Hong Kong Virtual Asset Trading Platform Operators Licensing Regime: Closing Remarks

Finally, the Hong Kong Securities and Futures Commission (HKSFC) has published its final Guidelines for Virtual Asset Trading Platform Operators (VATP Guidelines) on 23 May 2023. Notably, in connection with our first article,¹ the HKSFC has also published its consultation conclusions (Consultation Conclusions) on the proposed regulatory requirements for virtual asset trading platform operators (Platform Operators) on, among others, the following issues:

• Allowing retail access to licensed virtual asset (VA) trading platforms (Platforms): Noting the strong support expressed, the HKSFC will allow Platform Operators to provide their services to retail investors. The Platform Operator should comply with robust investor protection measures covering onboarding, governance, disclosure and token due diligence and admission, before providing trading services to retail investors. The HKSFC stressed that its approval of the admission of a VA for retail trading is not a recommendation or endorsement, nor does it guarantee the VA’s performance.
• Implementing additional requirements for retail access to Platforms: The HKSFC will impose an explicit prohibition of gifts tied to the trading of a specific VA, with the exception of discounts of fees or charges. Currently, there will be no cooling-off period after account opening for retail clients, as such clients should have been assessed by the Platform Operator as being suitable for trading VAs.
• Trading in VA derivatives: Given the importance of trading in VA derivatives to institutional investors, the HKSFC will conduct a separate review on such topic in due course.

Set out below is the checklist for the policies and procedures to be in place prior to the launch of the Platform, with revisions incorporated therein following the finalisation of the VATP Guidelines.

1. Checklist of policies and procedures (P&P)

Have you got the following P&Ps in place yet?

Highlighted below are some key P&Ps that warrant elaboration given the HKSFC’s scrutiny over these aspects of a licensed intermediary’s business operations:⁶

1.1 Conflicts of interests

a. With a view to eliminating, avoiding, managing or disclosing actual or potential conflicts of interests, Platform Operators are prohibited from:

(i) engaging in proprietary trading in VAs for its own account or any account in which it has an interest and market-making activities. Third-party market makers are, however, allowed to conduct market making activities, and affiliates are allowed to trade other than trading through the Platform;

(ii) providing financial accommodation for its clients (Clients) to acquire VAs (i.e. margin trading is not permitted);

(iii) offering, trading or dealing in VA futures contracts or related derivatives, subject to the aforementioned separate review by the HKSFC in the future;

(iv) providing algorithmic trading services to Clients;

(v) making any arrangements (i.e. staking) with Clients to use VAs held by the Clients and traded on the Platform for the purpose of generating returns for the Clients or any other parties; or

(vi) providing other VA market services such as earning, deposit-taking, lending and borrowing.

b. At the corporate level, Platform Operators should:

(i) demonstrate meeting the HKSFC’s competence requirements through establishing (x) control procedures to manage conflicts arising from carrying on regulated activities by itself or its group companies (Group), (y) adequate control systems to address conflicts arising from employee dealings – employees should generally be required to deal through the Platform Operator, and such transactions should be separately recorded and identified and (z) procedures to ensure that orders of clients have priority over orders of their employees; and

(ii) appropriately segregate key duties and functions among staff to minimise the occurrence of potential conflicts.

c. At an individual level, responsible officers of Platform Operators holding external directorships or engaging in businesses outside the Group will need to address conflicts arising from these roles, for example, due to confidentiality. In relation to onboarding Clients and VAs (Products), Platform Operators should NOT:

(i) for Clients – take commission rebates or other benefits solely for solicitating or recommending a specific VA to Clients; and

(ii) for Products – admit VAs for trading through application of a fee structure that charges differing rates against VA issuers.

d. As a general rule, if the Platform Operator cannot avoid acting in any actual or potential conflict-of-interest situation, it should make appropriate prior disclosure to Clients and also take reasonable steps to manage conflicts to ensure fair treatment of Clients.

