The new regulations for virtual assets in Hong Kong have officially come into effect, providing an in-depth interpretation of the Hong Kong virtual asset VASP licensing system

*Authors: Beosin, *Lawyer Liao Wang, Lawyer Gu Jianing

To actively respond to the Policy Declaration on the Development of Virtual Assets in Hong Kong issued in October 2022, aimed at promoting Hong Kong as an international virtual asset center, the Hong Kong Legislative Council passed the latest amendments to the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (2022) on December 7, 2022 (the "Anti-Money Laundering Ordinance"). This means that Hong Kong's new licensing regime for virtual asset service providers (VASP regime) will officially come into effect on June 1, 2023.

On February 20, 2023, the Hong Kong Securities and Futures Commission (SFC) released the VASP Consultation Paper, and on May 23, it published the VASP Consultation Summary, clarifying that the Guidelines for Virtual Asset Trading Platform Operators (VASP Guidelines) will officially take effect on June 1, 2023. This marks the Hong Kong government's proactive embrace of the new VASP regime after more than six months of planning, with an open attitude towards the virtual asset market. By then:

• All centralized virtual asset exchanges operating in Hong Kong or actively promoting their services to Hong Kong investors, regardless of whether they provide securities token trading services, must be licensed and regulated by the SFC.
• The SFC will implement measures in the second half of the year to allow licensed virtual asset exchanges to provide services to retail investors, but only non-securities tokens that have high liquidity in one of the traditional financial indices can be offered to retail investors.
• For stablecoins, regulatory arrangements will be implemented in 2023/24, and a licensing and permitting system for activities related to stablecoins will be established. Before stablecoins are regulated, the SFC believes that stablecoins should not be included for retail trading.

This article will help everyone better understand the Hong Kong virtual asset VASP licensing system, which will be implemented on June 1, by discussing the background of the VASP regime's revision, what virtual assets and virtual asset services are, the application requirements for VASP licenses, compliance requirements for exchanges, the dual licensing system, and transitional arrangements.

I. Background of the VASP Regime Revision

In the VASP Consultation Paper, the SFC clearly articulated the background for establishing the new VASP regime: during the ongoing crypto winter, a series of collapses has occurred, exacerbating the risks in the virtual asset market, particularly the collapse of FTX, which caused significant losses for millions of investors. The increasing interconnectedness of the virtual asset market with traditional financial markets highlights the importance and necessity of implementing effective regulation in the virtual asset industry. Major jurisdictions worldwide are shifting their regulatory approach from lenient (i.e., regulating from the perspective of anti-money laundering and payments) to a more comprehensive one (i.e., regulating from the perspective of investor protection).

The SFC has been ahead of other jurisdictions, gradually establishing a "voluntary licensing" system for securities token virtual assets as early as 2018, clearly stating that the SFC has no authority to regulate platforms that only trade non-securities virtual assets or tokens. Under the "voluntary licensing" system, virtual asset trading platforms engaged in non-securities tokens do not need to be licensed. Only two virtual asset exchanges obtained licenses under the "voluntary licensing" system: OSL Digital Securities Limited, a subsidiary of BC Technology Group, and Hash Blockchain Limited, a subsidiary of HashKey Group, received License 1 (securities trading) and License 7 (providing automated trading services).

To date, the virtual asset industry has undergone significant changes, and the original "voluntary licensing" system can no longer cover the current market, which is primarily composed of retail investors and focuses on non-securities tokens. To comprehensively regulate all centralized virtual asset trading platforms in Hong Kong and implement the latest standards from the Financial Action Task Force (FATF), the Hong Kong government amended the Anti-Money Laundering Ordinance and established a new "mandatory licensing" system for VASPs, aiming to achieve a more suitable balance between investor protection and market development. Once the VASP regime is officially implemented, all centralized virtual asset exchanges operating in Hong Kong or actively promoting their services to Hong Kong investors, regardless of whether they provide securities token trading services, will need to be licensed and regulated by the SFC.

II. Virtual Assets and Virtual Asset Services

In the context of the "mandatory licensing" of the VASP regime, it is crucial to clarify what virtual assets and virtual asset services are.

