Hong Kong Launches New Virtual Asset Trading Platform Licensing Regime

Introduction

The trading of virtual assets just got a bit easier—and a lot clearer for all participants in Hong Kong. On May 23, 2023, the SFC published its Consultation Conclusions on the Consultation Paper on the proposed regulatory requirements for virtual asset trading platform operators (“VATPs”). Notably, the SFC will now allow retail access to service provided by VATPs, subject to various investor protection measures. The new regime has come into effect on June 1, 2023 and has a number of stipulations, covering onboarding, trading, custody, token admission, insurance and compensation arrangements, anti-money laundering (“AML”) and counter-financing of terrorism ("CFT”) matters, corporate governance, internal controls, dual licensing, discipline and fines, and transitional arrangements. VATPs will generally be governed by the following rules:

1. Guidelines for Virtual Asset Trading Platform Operators (“VATP Guidelines”);
2. Guideline on Anti-Money Laundering and Counter-Financing of Terrorism and the Prevention of Money Laundering and Terrorist Financing Guideline issued by the Securities and Futures Commission for Associated Entities of Licensed Corporations and SFC-licensed Virtual Asset Service Providers (collectively the “AML/CFT Guidelines”); and
3. Disciplinary Fining Guidelines.

VATPs are expected to comply with all of the guidelines above, along with statutory requirements in the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap 615) (the “AMLO”) and the Securities and Futures Ordinance (Cap 571).

VATP Guidelines

The VATP Guidelines governs a wide area of issues which will be briefly summarized below.

Retail Access

VATPs can provide services to retail investors, subject to these investor-protection measures, among others, (i) onboarding requirements; (ii) governance; and (iii) disclosure obligations:

Onboarding requirements

VATPs must conduct a holistic assessment of a potential investor’s knowledge of virtual assets. The VATP Guidelines provide a non-exhaustive list of criteria that VATPs can use to conduct the assessment. VATPs need to (i) assess potential investors’ knowledge of the virtual assets to ensure that they understand the nature and risks of the virtual assets; (ii) conduct necessary know-your-client (“KYC”) steps to assess potential investors’ financial situation  to ensure that they have sufficient net worth to assume the risks and bear the potential losses of trading virtual assets, (iii) be aware of potential investors’ investment experience and objectives so that VATPs can provide the most relevant services. For example, executing five or more transactions of virtual assets within the last three years will not be considered having sufficient knowledge. This requirement is for VATPs to assess a potential investor’s risk tolerance and assess whether it is suitable for the potential investor to participate in the trading of virtual assets. The SFC’s onboarding requirements apply to both professional investors and retail investors so no exemption is allowed. This is in line with the SFC’s requirements for assessing derivatives knowledge and suitability, and VATPs are reminded to refer to the SFC’s website, circulars and FAQs regarding opening accounts.

Governance

Along with other standard corporate governance and internal control measures, VATPs are expected to set up a token admission and review committee for admission or withdrawal of virtual assets. The committee should conduct due diligence—the VATP Guidelines provide a non-exhaustive list of factors for VATPs to consider. VATPs should also continuously monitor each of their admitted virtual assets and suspend or withdraw them when the assets are no longer suitable to be traded. The committee should include members of the VATP who are “principally responsible for” managing the key business line, compliance, risk management, and information technology. VATPs should also ensure that the criteria for admitting or removing, suspending and withdrawing a virtual asset are transparent and fair, and they should disclose those criteria on their websites. Each decision made by the committee needs to be properly documented.

Disclosure obligations

The VATP Guidelines provide disclosure obligations for VATPs’ websites or platforms. VATPs are to act with due skill, care, and diligence when disclosing information, and take all reasonable steps to ensure that the product-specific information they disclose is not false, biased, misleading or deceptive.

Token Admission, Due Diligence and Monitoring

General token admission

Fundamentally, the SFC considers it necessary for VATPs to know the products that they offer. VATPs must conduct due diligence on each virtual asset before admitting it for trading. The VATP Guidelines provide a non-exhaustive list of factors to consider, including the background of the virtual asset’s management-development team; the asset’s supply, demand, maturity and liquidity; its technical aspects; and its legal status in Hong Kong. Although the VATP Guidelines only require VATPs to consider virtual assets’ legal status in Hong Kong, VATPs are reminded that their operations should also comply with any applicable local laws and regulations where they operate. The SFC has also removed the requirement for VATPs to obtain a legal opinion to confirm the non-security nature of a virtual asset before it is admitted for trading, but as part of the approval process, the SFC may still request legal opinions to be submitted on specific tokens in light of developments in other jurisdictions.

