New Hong Kong regulatory regime for Virtual Asset Exchanges

1. Summary

• On 3 November 2020 the Financial Services and the Treasury Bureau (FSTB) issued a consultation paper to introduce a new licensing regime for virtual asset services providers (VASPs).
• The consultation paper also introduced (a) a new two-tier registration regime for dealers in precious metals and stones (DPMS); and (b) miscellaneous technical amendments to the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) (AMLO). This briefing focuses on the proposals for a new VASP licensing regime.
• The licensing regime for VASPs (and the registration regime for DPMS) will be housed under the AMLO.
• The reason for the proposals is to enhance AML and CTF regulation, in particular in light of Financial Action Task Force (FATF) recommendations.

2. VASP licensing regime

• Under the proposals, any person seeking to conduct in Hong Kong the business of operating a “VA exchange” (which is a type of virtual asset trading platform, as described below) will be required to apply for a licence from the Securities and Futures Commission (SFC). For investor protection purposes, a licensed platform will be subject to fit-and-proper requirements (including experience and relevant qualifications) and to the AML/CTF customer due diligence and record-keeping requirements under Schedule 2 to the AMLO that apply to financial institutions, as well as other bespoke regulatory requirements.
• This ties in with the FATF’s revision of its Standards in February 2019, under Recommendation 15, to require jurisdictions to regulate (or prohibit) VASPs for AML/CTF purposes in the same way as financial institutions.

Scope

• The VASP regime will apply to a “VA exchange”, being any trading platform: (i) which is operated for the purpose of allowing an offer or invitation to be made to buy or sell any virtual asset (VA) in exchange for any money or any VA (whether of the same or different type); and (ii) which platform comes into custody, control, power or possession of, or over, any money or any VA at any point in time during its course of business.
• The definition of VA exchange will not include ‘peer-to-peer’ trading platforms that solely provide a forum for buyers and sellers to post their bids and offers (with or without automatic matching mechanisms) where the actual transactions are conducted outside the platform and the platform is not involved in the underlying transactions by coming into possession of any money or any VA.

VA will not cover:

1. digital representations of fiat currencies;
2. financial assets (such as securities and authorized structured products) already regulated under the Securities and Futures Ordinance (Cap. 571) (SFO); or
3. closed-looped limited purpose items that are non-transferable, non-exchangeable and non-fungible (e.g. air miles, credit card rewards, gift cards, customer loyalty programmes, gaming coins).

• VA will cover ‘stablecoins’ which are backed by some form of assets for the purpose of stabilising their value.
• For now, the VASP licensing regime will only apply to VA exchanges, and not to other VASP activities (such as VA payment systems or VA custodian services), as those are not prevalent in Hong Kong. Future consideration will be given to extending the VASP licensing regime if there is a need to do so – and flexibility will be built in to the licensing regime from the outset to provide for such expansion. 

Interaction with existing voluntary SFC regulation

• Turning to the existing voluntary regulation of VA trading platforms, in November 2019 the SFC issued a voluntary set of regulatory standards for the “opt-in regime”, being a regime for the licensing of VA trading platforms in its regulatory sandbox. The opt-in regime standards are comparable to those applicable to licensed securities brokers and automated trading venues. The opt-in regime is voluntary in nature and only applies to those platforms which offer trading of at least one VA which falls within the definition of “security” under the SFO. It is not available to platforms that trade only in non-securities VAs (such as bitcoin). A trading platform which is licensed under the opt-in regime is exempt from the VASP licensing regime.
   
• Turning back to the proposed VASP licensing regime, as well as:
  1. fit-and-proper requirements; and
  2. AML/CTF customer due diligence and record-keeping requirements under Schedule 2 to the AMLO,

the proposals will also:

3. make reference to the existing opt-in regime, in order to ensure there will be a level playing field between (i) platforms that have voluntarily opted in to that regime and (ii) platforms that are subject to the VASP licensing regime.  

Licensing requirements

• The applicant must:
  1. be a Hong Kong incorporated company;
  2. have a permanent place of business in Hong Kong; and
  3. appoint at least two responsible officers to assume responsibility for ensuring AML/CTF compliance. The responsible officers may be held personally accountable in the case of contravention or non-compliance. Similar to the SFO, any ‘executive director’ of a licensed VASP must be a responsible officer. (An executive director is a director who actively participates, or is responsible for directly supervising, business which is regulated under the VASP licensing regime.)
      