2.1 What are Virtual Assets

According to Section 53 ZRA of the Anti-Money Laundering Ordinance and the VASP Guidelines, virtual assets (Virtual Asset, VA) are broadly defined as:

A representation of value in digital form that is protected by cryptography, which meets the following descriptions:

Expressed in the form of a unit of account or a store of economic value;

Meets one of the following:

A. Used or intended to be used as a medium of exchange accepted by the public for one or more of the following purposes: (I) payment for goods or services; (II) settlement of debts; (III) investment; or

B. Provides rights, qualifications, or means to vote on matters related to the management, operation, or governance of any matters related to the value represented in cryptographic digital form, or changes to the terms applicable to arrangements concerning the value represented in cryptographic digital form;

Can be transferred, stored, or traded electronically; and

Possesses other characteristics as specified by the SFC from time to time in announcements published in the Gazette;

Defined as a representation of digital value that is a virtual asset as specified by the Financial Services and the Treasury Bureau of Hong Kong in announcements published in the Gazette.

Any securities token refers to a cryptographically protected digital representation of value that constitutes "securities" as defined in Section 1 of Schedule 1 of the Securities and Futures Ordinance.

According to Section 53 ZRA of the Anti-Money Laundering Ordinance, the following items are excluded from the definition of VA:

Digital currencies issued by central banks, entities performing central bank functions, or entities authorized by central banks to issue on behalf of central banks (CBDC);

Limited-use digital tokens (which are non-transferable, non-exchangeable, and non-fungible by nature, such as gift cards, customer loyalty rewards programs, and electronic payment services);

Stored value payment instruments (regulated under the Payment Systems and Stored Value Payment Instruments Ordinance);

Securities or futures contracts (regulated under the Securities and Futures Ordinance).

The definition of VA in the Anti-Money Laundering Ordinance will cover most virtual currencies in the market, including BTC, ETH, stablecoins, utility tokens, and governance tokens. Regarding stablecoins, the SFC also clarified in the Consultation Summary that the Hong Kong Monetary Authority released the Consultation Summary of the Discussion Paper on Crypto Assets and Stablecoins in January 2023, indicating that regulatory arrangements for stablecoins will be implemented in 2023/24, and a licensing and permitting system for activities related to stablecoins will be established. Before stablecoins are regulated, the SFC believes that stablecoins should not be included for retail trading.

The attributes of NFTs are linked to the attributes of the underlying assets, and currently, there is no clear definition under the VASP regime. When the SFC issued a reminder to investors about NFT risks on June 6, 2022, it stated that if an NFT is a true digital representation of collectibles (art, music, or films), the activities related to it do not fall under the SFC's regulatory scope. However, some NFTs cross the boundary between collectibles and financial assets and may possess attributes of "securities" regulated under the Securities and Futures Ordinance, and thus will be subject to regulation.

2.2 What are Virtual Asset Services

According to Schedule 3 B of the Anti-Money Laundering Ordinance and the VASP Guidelines, activities related to virtual asset services (VA Service) are defined as: operating a virtual asset exchange, that is:

Providing services that meet the following descriptions through electronic facilities:

The service:

A. Offers to buy and sell virtual assets that are frequently made in a certain manner, forming binding transactions or resulting in binding transactions; or

B. Frequently introduces or identifies individuals to negotiate or complete the buying and selling of virtual assets, or introduces or identifies individuals under reasonable expectations that they will negotiate or complete the buying and selling of virtual assets, forming binding transactions or resulting in binding transactions; and

In the service, customer funds or customer virtual assets are directly or indirectly held by the person providing the service; and

Any virtual asset trading activities and ancillary services conducted outside the platform provided to customers, and any activities conducted regarding virtual asset trading outside the platform.

Therefore, for (1) centralized virtual asset exchanges operating in Hong Kong, and (2) centralized virtual asset exchanges operating offshore that actively promote their services to Hong Kong investors, if they engage in the aforementioned related activities, they fall within the scope of virtual asset services. According to Section 53 ZRD of the Anti-Money Laundering Ordinance, any entity providing virtual asset services must obtain a VASP license from the SFC.