Specific token admission

For virtual assets to be admissible for trading by retail investors, they should meet additional criteria. The tokens should be of a non-security nature and have high liquidity. The SFC considers large market capitalization to be a sign of high liquidity. The virtual asset should be an eligible large-cap virtual asset—i.e., it should have been included in at least two acceptable indices issued by at least two different index providers. The index providers must (i) have experience in publishing indices for the conventional securities market, complying with the International Organization of Securities Commissions (the “IOSCO”) Principles for Financial Benchmarks; and (ii) be independent of each other, independent of the issuer of the virtual asset, and independent of the platform operator. Notably, prior to stablecoins being subject to regulation in Hong Kong, SFC is of the view that VATPs should not admit stablecoins for retail trading. The SFC emphasized that tokens accessible by retail investors should be less prone to market manipulation across the virtual asset market as a whole.

Proprietary trading and other restrictions

VATPs should not engage in proprietary trading in virtual assets for their own accounts or any accounts in which they have an interest—though there are some exemptions, permitted by the SFC, on a case-by-case basis. VATPs should not engage in market-making activity on a proprietary basis either. This means that algorithmic trading, earn/yield or other lending and borrowing arrangements, or the use of a customer’s virtual asset to generate returns for customers or other parties will not be allowed.

VATPs should not conduct any offering, trading or dealing activities in virtual asset derivatives, futures, or any other products. The SFC takes the view that VATPs should focus on their primary businesses as agents that match client orders, but the SFC intends to conduct a separate review of this restriction in due course.

Custody and Cybersecurity

VATPs should ensure that all client virtual assets are properly safeguarded and held in wallet address(es) established by VATPs, which are designated for the purpose of holding client virtual assets. VATPs should ensure that client virtual assets are segregated from VATPs’ assets. VATPs should store 98% of client virtual assets in cold storage (such as Hardware Security Module–based cold storage), except under limited circumstances permitted by the SFC on a case-by-case basis.

VATPs will also need to comply with the detailed cybersecurity guidance stipulated in the VATP Guidelines, which covers operating procedures, security measures, backup, and contingency arrangements.

Insurance and Compensation

The virtual assets kept in the custody of VATPs must be covered by insurance or some other form of compensation arrangement. The insurance or compensation arrangement needs to cover potential loss of 50% of client virtual assets in cold storage and 100% of client virtual assets in hot or other storage. Acceptable compensation arrangement include any or a combination of (i) third party insurance; (ii) funds held in the form of a demand deposit or time deposit which will mature in six months or less, or virtual assets held by the VATPs which are set aside on trust and designated for such a purpose; and (iii) bank guarantee provided by an authorized financial institution in Hong Kong.

Dual-licensing Regime

Security tokens, or any other product that falls under the definition of “security” under the SFO, will be governed by the existing SFO regime; non-security tokens will be governed by the new regime. Since the terms and features of a virtual asset may evolve and a virtual asset’s classification may change (from a non-security token to a security token), the SFC considers it prudent for VATPs to apply for approvals under both the existing SFO regime and the licensing regime under Part 5B of the AMLO. The SFC will implement a streamlined application to allow potential VATPs to submit a single combined application for both licenses to reduce administrative burden. Further easing the load on VATPs, any individual appointed as a responsible officer under one regime may also be concurrently appointed as a responsible officer under the other regime.

AML/CFT Guidelines

VATPs will, of course, need to also comply with the AML/CFT Guidelines. Most notably, the Travel Rule will be imposed on VATPs, so they should obtain the required information from the sender and receiver of virtual asset transactions and conduct sanctions screening to reduce the risk of money laundering and terrorist funding. This requirement is consistent with the requirements that are imposed on financial institutions in other jurisdictions under the guidance of the Financial Action Task Force (FATF).

Disciplinary Fining Guidelines

The Disciplinary Fining Guidelines sets out the factors the SFC takes into account in exercising its power to impose pecuniary penalties onto institutions or individuals. The proposed Disciplinary Fining Guidelines are based on both the existing SFO Fining Guidelines and the AMLO Fining Guidelines. SFO-licensed VATPs and AMLO-licensed VATPs will be subject to the same fining criteria, no matter how they are licensed. For example, under section 53ZSP of AMLO, the SFC may impose a fine up to HK$10 million or three times the profit gained or loss avoided as a result of a misconduct or other conducts that led the SFC to form the opinion that a regulated person is or was not fit to remain that type of regulated person.

Applications

Under the new regime, corporate applicants or individual applicants must prove to the SFC that they are fit and proper to be licensed, and that they satisfy the competence requirements.

When the SFC assesses whether an applicant is fit and proper, the SFC shall consider the requirements under the SFO and the AMLO, as well as the applicant’s (i) financial status or solvency; (ii) the applicant’s or its senior management’s educational or other qualifications or experiences; (iii) ability to carry on the relevant activities competently, honestly, and fairly; and (iv) reputation, character, reliability and financial integrity, and its financial resources and soundness.

