Hong Kong SFC Concludes Consultation on Regulation of Virtual Asset Trading Platforms

The Securities and Futures Commission (SFC) of Hong Kong released the "Consultation Conclusions on the Proposed Regulatory Requirements for Virtual Asset Trading Platform Operators Licensed by the Securities and Futures Commission" (Consultation Conclusions) on 23 May 2023.

Key Takeaways

Licence and Dual Licences Requirements

1. The new licensing regime under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, Cap. 615 (AMLO) for virtual asset (VA) service providers (AMLO VASP regime) catches a person who provides a centralised VA trading platform (VATP) providing VA trading services to its clients using an automated trading engine which matches client orders and also custody services as an ancillary service to its trading services. This is in line with the SFC’s approach in regulating traditional automated trading venues licensed under the Securities and Futures Ordinance, Cap. 571 (SFO). Accordingly, the AMLO VASP regime does not apply to over-the-counter VA trading activities and VA brokerage activities.

2. The SFC maintains its stance on the dual licences arrangement. To avoid contravention of the licensing requirements and ensure business continuity, the SFC considers it prudent for VATPs to be licensed under both the existing SFO regime (as regards VA which falls within the definition of “securities” under the SFO) and the AMLO VASP regime (as regards non-security VA).The SFC confirms that one responsible officer applicant may apply to be concurrently approved under both the SFO regime and the AMLO VASP regime, and a dually-licensed VATP is not required to maintain four different individuals as responsible officers. To facilitate the licence applications, the SFC will:

(a) adopt a streamlined application process so that only a single consolidated application needs to be submitted for a dual licences application; and

(b) provide further guidance on the details of the process and the pragmatic approach to be applied by the SFC.

Implementation Timeline

3. The revised regulatory requirements will be introduced into the various guidelines, principally, “Guidelines for Virtual Asset Trading Platform Operators” and “Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations and SFC-licensed Virtual Asset Service Providers)”, becoming effective on 1 June 2023. The SFC will issue a circular to provide further information on the transitional arrangements. The SFC will also (a) revise the joint HKMA-SFC circular to set out the regulatory requirements applicable to intermediaries engaging in VA related activities and (b) issue additional guidance on security tokens in due course.

Retail Access to Licensed VATPs

4. Licensed VATPs may provide VA trading services to retail investors, subject to compliance with a range of robust investor protection measures covering onboarding, governance, disclosure and token due diligence and admission.

• Onboarding requirements: In line with the SFC’s existing requirements regarding derivatives knowledge assessment and suitability obligations, the onboarding requirements applicable to individual professional investors will be the same as those applicable to retail investors.
  
  
• Governance: A licensed VATP should establish a token admission and review committee to enhance its governance. The SFC expects the committee to at least include managers-in-charge of the licensed VATP operator responsible for managing the key business line, compliance, risk management and information technology respectively. It is not a must to appoint independent external members to the committee provided the licensed VATP implements necessary internal policies and procedures to deal with any conflicts of interest involving committee members and the platform operator.
  
  
• Disclosure obligations: In line with the SFC’s existing requirements on other intermediaries which post information on their online platforms, licensed VATPs are required to act with due skill, care and diligence when disclosing product information. The SFC has refined the disclosure obligations in the VATP Guidelines to require platform operators to take all reasonable steps to ensure the product specific information they disclose is not false, biased, misleading or deceptive.
  
  
• Token due diligence and admission:
  
  (a) A licensed VATP should conduct due diligence on each token before admission for trading. This addresses the fundamental principle that an intermediary should know the product it is offering. In performing the token due diligence, a licensed VATP is not required to consider the token’s regulatory status in jurisdictions outside of Hong Kong where the platform operator provides trading services; and where overseas laws and regulations do not affect the token’s regulatory status in Hong Kong.
  
  (b) Tokens eligible for trading by retail investors must meet additional minimum criteria. For such purpose, tokens must be eligible large-cap VAs included in at least two acceptable indices issued by two independent index providers. The index providers are required to (i) have experience in publishing indices for the conventional securities market complying with the International Organization of Securities Commissions (IOSCO) Principles for Financial Benchmarks; and (ii) be independent of each other, and independent of the VA issuer and licensed VATP.
  
  (c) Before stablecoins are regulated in Hong Kong, they should not be admitted for retail trading.
  
  
• Other investor protection requirements: VATPs should not offer gifts tied to the trading of a specific VA, as is the case with all other intermediaries except for discounts of fees or charges.