Currently, apart from the aforementioned virtual asset services, other businesses such as market making, proprietary trading, futures contracts, and derivatives are not allowed to operate, but it is not ruled out that the Financial Services and the Treasury Bureau of Hong Kong may include other virtual asset services through announcements published in the Gazette in the future.

III. VASP License Application

Under the new VASP regime, the SFC will issue licenses and regulate applicants according to the Anti-Money Laundering Ordinance and the VASP Guidelines. Applying for a VASP license imposes very high requirements on companies and their personnel:

A. Company: 1. Must be a company incorporated in Hong Kong with a fixed office location; 2. Must have a registered capital of not less than HKD 5 million, and current assets must exceed HKD 3 million; 3. Subsidiaries or affiliated companies must hold a Hong Kong Trust TCSP license for virtual asset custody.

B. Personnel: 1. The applicant, responsible personnel, licensed representatives, directors, and ultimate owners of the VASP must meet the SFC's fit and proper test; 2. At least 2 responsible officers (ROs) with experience in virtual asset services must be appointed, with the following conditions: at least one RO must be an executive director of the VASP, at least one RO must reside in Hong Kong, and there must always be at least one RO supervising the business; 3. At least one RO must be a licensed representative; 4. An auditor with experience in virtual asset business is required.

C. Compliance Requirements: In addition to meeting company qualifications and personnel requirements, a series of compliance systems must also be satisfied, including virtual asset trading business assessment reports, AML/CTF, and customer asset management. According to the detailed requirements of the VASP Guidelines, these application details also include: fit and proper provisions, competency provisions, ongoing training provisions, business conduct principles, financial soundness, operation of virtual assets on the platform, prevention of market manipulation and misconduct, trading with customers, protection of customer assets, management, supervision, and internal controls, cybersecurity, avoidance of conflicts of interest, record-keeping, auditor audits, ongoing reporting, and notification responsibilities.

IV. Compliance Requirements for Exchanges

According to the VASP Guidelines, centralized virtual asset exchanges must meet the following compliance requirements during their operations:

A. Secure Custody of Customer Assets

Platform operators should hold customer funds and customer virtual assets in trust through a wholly-owned subsidiary (i.e., "connected entity") with a TCSP trust license. Platform operators must ensure that the customer virtual assets stored in online wallets do not exceed 2%.

Additionally, since accessing virtual assets requires the use of private keys, the custody of virtual assets fundamentally relies on the secure management of those private keys. Platform operators should establish and implement written internal policies and governance procedures for private key management to ensure the secure generation, storage, and backup of all cryptographic seeds and keys.

Furthermore, platform operators must not deposit, transfer, lend, pledge, re-pledge, or otherwise trade customer virtual assets, nor create any property encumbrances on customer virtual assets. They must also have insurance that covers the risks involved in the custody of customer virtual assets.

B. Know Your Customer (KYC)

Platform operators should take all reasonable steps to establish the true and complete identity, financial status, investment experience, and investment objectives of each customer. Additionally, platform operators must ensure that customers have a full understanding of virtual assets (including the risks involved) before providing any services.

C. Anti-Money Laundering/Counter-Terrorist Financing

Platform operators must establish and implement adequate and appropriate anti-money laundering/counter-terrorist financing policies, procedures, and monitoring measures. Platform operators may use virtual asset tracking tools to trace specific virtual assets on the blockchain.

D. Prevention of Conflicts of Interest

Platform operators must not engage in proprietary trading or proprietary market-making activities and should have policies in place to manage internal employees trading in virtual assets to eliminate, avoid, manage, or disclose actual or potential conflicts of interest.

E. Inclusion of Virtual Assets for Trading

Platform operators should establish a function responsible for formulating, implementing, and enforcing guidelines for the inclusion of virtual assets, guidelines for suspending, pausing, and withdrawing virtual asset trading, along with options available to customers.

Moreover, before including any virtual assets for trading, platform operators must conduct reasonable due diligence on those virtual assets and ensure that they continue to meet all guidelines.

