Dramatic changes are imminent: An article to understand the "Hong Kong Virtual Currency Exchange Licensing System"

Hong Kong will implement the virtual asset service provider licensing system (hereinafter referred to as the "VASP licensing system") on June 1, 2023. A huge industry change in Hong Kong and even Greater China is about to begin.

1. Voluntary Licensing System

For virtual asset trading platforms, the SFC introduced a regulatory framework for virtual asset trading platforms in 2019 and made detailed provisions in the "Position Paper - Regulation of Virtual Asset Trading Platforms" (hereinafter referred to as the "Position Paper").

The Position Paper stipulates that the SFC has no right to license or regulate platforms that only trade non-security virtual assets or tokens. This is because such virtual assets do not fall under the "Securities and Futures Ordinance" or "Futures Contracts", and the businesses operated by these platforms do not constitute "regulated businesses" under the Ordinance. Therefore, under the "Voluntary Licensing System", virtual asset trading platforms that engage in non-security tokens do not need to be licensed.

In fact, the "Position Paper" is consistent with the SFC's position on the adoption of a regulatory sandbox for innovation in the "financial technology" field in the "Circular on the Announcement of the SFC's Regulatory Sandbox" issued in 2017, and is also its specific measure in the field of crypto finance. In 2018, the SFC further formulated the "Statement on the Regulatory Framework for Virtual Asset Portfolio Managers, Fund Distributors and Trading Platform Operators" (hereinafter referred to as the "Regulatory Framework").

According to the Position Paper, a central platform that provides virtual asset trading services may apply to the SFC for a license for Type 1 (securities trading) and Type 7 (providing automated trading services) regulated activities if it intends to provide trading services for at least one security token. The regulatory framework includes strict standards in terms of asset custody, cyber security, anti-money laundering, market supervision, accounting and auditing, product due diligence and risk management.

The SFC also specifically stated that it will only regulate virtual asset trading platforms (i.e. centralized virtual asset exchanges) that provide virtual asset trading, settlement and delivery services and have control over investor assets. If the platform only provides trading services for direct peer-to-peer markets, and its investors generally retain control of their own assets (whether legal currency or virtual assets), the SFC will not accept the license applications of these platforms (i.e. decentralized virtual asset exchanges are not regulated by the SFC) . In addition, if the platform conducts virtual asset transactions for customers (including transmitting buy and sell instructions), but the platform itself does not provide automated trading services, the SFC will not accept their license applications.

So far, only two exchanges have obtained the above two licenses. At the end of 2020, OSL Digital Securities Limied, a subsidiary of BC Technology Group, obtained license No. 1 and license No. 7, becoming the first compliant and licensed virtual asset exchange in Hong Kong. In April 2022, Hash Blockchain Limited, a subsidiary of HashKey Group, became the second virtual asset exchange to obtain license No. 1 and license No. 7. Although there are slightly more asset management companies that have obtained license No. 9, there are only six institutions, including Huobi Asset Management, Lion Global Asset Management, MaiCapital, and Fore Elite Capital.

However, licensees under the "voluntary licensing system" can only provide services to professional investors . For most virtual asset exchanges that focus on the "retail" market, licenses 1 and 7 are not very attractive due to their lack of practicality. This further highlights the "preciousness" of the VASP license that will be issued in June this year.

2. VASP Licensing System

On December 7, 2022, the Anti-Money Laundering and Counter-Terrorist Financing (Amendment) Bill 2022 (hereinafter referred to as the "Anti-Money Laundering Ordinance") was passed by the Legislative Council of Hong Kong to implement the virtual asset service provider licensing system (hereinafter referred to as the "VASP Licensing System") which will come into effect on June 1, 2023.

The following table is a simple comparison of the old and new licensing systems in Hong Kong summarized by the author:

3. Dual License

Based on different regulatory authorizations, the SFC will regulate security token transactions conducted by virtual asset trading platforms in accordance with the existing system under the Securities and Futures Ordinance; at the same time, it will also regulate non-security token transactions conducted by virtual asset trading platforms in accordance with the virtual asset service provider system under the Anti-Money Laundering Ordinance.

Given that the terms and characteristics of virtual assets may evolve over time, the classification of a virtual asset may change from a non-security token to a security token (or vice versa). Based on the above regulatory logic, in order to avoid violating the provisions of any licensing system and ensure the continued operation of the business, virtual asset trading platforms should apply for approval under both the current system under the Securities and Futures Ordinance and the virtual asset service provider system under the Anti-Money Laundering Ordinance (i.e., apply for a VASP license and license No. 1 and license No. 7 at the same time) to obtain dual licensing and approval.

To simplify the application process for dual licenses, applicants who wish to apply for licenses under both the current system under the Securities and Futures Ordinance and the virtual asset service provider system under the Anti-Money Laundering Ordinance only need to submit a comprehensive application form online and indicate that they are applying for both licenses at the same time.

The SFC expects that dual-licensed platform operators will only need to make one notification to comply with the licensing or notification requirements under both the current regime under the SFO and the VASP regime under the AMLO.

IV. Exchange Compliance Requirements

According to the "Guidelines for Virtual Asset Trading Platform Operators" and "Terms and Conditions for Virtual Asset Trading Platform Operators" issued by the SFC, centralized virtual asset exchanges need to meet the following compliance requirements when operating.

