*This article was jointly written by Beosin’s special guest authors, Attorney Liao Wang and Attorney Gu Jining.
In order to actively respond to the "Policy Statement on the Development of Virtual Assets in Hong Kong" in October 2022 and promote the development of Hong Kong into an international virtual asset center, the Hong Kong Legislative Council passed the latest amendment to the "Anti-Money Laundering and Counter-Terrorist Financing Ordinance 2022" (the "Anti-Money Laundering Ordinance") on December 7, 2022, which means that Hong Kong's new virtual asset service provider licensing system (VASP system) will be officially implemented on June 1, 2023.
On February 20, 2023, the Hong Kong Securities and Futures Commission (SFC) issued the "VASP Consultation Document" and released the "VASP Consultation Summary" on May 23, clarifying that the "Guidelines for Virtual Asset Trading Platform Operators" (VASP Guidelines) will officially take effect on June 1, 2023. This marks that the Hong Kong government has actively welcomed the new VASP system with an open attitude towards the virtual asset market after more than half a year of planning. By then:
All centralized virtual asset exchanges that operate in Hong Kong or actively promote their services to Hong Kong investors must be licensed and regulated by the SFC, regardless of whether they provide security token trading services. The SFC will implement matters allowing licensed virtual asset exchanges to provide services to retail investors in the second half of the year, but only tokens that are not securities and have high liquidity in one of the traditional financial indexes can be provided to retail investors. For stablecoins, the regulatory arrangements for stablecoins will be implemented in 2023/24, and a licensing and permitting system for stablecoin-related activities will be established. Before stablecoins are regulated, the SFC believes that stablecoins should not be included for retail trading.
This article will help everyone better understand the Hong Kong virtual asset VASP licensing system, which will be implemented on June 1, from the background of the revision of the VASP system, what are virtual assets and virtual asset services, the application requirements for VASP licenses, the compliance requirements of exchanges, the dual licensing system, and transitional arrangements.
1. Background of the revision of the VASP system
In the VASP Consultation Paper, the SFC clearly elaborated on the background of the revision of the establishment of a new VASP system: in the ongoing crypto winter, crashes occurred one after another, causing the risks in the virtual asset market to increase, especially the collapse of FTX, which caused tens of millions of investors to suffer heavy losses. The risks brought about by the increasing closeness between the virtual asset market and the traditional financial market highlight the importance and necessity of effective supervision of the virtual asset industry. Major jurisdictions around the world are changing their regulatory approach from a loose approach (i.e., supervision from the perspective of combating money laundering and payments) to a more comprehensive approach (i.e., supervision from the perspective of investor protection).
The SFC is ahead of other jurisdictions and has gradually established a "voluntary licensing" system for security token virtual assets as early as 2018, which clearly stipulates that the SFC has no right to regulate platforms that only buy and sell non-security virtual assets or tokens. Under the "voluntary licensing" system, if it is a virtual asset trading platform engaged in non-security tokens, it does not need to be licensed. Only two virtual asset exchanges have obtained licenses for exchange business under the "voluntary licensing" system: OSL Digital Securities Limited under BC Technology Group and Hash Blockchain Limited under HashKey Group obtained license No. 1 (securities trading) and license No. 7 (providing automated trading services).
Today, the virtual asset industry has undergone tremendous changes, and the original "voluntary licensing" system can no longer cover the market, which is now dominated by retail investors and non-security tokens are the main trading objects. In order to fully regulate all centralized virtual asset trading platforms in Hong Kong and implement the latest standards of the Financial Action Task Force on Money Laundering (FATF), the Hong Kong government has amended the Anti-Money Laundering Ordinance and established a new VASP "mandatory licensing" system in order to achieve a more appropriate balance between investor protection and market development. After the VASP system is officially implemented, all centralized virtual asset exchanges that operate in Hong Kong or actively promote their services to Hong Kong investors, regardless of whether they provide security token trading services, will be required to obtain SFC licenses and be regulated by it.
2. Virtual Assets and Virtual Asset Services
In the context of the VASP system’s “mandatory licensing”, it is crucial to clarify what virtual assets are and what virtual asset services are.