When the SFC assesses an applicant’s competence, the applicant must demonstrate to the SFC that they possess the necessary technical skills and professional expertise to be “fit”, and that they are aware of the relevant ethical standards and regulations to be “proper”. When considering corporate applicants, generally, the SFC will consider factors including business, corporate governance, staff competencies, internal controls, operations, risk management, and compliance.

When the SFC assesses an individual applicant’s competence to carry on the relevant activities, it will consider, among other things, whether the applicant has (i) necessary academic, professional or industry qualifications; (ii) sufficient relevant industry and management experience (where applicable); (iii) a good understanding of the regulatory framework, including the laws, regulations and associated codes governing the virtual asset sector; and (iv) familiarity with the ethical standards expected of a financial practitioner.

As for financial resources and soundness, a VATP operator must maintain in Hong Kong at all times assets that it beneficially owns and that are sufficiently liquid—for example, cash, deposits, treasury bills, and certificates of deposit (but no virtual assets) equivalent to at least 12 months of its actual operating expenses calculated on a rolling basis. A VATP operator must at all times maintain a paid-up share capital of not less than HK$5,000,000. A VATP operator must account for all assets and liabilities in accordance with generally accepted accounting principles, unless otherwise specified in the Securities and Futures (Financial Resources) Rules (Cap. 571N); and the account has to recognize the substance of a transaction, arrangement, or position.

To streamline the application process, the SFC requires applicants to engage an external assessor to assess their businesses, and submit the assessor’s report to the SFC (i) when submitting the licence application (Phase 1 Report) and (ii) after approval-in-principle is granted (Phase 2 Report). The report should cover the efficiency and soundness of the VATP’s proposed structure, governance, operations, systems, controls (with a focus on key areas such as governance and staffing), token admission, custody of virtual assets, KYC, AML/CFT, market surveillance, risk management, and cybersecurity, and the implementation and effectiveness of the adoption thereof.

Transitional Arrangement

From June 1, 2023, any VATP doing business in Hong Kong or actively marketing its services to Hong Kong persons will need to obtain a licence. The SFC will publish another circular with further information on transitional arrangements. The Consultation Paper provided a one-year transitional period for existing VATP operators in Hong Kong to either apply for a licence or to close down their VA trading operations. To be eligible for the transitional arrangements, a VATP must be pre-existing—it should have been operating in Hong Kong before June 1, 2023 with a “meaningful and substantial presence”. The SFC will consider a range of factors when determining what constitutes “meaningful and substantial presence”, including the place of incorporation, office space, location of central management and key personnel, and the platform’s active user base and trading volume in Hong Kong.

VATPs that are not deemed to be pre-existing cannot carry on their VA operations or market their services to Hong Kong investors and purchasers until they have obtained a license under the new regime.

Conclusion

Hong Kong has become one of the few jurisdictions with a comprehensive regulatory regime for VATPs. Consistent with the global effort to standardize the regulation of virtual assets, the IOSCO also issued a consultation report on policy recommendations for virtual assets. The new regime demonstrates not only the Hong Kong government’s supportive approach toward fintech development, but also the collective efforts of the Hong Kong government, regulators, and industry participants to establish Hong Kong as a key virtual asset hub in Asia. We expect that the SFC will soon publish further guidance—circulars, FAQs, and a licensing handbook for common questions relating to the new regime.

We expect there to be more clarification publications or updates by the SFC about the new regime, companies are advised to remain vigilant in tracking laws and regulations to ensure that they are in compliance with the requirements when the new laws take effect. A cross-disciplinary team of O’Melveny attorneys is closely monitoring legal and regulatory developments, bringing our expertise in securities law, corporate, financial regulation, privacy and data security, and other fields to this area of law in Hong Kong. Please contact the attorneys listed on this article or your O’Melveny counsel to help you navigate legal and strategic issues related to SFC licensing or other relevant issues.

This memorandum is a summary for general information and discussion only and may be considered an advertisement for certain purposes. It is not a full analysis of the matters presented, may not be relied upon as legal advice, and does not purport to represent the views of our clients or the Firm. Edwin Kwok, an O’Melveny partner licensed to practice law in Hong Kong, William K. Pao, an O'Melveny partner licensed to practice law in California, Ke Zhu, an O’Melveny partner licensed to practice law in Hong Kong and New York, AnnaLou Tirol, an O’Melveny partner licensed to practice law in California, and Wenting Yu, an O’Melveny partner licensed to practice law in New York and California, contributed to the content of this newsletter. The views expressed in this newsletter are the views of the authors except as otherwise noted.

© 2023 O’Melveny & Myers LLP. All Rights Reserved. Portions of this communication may contain attorney advertising. Prior results do not guarantee a similar outcome. Please direct all inquiries regarding New York’s Rules of Professional Conduct to O’Melveny & Myers LLP, Times Square Tower, 7 Times Square, New York, NY, 10036, T: +1 212 326 2000.