1.2 Record keeping

a. Record-keeping obligations are not only to be met as a matter of general principle when carrying on regulated activities, but diligence will go a long way to helping Platform Operators demonstrate to the HKSFC that they have been compliant with the VATP Guidelines.

b. Apart from the requirements under the Securities and Futures (Record Keeping) Rules (Cap. 571O of the Laws of Hong Kong), Platform Operators should also ensure that records set out in paragraphs 14.7, 14.8 and 14.9 of the VATP Guidelines are kept.⁷ Platform Operators should keep sufficient records in relation to the conduct of regulated activities and client assets that it receives or holds.

c. Specifically, Platform Operators, among other things, must keep:

(i) When acting as an ordering institution – records of required information relating to any VA transfers, as well as immediately and securely transmitting them to the beneficiary institution;

(ii) When acting as a beneficiary institution⁸ – records of required information obtained from the ordering institution or intermediary institution;

(iii) When conducting VA transfers to or from unhosted wallets – records of required information from its Clients; and

(iv) When adopting technological solutions for travel rule compliance – records of its due diligence on the technological solutions provider.

d. Further, Platform Operators should:

(i) maintain an adequate access log which records the identity and role of staff members who has access to the Platform, the information accessed, the time of access, any approval given for such access and the basis upon which such access was permitted in each case;

(ii) record the required level of spare capacity on the Platform as part of its capacity planning to facilitate regular monitoring of the Platform’s usage capacity;

(iii) properly document decisions (and the reasons thereof) made by the token admission and review committee; and

(iv) maintain proper access to the system nodes for the full records of the regulated activities at all times.

e. Needless to say, daily backup at an offline medium of the Platform Operator’s business records, Client and transaction databases, servers and supporting documentation must be performed at a minimal.

1.3 Ongoing reporting to the HKSFC, the Token Admission and Review Committee and Senior Management

Highlighted below are key reporting obligations for reference:

a. Reporting obligations to the HKSFC

(i) The HKSFC has imposed monthly reporting obligations on Platform Operators regarding business activities, including a financial return form which is due within three weeks of each calendar month end. An annual financial return must also be submitted to the HKSFC within four months of the financial year end.

(ii) Additionally, annual reports of any reviews on the effectiveness of a Platform Operator’s market surveillance system are to be submitted to the HKSFC upon request.

(iii) Occurrences of material non-compliance with legal and regulatory requirements or any internal P&Ps should be promptly reported to the HKSFC, any relevant regulatory authorities and senior management of the Platform operator (Senior Management).

(iv) Audit logs and incident reports to be made available to the HKSFC upon request.

(v) Escalation internally and externally (to clients, the HKSFC and other regulatory authorities) of suspected or actual cybersecurity incidents, as appropriate.

b. Reporting obligation to and from the Token Admission and Review Committee

(i) Ongoing monitoring and reporting of each onboarded VA covering an assessment of whether it (x) should be made available for trading on the Platform, (y) should be accessible to all or some Clients and (z) continues to satisfy the Criteria.

(ii) The Token Admission and Review Committee must report details of the VAs made available to retail Clients for trading and other issues noted to the Board of Directors of the Platform Operator on a monthly basis.

c. Reporting to Senior Management:

(i) Findings and issues discovered through regular operational reviews of the Platform that are not yet resolved within established time frames must be reported to Senior Management.

(ii) Any non-compliance with requirements for custody of client assets and established P&P in respect to the handling of client assets should be reported by designated staff members to Senior Management as soon as practicable.

(iii) Risk exposure reports should be provided on a regular basis, and material risk exposures and significant risk variances are to be alerted to Senior Management promptly.

(iv) Findings, conclusions and recommendations noted in any audit are to be reported to Senior Management in a timely manner.