2.1 What are virtual assets?
According to the Anti-Money Laundering Regulations 53 ZRA and VASP Guidelines, Virtual Assets (VA) are broadly defined as:
A cryptographically protected digital representation of value that meets the following specifications:
expressed in units of account or as a store of economic value;
Meet one of the following:
A. is or is intended to be used as a medium of exchange that is accepted by the public for one or more of the following purposes: (I) payment for goods or services; (II) settlement of debts; (III) investment; or
B. Provide the right, qualification or means to vote on any matter relating to the management, operation or governance of any cryptographically protected digital value or any changes to the terms of any arrangement applicable to cryptographically protected digital value;
can be transferred, stored or traded by electronic means; and
possess such other characteristics as the SFC may from time to time prescribe by notice published in the Gazette;
The digital form of value representation of virtual assets is stipulated by the Hong Kong Financial Services and the Treasury Bureau in the form of a notice published in the Gazette.
Any security token means a cryptographically protected digital form of value that constitutes a “security” as defined in section 1 of Part 1 of Schedule 1 to the Securities and Futures Ordinance.
Pursuant to the Money Laundering Regulation 53 ZRA, the following items are excluded from the definition of VA:
Digital currencies (CBDCs) issued by a central bank, an entity performing central bank functions, or an entity authorized by a central bank on behalf of a central bank;
Limited-use digital tokens (non-transferable, non-exchangeable and non-fungible in nature, such as gift cards, customer loyalty reward programs and electronic payment services);
Stored value facilities (regulated by the Payment Systems and Stored Value Facilities Ordinance);
Securities or futures contracts (regulated by the Securities and Futures Ordinance).
The definition of VA in the Anti-Money Laundering Ordinance will cover most virtual currencies on the market, including BTC, ETH, stablecoins, utility tokens, and governance tokens. Regarding stablecoins, the SFC also made it clear in the Consultation Summary: The Hong Kong Monetary Authority has issued the Consultation Summary of the Discussion Paper on Crypto Assets and Stablecoins in January 2023, stating that it will implement regulatory arrangements for stablecoins in 2023/24 and establish a licensing and permitting system for stablecoin-related activities. Before stablecoins are regulated, the SFC believes that stablecoins should not be included for retail trading.
The attributes of NFTs are linked to the attributes of the assets behind them, and there is no clear definition under the VASP system. When the SFC issued a reminder to investors about the risks of NFTs on June 6, 2022, it stated that if NFTs are real digital representations of collectibles (artworks, music or films), activities related to them are not within the scope of SFC supervision. However, some NFTs cross the line between collectibles and financial assets and may have the attributes of "securities" regulated by the Securities and Futures Ordinance, and therefore will be regulated.
2.2 What are virtual asset services?
According to Schedule 3B of the Anti-Money Laundering Ordinance and the VASP Guidelines, the activities of virtual asset services (VA Service) are defined as: operating a virtual asset exchange, that is:
Providing services through electronic means that meet the following requirements:
The service:
A. Offers to buy or sell virtual assets are often made or accepted in a manner that creates or results in binding transactions; or
B. People frequently introduce or identify each other with a view to negotiating or completing the sale or purchase of virtual assets, or frequently introduce or identify each other in circumstances where there is a reasonable expectation that they will negotiate or complete the sale or purchase of virtual assets in a manner that results in a binding transaction or causes a binding transaction to occur; and
in the service, client money or client virtual assets are directly or indirectly possessed by the person providing the service; and
Any virtual asset trading activities and ancillary services provided by the platform operator to its customers that are conducted outside the platform, and any activities conducted in connection with virtual asset trading activities that are conducted outside the platform.
Therefore, for (1) centralized virtual asset exchanges operating in Hong Kong, and (2) centralized virtual asset exchanges operating offshore that actively promote their services to Hong Kong investors, if they engage in the above-mentioned related activities, they all fall within the scope of virtual asset services. According to Section 53 ZRD of the Anti-Money Laundering Regulations, any entity engaged in virtual asset services must obtain a VASP license from the SFC.
