New Hong Kong Regulatory Requirements and Licensing Regime for Virtual Asset Trading Platforms Finalised as Legislation Takes Effect

Licensing requirement

The SFC has reiterated that Platform Operators should, as a matter of prudence, apply for approvals under both the existing SFC licensing regime and the AMLO licensing regime[14] to ensure business continuity, given that a VA’s classification may change from security to non-security, or vice versa. The SFC rejected the propositions that Platform Operators under the AMLO regime can withdraw a particular token which evolves into a security token and simply allow the client to sell down the token, as this will not be in the client’s best interests.  This stance suggests that applicants seeking an AMLO only licence should expect to face tough questions from the SFC as to their rationale for not also seeking a licence under the SFC’s existing licence regime.

The SFC has also stated that the AMLO regime will cover VA trading platforms which are centralised and function in a manner similar to the types of automated trading venues licensed under the SFO – i.e., they use automated trading engines which match client orders and provide custody services as an ancillary service to their trading services. Given this, the SFC has also clarified that the scope of the AMLO regime does not include over-the-counter VA trading activities and VA brokerage activities, as these do not involve providing VA services with an automated trading engine and ancillary custody services.

Retail access and onboarding requirements

Platform Operators will be allowed to provide their services to retail investors provided that they comply with a range of robust investor protection measures covering onboarding, governance, disclosure and token diligence and admission, before providing services to retail investors.

The SFC notes that it is crucial for retail investors to understand the features and risks of investing in VAs, as well as the potential losses.  As such, the SFC will require Platform Operators to conduct the full scope of the onboarding requirements, including assessing the investor’s risk tolerance, conducting an holistic assessment of the investor’s understanding of the nature and risks of VAs, etc.  The assessment made during the onboarding process will also be relevant in order to comply with the suitability requirements.

It is relevant to note that Platform Operators will be required to comply with the full scope of the onboarding requirements, even if the retail client is knowledgeable about VAs (e.g. as a result of trading VAs for a number of years) or the client is an individual professional investor.  These requirements are broadly consistent with the regulatory requirements applied to traditional licensed corporations more generally.

The SFC has also now issued FAQs providing further guidance on onboarding requirements, including matters such as how to assess an investor’s knowledge of VAs and risk tolerance levels.[15]

Governance

A Platform Operator will be required to set up a token admission and review committee that consists of senior management who are principally responsible for managing the Platform Operator’s key business line, compliance, risk management, and information technology functions (i.e., at a minimum the Manager in Charge (MICs) for these functions).

The SFC has also now issued FAQs to augment the accountability of the senior management of Platform Operators through the imposition of a Manager in Charge regime for Platform Operators, which the SFC acknowledges is ‘substantially the same’ as that applicable to licensed corporations.[16]

Disclosure

The SFC notes that, although it understands the potential challenges of obtaining and verifying information provided by the issuer of a VA, it will still expect a Platform Operator to conduct due diligence on each virtual asset prior to admission for trading. As such, the Platform Operator is expected to obtain information for each VA which it can be reasonably satisfied is reliable and sufficient to base its token admission decision on. Accordingly, the SFC will require Platform Operators to take all reasonable steps to ensure that product specific information that they disclose is not false, biased, misleading or deceptive.

The SFC has set out in the VATP Guidelines the minimum information that Platform Operators are required to disclose with regards to the risk disclosure statements, disclosures regarding the platform’s operations, and VA-specific disclosures.

Token admission

Similar to the SFC’s product due diligence requirements applicable to licensed corporations in respect of traditional financial products, the SFC will require a Platform Operator to  conduct due diligence on each VA it plans to admit for trading on its platform to ensure that the VA complies with the admission criteria established by the token admission and review committee.

These due diligence requirements apply even if the VAs are not intended to be made available to retail investors, although there will likely be material differences in the admission criteria applicable to VAs that are or are not available for trading by retail investors. Furthermore, there is no exemption from conducting due diligence even if the VA in question has already been admitted for trading on another licensed VATP.

Relevantly, the SFC has decided that it will not relax the requirement for a non-security token to have at least a 12-month track record (as it is one of the factors which the token admission and review committee must consider). The result is that a newly or recently launched VA with less than a 12-month track record cannot be admitted for trading by a Platform Operator, even if it is not available for trading by retail investors.

However, the SFC has relaxed one aspect of its token admission requirements, with Platform Operators no longer being required to submit to the SFC written legal advice confirming that each token made available for trading by retail clients would not amount to a security token. Nevertheless, Platform Operators will still need to take reasonable steps to ensure that security tokens are not made available for trading by retail clients, as this could be a breach of the prospectus regime under the Companies (Winding Up and Miscellaneous Provisions) Ordinance (Cap. 32).

The SFC has emphasised in the Consultation Conclusions the importance of having additional minimum criteria that need to be satisfied before a non-security token can be made available for trading by retail users. In this respect, the SFC has further tightened the eligible large-cap VA requirements to stipulate that at least one of the two acceptable indices must be issued by an independent index provider (that has experience publishing indices for conventional securities markets, and that is also compliant with the IOSCO Principles for Financial Benchmarks).

Furthermore, in addition to being independent of the Platform Operator, the two index providers will also need to be independent of the issuer of the VA.  Additionally, the SFC emphasised in the Consultation Conclusions that being included in two acceptable indices is merely the minimum criterion for admitting a VA for retail trading, and that Platform Operators will also need to ensure that tokens admitted satisfy the Platform Operator’s token admission criteria (and also ensure that such tokens have high liquidity for tokens available for retail trading).