2. Pre-launch checks

2.1 Disclosure

Throughout the VATP Guidelines, the HKSFC emphasised the importance of making sufficient disclosures to Clients (both online and offline), enabling Clients to appraise themselves of the position of their investments. The disclosure obligations include, without limitation:

a. Price and trading volume of the VA on the Platform, both within the last 24 hours and since the VA’s admission for trading on the Platform;

b. Background information about the management or development team of the VA or any of its known key members (if any);

c. Issuance date of the VA (if any);

d. Material terms and features of the VA;

e. Affiliation of the Platform Operator with the issuer of the VA and the management or development team (of any of its known key members) of the VA (if any);

f. Link to the VA’s official website and Whitepaper (if any);

g. Link to the smart contract audit report and other bug reports of the VA (if any);

h. How voting rights (if any) will be handled by the Platform Operator;

i. Criteria for admitting, suspending and withdrawing a VA for or from trading;

j. Custodial arrangements, rights and obligations of the Platform Operator and the Clients and how client assets are stored;

k. Conflict of interest disclosures;

l. Jurisdiction in which trading of onboarded VAs are prohibited; and

m. Personal data privacy disclosure statement.

Platform Operators should act with due skill, care and diligence when disclosing information and should take all reasonable steps to (x) ensure that product-specific information disclosed is not false, biased, misleading or deceptive and (y) disclose, in a prominent manner, the nature and risks of trading VAs and using the Platform Operator’s VA trading services.

Have you made adequate disclosures to Clients? In particular, if there is a material system delay or failure, Platform Operators are expected to inform Clients about (x) the situation as soon as practicable and (y) how Client’s pending orders, deposits and withdrawals will be handled.

2.2 Cybersecurity assessments

Have you completed your cybersecurity assessment ahead of launch? The HKSFC mandates a stringent independent cybersecurity assessment to be conducted pre-launch of the Platform and expects ongoing monitoring and enhancement to the Platform thereafter. Platform Operators should allocate sufficient time and effort working with technological service providers to ensure the Platform is properly designed and operates in compliance with the Anti-Money Laundering and Counter Terrorist Financing Ordinance (Cap. 615 of the Laws of Hong Kong) (AMLO)/Securities and Futures Ordinance (Cap. 571 of the Laws of Hong Kong) (SFO), the VATP Guidelines and the Platform’s cybersecurity policies.

SIDLEY’S CLOSING REMARKS

1. IN OR OUT OF SCOPE

Before yielding oneself to the extensive requirements under the VATP Guidelines, Platform Operators ought to continuously assess and monitor its business model to determine whether proposed business activities are within the scope of the VA licensing regime.

As a gentle reminder, the existing licensing regime effective as of 1 June 2023 does not aim to capture the provision of VA trading services that does not:

a. utilise automated trading engines (e.g. a platform which operates as an order routing facility); or

b. involve a centralised party providing intermediation services (i.e. merely peer-to-peer in nature).

2. TRANSITIONAL ARRANGEMENTS AND IMPLEMENTATION DETAILS OF THE NEW REGULATORY REGIME

The VATP Guidelines will supersede the Terms and Conditions for Platform Operators (Terms and Conditions), and compliance with the VATP Guidelines will be imposed as a licensing condition.

For existing SFO-licensed Platforms, given the 12-month transitional period for compliance with the requirements in the VATP Guidelines, HKSFC will not remove the corresponding licensing conditions on compliance with the Terms and Conditions from their licences until the Platform can fully comply with the VATP Guidelines or by the deadline of the 12-month transitional period, whichever is earlier.

On 31 May 2023, the HKSFC issued the Circular⁹  on transitional arrangements of the new licensing regime for Platforms (Transition Circular). Highlighted in the table below is further elaboration provided by the HKSFC on the transitional arrangements:

3. THE HKSFC’S POWERS, PUBLICATION AND PROCESS

Given the paramount role of the HKSFC in protecting the investing public once the new licensing regime is expanded permitting retail Clients to trade in VAs, the HKSFC’s expanded powers exercisable in supervising Platform Operators are noted below:

a. Powers of the HKSFC

The HKSFC may impose prohibitions and requirements in relation to the operation of the Platform by the Platform Operators and their associated entities:

(i) conducting regulated business on a specified manner;

