions risks arising from the growing prevalence of VAs; for example, the use of virtual currencies as a payment method to evade sanctions.

Recent enforcement actions by OFAC demonstrate that OFAC is increasingly targeting potential sanctions violations relating to digital currency transactions. So far, two crypto/virtual currency mixers have been sanctioned by OFAC.

OFAC designated crypto mixer, Blender.io, as a Specially Designated National (SDN) on 6 May 2022, marking the first time a virtual currency mixer has been sanctioned. Please refer to our previous Legal Update for further details.
OFAC sanctioned virtual currency mixer Tornado Cash on 8 August 2022.

With the increasing focus of foreign regulators on the sanctions risks arising from VAs, VASPs as well as traditional financial institutions should consider including VAs in their procedures for reporting blocked property or rejected transactions to the relevant authorities, proactively manage sanctions risks relating to VAs, and keeping up to date with the changes in the global regulatory space.

Conclusion

Regulators around the world are likely to introduce new laws and regulations to manage the risks posed by the rapid growth in VA technologies and associated products, if they have not already done so. Hong Kong's new VASP regime is a recent addition to this space and it will be interesting to see the extent to which, if at all, the new regime impacts the growth of the VA industry in Hong Kong.

¹ Section 1 of the Bill; Footnote 21 of the Legislative Council Brief on the Bill dated 22 June 2022 (Legislative Council Brief on 22 June 2022)

² Section 53ZRA of the Bill; Paragraph 18 of the Background Brief on 26 July 2022

³ Section 53ZRA of the Bill

⁴ Section 53ZRA of the Bill

⁵ Section 53ZRA of the Bill

⁶ Schedule 3B of the Bill

⁷ Section 53ZRK of the Bill; Paragraph 11 of the Legislative Council Brief on 22 June 2022

⁸ Section 53ZRK of the Bill; Paragraph 11 of the Legislative Council Brief on 22 June 2022

⁹ Paragraph 24 of the Background Brief on 26 July 2022

¹⁰ “security” is defined in section 1 of Part 1 of Schedule 1 to the Securities and Futures Ordinance (Cap. 571).

¹¹ Paragraphs 4 and 5 of the Position Paper on the Regulation of virtual asset trading platforms

¹² Paragraph 12 of the Legislative Council Brief on 22 June 2022