• The applicant must satisfy a fit-and-proper test that applies to other financial institutions regulated under the AMLO. This extends to responsible officers and ultimate owners.
• The SFC will likely impose the following licensing conditions and regulatory requirements on licensed VASPs:
  1. Professional investors only – at the initial stage, the licensed VASP should only offer services to professional investors. The SFC will continue to monitor the market and reconsider its position as the market becomes more mature in future
  2. Financial resources – the licensed VASP should have adequate financial resources for operating its VA business, including a paid-up share capital of a specified amount and liquid assets, depending on the nature of its business
  3. Knowledge and experience – the licensed VASP and its associated entities should have a proper corporate governance structure staffed by personnel with the necessary knowledge and experience to enable the effective discharge of responsibility
  4. Soundness of the business – the licensed VASP and its associated entities (i.e., a separate corporate entity with which the licensed VASP has a controlling relationship) should operate its VA business in a prudent and sound manner, and ensure that client and public interests will not be adversely affected
  5. Risk management – the licensed VASP should have in place appropriate risk management policies and procedures for managing ML/TF, cybersecurity and other risks arising from a regulated VA activity that are commensurate with the scale and complexity of the business
  6. Segregation and management of client assets – the licensed VASP should implement proper segregation of client assets by placing them in an associated entity. Adequate policies and governance procedures should also be implemented to ensure the proper management and custody of client assets including VAs
  7. VA listing and trading policies – the licensed VASP should implement and enforce robust rules for the listing and trading of VAs on its platform(s). The VA exchange should also perform all reasonable due diligence on VAs before listing them for trading
  8. Financial reporting and disclosure – the licensed VASP and its associated entities should observe prescribed auditing and disclosure requirements and publish audited accounts
  9. Prevention of market manipulative and abusive activities – the licensed VASP should establish and implement written policies and controls for the proper surveillance of activities on its platform(s) in order to identify, prevent and report any market manipulative or abusive trading activities
  10. Prevention of conflicts of interest – to avoid any conflicts of interest, the licensed VASP and its associated entities should not engage in proprietary trading or market-making activities on a proprietary basis. Suitable firewalls should also be instituted between the different functions of the corporate structure to avoid conflict of interests. The licensed VASPs and its associated entities should also have a policy to eliminate, avoid, manage, or disclose actual or potential conflicts of interests for their employees who deal with VAs.

Exemption

• As mentioned above, a VA exchange that is already regulated as a licensed corporation under the opt-in regime will be exempt from the VASP licensing regime.

Short grandfathering period

• After a short period, currently anticipated to be 180 days after commencement of operation of the VASP licensing regime, all operators carrying on VA exchange business must possess a valid licence issued by the SFC.

Actively marketing to Hong Kong public

• A person, whether in Hong Kong or elsewhere, will be prohibited from actively marketing to the Hong Kong public a regulated VA activity or associated services, unless that person is properly licensed and regulated by the SFC to carry out the regulated VA activity.

Levels of fines/offences

• The proposed fines and offences are:

3. Commentary

• The Government’s decision to regulate VA exchanges is unsurprising given FATF recommendations. It will enhance the VA exchanges which apply for the licence, in particular by giving investors comfort in light of: (i) a rigorous regulatory regime; (ii) custody rules; and (ii) ongoing monitoring and fraud prevention systems.
• The AML/CTF customer due diligence requirements will counter one of the biggest concerns around VA and help remove the stigma around VA being used for illicit or concealed activities.
• Particular points of concern are:

1. The proposals envisage that only Hong Kong incorporated companies may apply for a VASP licence. We believe the licence should be available to any corporation, wherever incorporated.
2. We do not think it should be necessary for client assets to be placed with an associated entity of the VA (noting however that this is a condition of the opt-in regime). We believe third party custodians approved by the SFC for this purpose should be permitted.
3. The grandfthering period of 180 days may well be too short for a VA exchange to prepare and submit the application and for the SFC to grant a licence.