1. Safeguard customer assets

Platform operators should hold client funds and client virtual assets on trust through a wholly-owned subsidiary (i.e. an “associated entity”). Platform operators should ensure that no more than 2% of client virtual assets are stored in online wallets.

In addition, since access to virtual assets requires the use of private keys, custody of virtual assets is essentially about the safe management of the relevant private keys. Platform operators should establish and implement written internal policies and governance procedures for private key management to ensure that all encryption seeds and keys are securely generated, stored and backed up.

In addition, platform operators should not deposit, transfer, lend, pledge, re-pledge or otherwise trade customer virtual assets, or incur any property rights encumbrances on customer virtual assets. They must also have insurance, and the coverage should cover the risks involved in the custody of customer virtual assets.

2. Know Your Customer (KYC)

Platform Operators should take all reasonable steps to establish the true and full identity, financial situation, investment experience and investment objectives of each of their clients.

In addition, platform operators must ensure that clients have a full understanding of virtual assets (including awareness of the risks involved) before providing any services to clients.

3. Combating money laundering/terrorist funding

Platform operators should establish and implement adequate and appropriate anti-money laundering/terrorist financing policies, procedures and control measures. Platform operators can use virtual asset tracking tools to trace the records of specific virtual assets on the blockchain.

4. Conflict of Interest

Platform operators should not engage in proprietary trading or proprietary market making activities and should have policies in place to manage internal employees’ trading in virtual assets to eliminate, avoid, manage or disclose actual or potential conflicts of interest.

5. Incorporate virtual assets for trading

Platform operators should establish a function to develop, implement and enforce the criteria for inclusion of virtual assets, the criteria for suspension, timing and cancellation of the sale and purchase of virtual assets, together with the options that customers can exercise.

In addition, platform operators should conduct reasonable due diligence on any virtual assets before including them for trading and ensure that such virtual assets continue to comply with all criteria.

6. Prevent market manipulation and illegal activities

Platform Operators should establish and implement written policies and controls to identify, prevent and report any market manipulation or irregular trading activities occurring on their platforms. Such controls should include limiting or suspending trading upon discovery of manipulation or irregular activities. Platform Operators should adopt an effective market surveillance system provided by a reputable independent provider to identify, monitor, detect and prevent such manipulation or irregular trading activities and provide the SFC with access to such system.

7. Accounting and Auditing

Platform operators must select auditors with appropriate skills, care and diligence, and consider their experience, track record and capabilities in auditing virtual asset-related businesses and platform operators.

In addition, platform operators should submit an auditor’s report every financial year, which should include a statement as to whether there has been any breach of applicable regulatory requirements.

In addition, we currently impose a licensing condition requiring platform operators to provide the SFC with monthly reports on their business activities within two weeks after the end of each calendar month and upon the SFC’s request.

8. Risk Management

Platform Operators should establish a robust risk management framework that enables them to identify, measure, monitor and manage all risks arising from their business and operations.

Platform operators should also require customers to deposit funds into their accounts in advance and should not provide any financial facilities to customers for purchasing virtual assets.

V. Transitional Arrangements

For the "existing virtual asset trading platform", the "Anti-Money Laundering Regulations" stipulates that the transition period is before June 1, 2024.

If the operator applies to the SFC within 9 months after June 1, 2023 and confirms that it will comply with the regulatory requirements set by the SFC, the operator will be deemed to be licensed until the SFC makes a decision on its license application, and will be able to continue to provide services during this period until the earlier of (i) the end of the first 12 months, (ii) the withdrawal of the application, (iii) the SFC’s rejection of the application, and (iv) the SFC’s grant of the license.

If its application for a virtual asset service provider license is rejected by the SFC, it must terminate its virtual asset service business within 3 months of receiving the rejection notice or before June 1, 2024 (whichever is later). During this period, the operator may only take actions purely for the purpose of closing its services. The operator may apply to the SFC for an extension of the closure period, which is a period that the SFC deems appropriate taking into account the operator's business and activities.

For "non-existing virtual asset trading platforms" that plan to provide virtual asset services in Hong Kong after June 1, 2023, they should apply to the SFC for and obtain a virtual asset service provider license before commencing business.

6. “Regulatory arbitrage” is gradually fading away

Under the Anti-Money Laundering Ordinance, relevant sanctions will be imposed on illegal and non-compliant acts, including providing virtual asset services without a license and failing to comply with AML/CTF requirements. In addition, any active marketing of services to the Hong Kong public will be deemed to be providing virtual asset services, regardless of where the service is provided or whether the service provider is in Hong Kong.

After June 1, 2023, it is an offence to operate a virtual asset service without a VASP licence. If convicted on indictment, the offender may be fined HK$5 million and imprisoned for 7 years. If the offence is a continuing offence, the offender may be fined HK$100,000 for each day during which the offence continues. If convicted on summary conviction, the offender may be fined HK$5 million and imprisoned for 2 years. If the offence is a continuing offence, the offender may be fined HK$10,000 for each day during which the offence continues.

If the statutory AML/CTF requirements are not complied with, the licensed service provider and its responsible officers will be guilty of an offence and, upon conviction upon prosecution, each person may be fined HK$1 million and imprisoned for 2 years. In addition to criminal liability, they will also be subject to disciplinary action by the SFC, including suspension or revocation of licences, reprimands, orders to take remedial actions and fines.

In addition, virtual asset exchanges may face disciplinary fines from the SFC for various "improper behaviors" during their operations.