At present, in addition to the above-mentioned virtual asset services, other businesses such as market makers, proprietary trading, futures contracts and derivatives are not allowed to be carried out. However, it is not ruled out that the Hong Kong Financial Services and the Treasury Bureau will subsequently include other virtual asset services in the form of an announcement published in the Gazette.
3. VASP License Application
Under the new VASP system, the SFC will issue licenses and supervise applicants in accordance with the Anti-Money Laundering Regulations and VASP Guidelines. Applying for a VASP license has very high requirements for the company and its personnel:
A. Company: 1. A company established in Hong Kong with a fixed office location; 2. It must have a registered capital of no less than HK$5 million and liquid funds of more than HK$3 million; 3. Subsidiaries or affiliated companies must have a Hong Kong Trust TCSP license for virtual asset custody.
B. Personnel: 1. VASP applicants, responsible officers, licensed representatives, directors and ultimate owners must meet the SFC’s fit and proper test; 2. At least two responsible officers (ROs) with experience in virtual asset services must be appointed, and the following conditions must be met: at least one RO must be the executive director of the VASP, at least one RO must reside in Hong Kong, and there must always be at least one RO to supervise the business; 3. At least one RO licensed representative; 4. An auditor with experience in virtual asset business is required.
C. Compliance requirements: In addition to meeting the company's qualifications and personnel requirements, it is also necessary to meet a series of compliance systems such as the virtual asset trading business development assessment report, AML/CTF, and customer asset management. According to the VASP guidelines, the detailed requirements of these applications also include: appropriate personnel regulations, competence regulations, continuous training regulations, business ethics principles, financial stability, virtual asset operations on the platform, prevention of market manipulation and illegal activities, transactions with customers, protection of customer assets, management, supervision and internal control, network security, avoidance of conflicts of interest, record keeping, auditor audits, continuous reporting and notification responsibilities, etc.
IV. Exchange Compliance Requirements
According to the VASP guidelines, centralized virtual asset exchanges need to meet the following compliance requirements when operating:
A. Safeguarding customer assets
Platform operators should hold customer funds and customer virtual assets on trust (TCSP Trust License) through a wholly-owned subsidiary (i.e. “associated entity”). Platform operators should ensure that no more than 2% of customer virtual assets are stored in online wallets.
In addition, since access to virtual assets requires the use of private keys, the custody of virtual assets basically requires the safe management of the relevant private keys. Platform operators should establish and implement written internal policies and governance procedures regarding private key management to ensure that all encryption seeds and keys are securely generated, stored and backed up.
In addition, platform operators should not deposit, transfer, lend, pledge, re-pledge or otherwise trade customer virtual assets, or incur any property rights encumbrances on customer virtual assets. They must also have insurance, and the coverage should cover the risks involved in the custody of customer virtual assets.
B. Know Your Customer (KYC)
Platform operators should take all reasonable steps to establish the true and full identity, financial situation, investment experience and investment objectives of each of their customers. In addition, platform operators must ensure that customers have a full understanding of virtual assets (including the risks involved) before providing any services to customers.
C. Combating Money Laundering/Terrorist Financing
Platform operators should establish and implement adequate and appropriate anti-money laundering/terrorist financing policies, procedures and control measures. Platform operators can use virtual asset tracking tools to trace the records of specific virtual assets on the blockchain.
D. Preventing conflicts of interest
Platform operators should not engage in proprietary trading or proprietary market making activities and should have policies in place to manage internal employees’ trading in virtual assets in order to eliminate, avoid, manage or disclose actual or potential conflicts of interest.
E. Inclusion of virtual assets for trading
Platform operators should establish a function to develop, implement and enforce the criteria for inclusion of virtual assets, the criteria for suspension, timing and cancellation of trading of virtual assets, and the options that customers can exercise.
In addition, platform operators should conduct reasonable due diligence on any virtual assets before including them for trading and ensure that such virtual assets continue to comply with all criteria.
F. Prevention of market manipulation and illegal activities
Platform operators should establish and implement written policies and controls to identify, prevent and report any market manipulation or irregular trading activities occurring on their platforms. Such controls should include limiting or suspending trading upon discovery of manipulation or irregular activities. Platform operators should adopt an effective market surveillance system provided by a reputable independent provider to identify, monitor, detect and prevent such manipulation or irregular trading activities and provide the SFC with access to such system.