F. Prevention of Market Manipulation and Misconduct

Platform operators should establish and implement written policies and monitoring measures to identify, prevent, and report any market manipulation or misconduct occurring on their platform. The monitoring measures should include restrictions or suspensions of trading upon discovering manipulation or misconduct. Platform operators should adopt effective market surveillance systems provided by reputable independent vendors to identify, monitor, detect, and prevent such manipulation or misconduct and provide the SFC with access to this system.

G. Accounting and Auditing

Platform operators must select auditors with appropriate skills, care, and diligence, considering their experience, track record, and capabilities in auditing virtual asset-related businesses and platform operators. Additionally, platform operators should submit an auditor's report at the end of each financial year, which should include a statement regarding whether any violations of applicable regulatory requirements have occurred. Furthermore, the SFC requires platform operators to provide monthly reports on their business activities to the SFC within two weeks after the end of each month and upon the SFC's request.

H. Risk Management

Platform operators should establish a robust risk management framework that enables them to identify, measure, monitor, and manage all risks arising from their business and operations. Platform operators should also require customers to pre-fund their accounts and must not provide any financial facilitation for purchasing virtual assets.

V. Dual Licensing System

Under different regulatory mandates, the SFC will regulate securities token trading conducted by virtual asset exchanges under the Securities and Futures Ordinance (License 1 + License 7); at the same time, it will regulate non-securities token trading conducted by virtual asset exchanges under the Anti-Money Laundering Ordinance (VASP license).

Considering that the nature of virtual assets may evolve over time, such as transitioning from non-securities tokens to securities tokens, to avoid violating any licensing system provisions, virtual asset exchanges should simultaneously apply for dual licenses and approvals from the SFC under both the Securities and Futures Ordinance and the Anti-Money Laundering Ordinance (i.e., simultaneously applying for a VASP license and License 1, License 7).

To simplify the application process for dual licenses, applicants wishing to apply for licenses under both the current system of the Securities and Futures Ordinance and the virtual asset service provider system under the Anti-Money Laundering Ordinance only need to submit a comprehensive application form online, indicating that they are applying for both licenses simultaneously.

The SFC expects that platform operators with dual licenses will only need to report once to comply with the licensing or notification requirements under both the current system of the Securities and Futures Ordinance and the virtual asset service provider system under the Anti-Money Laundering Ordinance.

VI. Transitional Arrangements

The Anti-Money Laundering Ordinance provides transitional arrangements for "existing virtual asset exchanges," stipulating a transition period until June 1, 2024. This applies to exchanges that have been operating in Hong Kong and have meaningful and substantive business before June 1, 2023, including (1) exchanges that already have or are applying for licenses under the Securities and Futures Ordinance, and (2) unlicensed exchanges conducting business under the Securities and Futures Ordinance for non-securities tokens, which are eligible to participate in the transitional arrangements.

Exchanges eligible to participate in the transitional arrangements must meet the conditions listed in Schedule 3 G of the Anti-Money Laundering Ordinance to continue operating in Hong Kong from June 1, 2023, to May 31, 2024, and will be subject to the VASP licensing regime starting June 1, 2024.

If the operator submits an application to the SFC within 9 months after June 1, 2023, and confirms that it will comply with the regulatory requirements set by the SFC, the operator may be considered to have been licensed until the SFC makes a decision on its license application. During this period, it will be able to continue providing services until (i) the end of the first 12 months, (ii) withdrawal of the application, (iii) SFC rejection of the application, or (iv) SFC granting the license, whichever occurs first.

If its application for a virtual asset service provider license is rejected by the SFC, it must terminate its virtual asset service business within 3 months of receiving the rejection notice or by June 1, 2024 (whichever is later). During this period, the operator may only take actions purely for closing its services. The operator may apply to the SFC for an extension of the closure period, which will be for a duration deemed appropriate by the SFC, considering the operator's business and activities.

For "non-existing virtual asset exchanges" planning to provide virtual asset services in Hong Kong after June 1, 2023, they must apply in advance to the SFC and obtain a VASP license.

VII. "Regulatory Arbitrage" is Fading Away

According to the Anti-Money Laundering Ordinance, relevant sanctions will be imposed on illegal and non-compliant activities, including providing virtual asset services without a license and failing to meet AML/CTF requirements. Furthermore, any act of actively marketing services to the public in Hong Kong will be regarded as providing virtual asset services, regardless of the location of service provision or whether the service provider is in Hong Kong.