(ii) prohibition from entering into any further transactions;

(iii) restriction from disposing of client assets and other property; and

(iv) appointment of an auditor.

b. Publication of VA trading platform lists

To enhance transparency of the Platforms’ regulatory status, the HKSFC proposes to publish Platform lists on its website. These lists aim to deter Platforms which are unlicensed or required to close down from providing VA trading services to the retail public. The four lists and their respective purpose are set out below:

c. Licensing process

As of 25 May 2023, the relevant licensing forms have been updated to facilitate filing of licence applications by interested Platform Operators to the HKSFC beginning 1 June 2023. The HKSFC has also updated Schedule 4 of the VATP Guidelines to assist applicants on collating the requisite information to be submitted in support of its licence application under the new VASP licensing regime.

4. CLOSING REMARKS

The HKSFC has also published the Circular¹⁰  on implementation of new licensing regime for Platforms on 31 May 2023 (New Circular). Extracted below is key information relevant to corporate and individual applicants applying for licenses under the new licensing regime.

The New Circular also covers additional guidance including FAQs on conduct-related matters, forms and ongoing notifications (covering licensing forms, financial returns and relevant documents and reporting of material breach and non-compliance incidents). Additionally, the HKSFC also issued a separate licensing handbook for Platform Operators.

This is clearly just the beginning of the end as we welcome the new chapter of Hong Kong being one step closer to becoming the world’s premier fintech hub by introducing one of the most comprehensive regulatory frameworks for crypto exchanges in the world!

¹ Please refer to Sidley’s series of articles for details relating to the commencement of consultations by HKSFC on the proposed regulatory requirements for Platform Operators: https://mp.weixin.qq.com/s/OEoXrMerPEr6GLbf9MD4jA
² Please refer to Sidley’s series of articles for details relating to personnel requirements under the VATP Guidelines: https://www.sidley.com/en/insights/newsupdates/2023/5/hk-vatp-licensing-regime-1-dual-licensing-regime-and-key-personnel-requirements
³ Please refer to Sidley’s series of articles for details relating to infrastructure requirements under the VATP Guidelines: https://www.sidley.com/en/insights/newsupdates/2023/5/hk-vatp-licensing-regime-2-key-infrastructure-requirements-under-the-vatp-guidelines
⁴ Please refer to Sidley’s series of articles for details relating to onboarding requirements under the VATP Guidelines: https://www.sidley.com/en/insights/newsupdates/2023/06/hk-vatp-licensing-regime-3-final-vatp-requirements-and-key-onboarding-requirements
⁵ Please refer to Sidley’s series of articles for details relating to AML requirements under the VATP Guidelines: https://www.sidley.com/en/insights/newsupdates/2023/06/hk-vatp-licensing-regime-4-standalone-aml-chapter
⁶ Capitalised terms herein have been defined in the various articles published earlier as part of Sidley’s VASP series.
⁷ Paragraphs 8 and 12.9 of the Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations and SFC-licensed Virtual Asset Service Providers) (AML Guideline) specifies the record-keeping requirements relating to customer due diligence and transactions.
⁸ When the required information cannot be submitted to the beneficiary institution immediately, the HKSFC considers that submission, as soon as practicable after the VA transfer, to be acceptable as an interim measure until 1 January 2024; i.e. paragraphs 12.10.10 and 12.11.13 of the AML Guideline will only take effect on 1 January 2024.
⁹ https://apps.sfc.hk/edistributionWeb/gateway/EN/circular/doc?refNo=23EC27
¹⁰ https://apps.sfc.hk/edistributionWeb/gateway/EN/circular/doc?refNo=23EC28
¹¹ https://www.sfc.hk/en/Welcome-to-the-Fintech-Contact-Point/Virtual-assets/Overview
¹² https://www.sfc.hk/en/Welcome-to-the-Fintech-Contact-Point/Virtual-assets/Virtual-asset-trading-platforms-operators/Regulatory-requirements/FAQs-on-licensing-related-matters