G. Accounting and Auditing
Platform operators must select auditors with appropriate skills, care and diligence, and consider their experience, track record and ability to audit virtual asset-related businesses and platform operators. In addition, platform operators should submit an auditor's report every financial year, which should include a statement on whether there has been any violation of applicable regulatory requirements. In addition, the SFC also requires platform operators to provide monthly reports on their business activities to the SFC within two weeks after the end of each calendar month and upon request by the SFC.
H. Risk Management
Platform operators should establish a robust risk management framework that enables them to identify, measure, monitor and manage all risks arising from their business and operations. Platform operators should also require customers to pre-fund their accounts and should not provide any financial facilities to customers to purchase virtual assets.
5. Dual Licensing System
Based on different regulatory authorizations, the SFC will regulate security token transactions conducted by virtual asset exchanges in accordance with the Securities and Futures Ordinance (License No. 1 + License No. 7); at the same time, it will also regulate non-security token transactions conducted by virtual asset exchanges in accordance with the Anti-Money Laundering Ordinance (VASP license).
Taking into account that the nature of virtual assets may evolve over time, such as transforming from non-security tokens to security tokens, in order to avoid violating the provisions of any licensing system, virtual asset exchanges should obtain dual licensing and approval from the SFC under both the Securities and Futures Ordinance and the Anti-Money Laundering Ordinance (i.e. applying for a VASP license and a Type 1 license and a Type 7 license at the same time).
To simplify the application process for dual licenses, applicants who wish to apply for licenses under both the current system under the Securities and Futures Ordinance and the virtual asset service provider system under the Anti-Money Laundering Ordinance only need to submit a comprehensive application form online and indicate that they are applying for both licenses at the same time.
The SFC expects that dual-licensed platform operators will only need to make one notification to comply with the licensing or notification requirements under both the current regime under the SFO and the VASP regime under the AMLO.
VI. Transitional Arrangements
The Anti-Money Laundering Ordinance provides for transitional arrangements for "existing virtual asset exchanges", stipulating that the transitional period will be before June 1, 2024. Exchanges that have been operating in Hong Kong and have meaningful and substantial business before June 1, 2023, including (1) exchanges that have or are applying for licenses under the Securities and Futures Ordinance, and (2) unlicensed exchanges that conduct business in non-security tokens under the Securities and Futures Ordinance, are eligible to participate in the transitional arrangements.
Exchanges eligible to participate in the transitional arrangement must meet the conditions set out in Schedule 3G to the Anti-Money Laundering Ordinance in order to continue to operate in Hong Kong from June 1, 2023 to May 31, 2024, and will be subject to the VASP licensing regime from June 1, 2024.
If the operator applies to the SFC within 9 months after 1 June 2023 and confirms that it will comply with the regulatory requirements set by the SFC, the operator will be deemed to be licensed until the SFC makes a decision on its licence application and will be able to continue to provide services until the earlier of (i) the end of the first 12 months, (ii) the withdrawal of the application, (iii) the SFC’s rejection of the application, and (iv) the SFC’s grant of a licence.
If its application for a virtual asset service provider license is rejected by the SFC, it must terminate its virtual asset service business within 3 months of receiving the rejection notice or before June 1, 2024 (whichever is later). During this period, the operator may only take actions purely for the purpose of closing its services. The operator may apply to the SFC for an extension of the closure period for a period that the SFC deems appropriate taking into account the operator's business and activities.
For "non-existing virtual asset exchanges" that plan to provide virtual asset services in Hong Kong after June 1, 2023, they must apply to the SFC in advance and obtain a VASP license.
7. “Regulatory arbitrage” is gradually fading away
Under the Anti-Money Laundering Ordinance, relevant sanctions will be imposed on illegal and non-compliant acts, including providing virtual asset services without a license and failing to comply with AML/CTF requirements. In addition, any unsolicited marketing of services to the Hong Kong public will be deemed to be providing virtual asset services, regardless of where the service is provided or whether the service provider is in Hong Kong.