After June 1, 2023, operating virtual asset services without a VASP license will be a criminal offense. If convicted through public prosecution, a fine of HKD 5 million and 7 years of imprisonment may be imposed. If it is a continuing offense, an additional fine of HKD 100,000 may be imposed for each day the offense continues. If convicted through summary proceedings, a fine of HKD 5 million and 2 years of imprisonment may be imposed. If it is a continuing offense, an additional fine of HKD 10,000 may be imposed for each day the offense continues.

If licensed service providers and their responsible personnel fail to comply with statutory AML/CTF requirements, they will be committing a crime, and upon conviction, each person may be fined HKD 1 million and face 2 years of imprisonment. In addition to criminal liability, they will also face disciplinary actions from the SFC, including suspension or revocation of licenses, reprimands, orders to take remedial actions, and fines.

Moreover, various "misconduct" during the operation of virtual asset exchanges may also face disciplinary fines from the SFC.

Compared to other jurisdictions, especially in other East Asian regions, Hong Kong's previous regulatory environment for virtual asset trading was quite lenient. This led to numerous exchanges establishing their headquarters or operational centers in Hong Kong. However, with the introduction of the "VASP Crypto New Policy," Hong Kong is gradually moving away from "regulatory arbitrage."

VIII. Conclusion

The VASP regime is about to be implemented, regardless of the following situations: (1) virtual asset exchanges already operating in Hong Kong; (2) offshore virtual asset exchanges actively promoting their services to Hong Kong investors; (3) those planning to operate virtual asset exchanges in Hong Kong; or (4) traditional financial institutions intending to engage in virtual asset exchanges, VASP license applicants should prepare in advance for business compliance and related license applications.

The VASP regime is a means for the Hong Kong government to "channel water into the canal" through licensed exchanges. In this context, KYC and anti-money laundering compliance are of utmost importance. After the first step of "channeling water into the canal," we will see a series of detailed regulations regarding the opening of investments to retail investors and how to protect investors in the second half of the year. To wear the crown, one must bear its weight; only by meeting regulatory requirements can exchanges participate in the distribution of this enormous cake and promote the long-term development of the market.

We can foresee that the "East Rising and West Falling" has become inevitable. In the wake of the collapse of FTX and tightening regulations in the U.S., along with political maneuvering, Hong Kong, relying on its traditional financial foundation and sound legal system, as well as solid resources backed by the mainland, will surely regain its former glory as a "crypto center."

Beosin, as a global leading blockchain security company, has established branches in over 10 countries and regions, covering a "one-stop" blockchain security product and service that includes smart contract security audits before project launch, security risk monitoring, early warning and blocking during project operation, and security compliance KYT/AML. Currently, it has provided security technology services to over 3,000 blockchain enterprises worldwide and audited more than 3,000 smart contracts. Beosin also offers security assessments for token listing projects and provides compliance assessments that meet regulatory requirements in various regions, VaaS automated token listing audit services, exchange penetration services, exchange security construction consulting services, and other security solutions. Feel free to click the public account message box to contact us.

Author Introduction:

Liao Wang, Lawyer at DeHeng Law Offices (Hangzhou)

Gu Jianing, Senior Legal Consultant at Shanghai Mankun Law Firm

References:

https://www.elegislation.gov.hk/hk/cap571!zh-Hant-HK

https://www.sfc.hk/TC/Regulatory-functions/Intermediaries/Licensing/Do-you-need-a-licence-or-registration

https://apps.sfc.hk/edistributionWeb/API/consultation/openFile?lang=TC\&refNo=23CP1

https://apps.sfc.hk/publicreg/Terms-and-Conditions-for-VATP_10Dec20.PDF

https://www.hkex.com.hk/-/media/HKEX-Market/News/Research-Reports/HKEx-Research-Papers/2023/CCEOCryptoETF202304_c.PDF

https://apps.sfc.hk/edistributionWeb/gateway/TC/news-and-announcements/news/doc?refNo=23PR53