Other Aspects of the Regulatory Requirements

5. In incorporating the relevant requirements into the VATP Guidelines:

• Cold to hot storage ratio: To ensure safe custody of client assets, the SFC maintains that the cold to hot storage ratio should not be lowered (i.e. 98% of client VAs must be stored in cold storage and only 2% stored in hot or other storages).
  
  
• Algorithmic trading: The SFC clarifies that while licensed VATPs are prohibited from providing algorithmic trading services to clients, clients can use their own algorithmic trading systems in connection with trading via the licensed VATPs.
  
  
• Licensed VATPs to provide VA related services only: A licensed VATP's primary business is to act as an agent and provide an avenue for the matching of orders between clients. Other activities commonly seen in the VA market such as earning, deposit-taking, lending and borrowing may lead to potential conflicts of interest and require additional safeguards. Accordingly at this stage, the SFC does not allow licensed VATPs to conduct these other activities.

Maintain Insurance or Compensation Arrangement

6. Regarding insurance or compensation arrangement, the SFC’s responses are:

• Coverage threshold: The SFC draws comfort in knowing the bulk of client VAs are held in cold storage. Thus, the SFC is prepared to lower the coverage threshold to 50% for client VAs held in cold storage, on the basis that 98% of them will be required to be held in cold storage.
  
  
• Types of assets acceptable for the compensation arrangement: Bank guarantees, along with funds held in the form of demand deposits or fixed deposits with a maturity of six months or less, would be acceptable. Reserve VAs that are the same as client VAs required to be covered under the compensation arrangement may be acceptable.
  
  
• Escrow arrangement: A licensed VATP may either use an escrow arrangement or simply hold the funds set aside for the compensation arrangement provided that, in the latter, the funds set aside are segregated and set aside on trust and designated for compensation purpose from the assets of the platform operator and its group companies. Further, VAs which form part of a compensation arrangement should be segregated from VAs of the platform operator and its group companies, and be held in cold storage by its associated entity in accordance with the VATP Guidelines (as opposed to third-party custodians).

AML/CFT Matters

7. Implementation of the Travel Rule

• The Travel Rule is a key AML/CFT measure for VA service providers and financial institutions as it provides fundamental information for carrying out sanctions screening and transaction monitoring, and other risk mitigating measures.
  
  
• Under the Travel Rule, licensed VATPs are required to (i) when acting as the ordering institution, obtain, hold and submit required information about the originator and recipient to the beneficiary institution immediately and securely; and (ii) when acting as the beneficiary institution, obtain from the ordering institution and hold required information.
  
  
• Where the required information cannot be submitted to the beneficiary institution immediately, the SFC considers that submission as soon as practicable after the VA transfer to be acceptable as an interim measure until 1 January 2024.Licensed VATPs should comply with all other Travel Rule and relevant requirements with effect from 1 June 2023, including submitting the required information to the beneficiary institution securely, while adopting the said interim measures.
  
  
• Unhosted wallets: Where handling clients’ request to transfer VAs to or from unhosted wallets, licensed VATPs are subject to specific requirements which may be more stringent than the Travel Rule requirements. In particular, licensed VATPs should obtain required information from the client and conduct sanctions screening, and should only accept transfers with unhosted wallets that are assessed to be reliable, having regard to screening results of the VA transactions and associated wallet addresses, as well as assessment results of the ownership or control of the unhosted wallet.
  
  
• Licensed VATPs must take reasonable measures on a risk-sensitive basis to mitigate and manage ML/TF risks associated with VA transfers to or from unhosted wallets. Where a VA transfer is conducted via an unhosted wallet which has been whitelisted, the licensed VATP should ascertain the ownership or control of the unhosted wallet on a periodic and risk-sensitive basis.
  
  
• Transfer counterparty due diligence: VA transfer counterparty due diligence and additional measures should be applied using a risk-based approach, taking into account various factors such as the types of products and services offered by the VA transfer counterparty and the types of customers it serves, as well as the AML/CFT regime in the jurisdiction that it operates. In relation to ongoing monitoring of VA transfer counterparties, this would include screening VA transfers using a risk-based approach. The due diligence measures should be applied to the entity which a licensed VATP conducts VA transfers with.
  
  
• No occasional transactions allowed: Licensed VATPs should not carry out occasional transactions as they are required to establish a business relationship with all customers.