After June 1, 2023, it is an offence to operate a virtual asset service without a VASP licence. If convicted on indictment, the offender is liable to a fine of HK$5 million and seven years’ imprisonment, and, if the offence is a continuing offence, to a further fine of HK$100,000 for each day during which the offence continues. If convicted on summary conviction, the offender is liable to a fine of HK$5 million and two years’ imprisonment, and, if the offence is a continuing offence, to a further fine of HK$10,000 for each day during which the offence continues.
Failure to comply with statutory AML/CTF requirements will commit an offence for licensed service providers and their responsible officers and, upon conviction upon indictment, each may be fined HK$1 million and imprisoned for 2 years. In addition to criminal liability, they will also be subject to disciplinary action by the SFC, including suspension or revocation of licences, reprimands, orders to take remedial action and fines.
In addition, virtual asset exchanges may face disciplinary fines from the SFC for various "improper behaviors" during their operations.
Compared with other jurisdictions, especially other regions in East Asia, Hong Kong’s previous regulatory environment for virtual asset transactions can be said to be very relaxed. That’s why countless companies, big and small, have their headquarters or operations centers in Hong Kong. However, with the introduction of the “VASP Crypto New Policy”, Hong Kong is moving away from “regulatory arbitrage”.
8. Conclusion
The VASP regime is about to be implemented. Regardless of the following situations: (1) a virtual asset exchange already operating in Hong Kong; (2) an offshore virtual asset exchange actively promoting its services to Hong Kong investors; (3) a virtual asset exchange planning to operate in Hong Kong; or (4) a traditional financial institution planning to get involved in virtual asset exchanges, VASP license applicants should prepare for business compliance and related license applications in advance.
The Hong Kong government is currently working on the VASP system by “bringing water into the channel” through licensed exchanges. In this context, KYC and anti-money laundering compliance are top priorities. After the first step of “bringing water into the channel”, we will see a series of detailed rules and regulations on opening up retail investors’ investment and how to protect investors in the second half of the year. If you want to wear the crown, you must bear its weight. Only on the basis of meeting regulatory requirements can exchanges participate in the distribution of this huge pie and promote the long-term development of the market.
We can foresee that the "rise of the East and the fall of the West" is inevitable. With the fall of FTX, tightened regulation in the United States, and political games, Hong Kong will surely regain its former glory as the "crypto center" by relying on its own traditional financial foundation and perfect legal system, as well as the solid resources of the mainland.
As a world-leading blockchain security company, Beosin has established branches in more than 10 countries and regions around the world. Its business covers smart contract security audits before project launch, security risk monitoring, early warning and blocking during project operation, security compliance KYT/AML and other "one-stop" blockchain security products + services. It has currently provided security technical services to more than 3,000 blockchain companies around the world and audited more than 3,000 smart contracts. Beosin also provides security assessments for coin listing projects and provides compliance assessments that meet local regulatory requirements, VaaS automated coin listing audit services, exchange penetration services, exchange security construction consulting services and other security solutions. Please click on the public account message box to contact us.
This article features the following authors:
Liao Wang, lawyer at Beijing Deheng (Hangzhou) Law Firm, liaowang@dehenglaw.com, WeChat ID: Web3XiaoLawyer
Gu Jining, senior legal counsel at Shanghai Mankun Law Firm, gujiening@mankunlaw.com, WeChat account: Mankun Blockchain
References:
https://www.elegislation.gov.hk/hk/cap571!zh-Hant-HK
https://www.sfc.hk/TC/Regulatory-functions/Intermediaries/Licensing/Do-you-need-a-licence-or-registration
https://apps.sfc.hk/edistributionWeb/API/consultation/openFile?lang=TC&refNo=23CP1
https://apps.sfc.hk/publicreg/Terms-and-Conditions-for-VATP_10Dec20.PDF
https://www.hkex.com.hk/-/media/HKEX-Market/News/Research-Reports/HKEx-Research-Papers/2023/CCEO_CryptoETF_202304_c.PDF
https://apps.sfc.hk/edistributionWeb/gateway/TC/news-and-announcements/news/doc?refNo=23PR53