Stablecoins

The SFC has also clarified in the Consultation Conclusions that, prior to stablecoins being subject to regulation by the Hong Kong Monetary Authority (“HKMA”), Platform Operators should not admit stablecoins for retail trading.  The HKMA published the conclusions on its discussion paper on crypto-assets and stablecoins in January 2023, and the regulatory arrangements for stablecoins are expected to be implemented in 2023/24.  We previously published a client alert on this consultation.[17]

Insurance and compensation arrangements

The SFC will now require Platform Operators to have in place a compensation arrangement approved by the SFC to cover potential loss of 50% of client VAs in cold storage and 100% of client VAs in hot or other storage held by its custodian (see below for further discussion on custody arrangements). The SFC has also noted that the arrangement should be made up of the following:

• Third-party insurance;
• Funds (held in a demand deposit or time deposit with less than 6 months maturity) or VAs of the Platform Operator or any corporation within the same group as the Platform Operator which are set aside on trust and designated for such a purpose; and/or
• A bank guarantee from an authorised financial institution in Hong Kong.

Custody and security requirements

In this aspect of the Consultation, the SFC had sought industry suggestions in relation to technical solutions that could mitigate risks associated with custody of client assets, particularly in hot storage.

However, the SFC’s response in the Consultation Conclusions focused on reiterating the SFC’s view that, given the importance of safe custody of VAs, the SFC will require what it terms a ‘direct regulatory handle’ over a firm exercising control of client VAs, and as such will require custody to be undertaken by a wholly-owned subsidiary of a Platform Operator. For the same reason, the SFC will require  all seeds and private keys holding customer VAs to be securely stored in Hong Kong, noting that if they were stored overseas, this would substantially hinder the SFC’s supervision and enforcement efforts.  As a result, the SFC has reiterated in the Consultation Conclusions that the use of third-party custodians will not be allowed.

The SFC also noted that it had received ‘many’ comments requesting that the SFC amend the requirement that 98% of client VAs must be stored in cold storage and only 2% could be stored in hot or other storage so to permit a lower cold to hot storage ratio to be adopted. However, the SFC has reiterated that it believes that this ratio should not be lowered and that the ‘bulk’ of client VAs should be held in cold storage given that it is generally free of hacking / other cybersecurity risks. Further, while many respondents had indicated that they believed that a lower cold to hot storage ratio was required in order to ensure more expedient asset withdrawals, the SFC appears to have had little sympathy for this position. Instead, the SFC has reminded Platform Operators of the requirement under the Guidelines for Platform Operators’ comprehensive trading and operational rules to cover withdrawal procedures, including the time required to transfer VAs to a client’s private wallet after receiving a withdrawal request on its website.

Virtual asset derivatives

This aspect of the Consultation had sought input in relation to business models that would be adopted by Platform Operators if allowed to provide trading services in VA derivatives and the types of investors that would be targeted.

The SFC noted in the Consultation Conclusions that respondents expressed general support for allowing Platform Operators to provide trading services in VA derivatives, and that the SFC understood the importance of VA derivatives to institutional investors. However, the revised Guidelines maintain the prohibition on Platform Operators offering trading or dealing in VA derivatives, with the SFC instead indicating in the Consultation Conclusions that it will conduct a separate review of this issue ‘in due course’.

Proprietary trading and other services

The SFC has noted that it received submissions suggesting that proprietary trading, including proprietary market making by a Platform Operator’s affiliates, should be allowed in order to enhance liquidity.

While maintaining the prohibition on proprietary trading, the SFC has amended the requirements in the Guidelines to allow trading by affiliates of a Platform Operator other than trading through the Platform Operator (regardless of whether such trading is on-platform or is off-platform). The SFC noted that this amendment has been made on the basis that the previous iteration of the draft Guidelines effectively prohibited group companies of a Platform Operator from having any positions in VAs.

The SFC also noted that it received a number of responses in relation to whether Platform Operators could provide other VA services such as earning, deposit-taking, lending or borrowing. The SFC’s position, however, is that allowing such services could create potential conflicts of interest for Platform Operators (and would require additional safeguards) and as such Platform Operators will not be permitted to conduct these activities ‘at this stage’.

The SFC has also clarified in the Consultation Conclusions that while Platform Operators are prohibited from providing algorithmic trading services to their clients, the platform’s clients can use their own algorithmic trading systems when trading on a licensed platform.

Disciplinary Fining Guidelines

The SFC has clarified that all Platform Operators will be subject to the same fining criteria[18] regardless of the regime under which the Platform Operator is licensed. In rejecting a submission proposing that fines should be determined with reference to the total annual turnover of the Platform Operator, the SFC has stated that it will continue to determine quantum based on the legislative requirement in the AMLO that a fine should not exceed the higher of HK$10 million or three times the profit gained or loss avoided. However, the SFC has also noted that it will closely monitor the implementation of the Fining Guidelines, and determine whether legislative change may be required.

In response to a comment, the SFC specifically noted that the fact that a particular type of conduct is widespread in unregulated entities would not be considered a mitigating factor for any misconduct by licensed Platform Operators.

In the context of submissions requesting greater clarity on factors relevant to the SFC’s decision to take enforcement action against Platform Operators and/or individuals, the SFC has stated that it will take a holistic approach to disciplinary action in order to ensure that all culpable parties are held accountable for their conduct. In this vein, the SFC has noted in the Consultation Conclusions that the VATP Guidelines already provide that senior management of a Platform Operator bear the primary responsibility for ensuring compliance with the rules and guidelines applicable to Platform Operators. Further, as noted above, the SFC has also issued an FAQ on the augmentation of the accountability of senior management for Platform Operators, which extends the SFC’s Manager in Charge regime to Platform Operators.[19]