Hong Kong Doubles Down on Digital Assets with New Licensing Proposals

• Scope of SFC licensing / registration regime: Any person who, by way of business, makes or offers to make an agreement with another person, or induces or attempts to induce another person to enter into or to offer to enter into an agreement in respect of the following : (i) for or with a view to acquiring, disposing of, subscribing for or underwriting VAs or (ii) the purpose or pretended purpose of which is to secure a profit to any of the parties of an agreement from the yield or value fluctuation of VAs. The proposed definition is modelled on the traditional Type 1 regulated activity “dealing in securities”. 
• Activities regulated: The regime will adopt the same definition of “VA” under the VATP licensing regime. Activities to be regulated include simple dealing services – e.g. VA-VA or VA-fiat (and vice versa) conversion services (including spot trading of VAs), and more complex dealing services such as brokerage activities, block trading activities, and other relevant activities of advisors or asset managers. This is irrespective of whether the services are provided through physical shops or online platforms. P2P trading of VAs between individuals (with no intermediaries involved) are not in-scope. Separate sets of regulatory requirements will be formulated to regulate other services (e.g. advisory, asset management, staking, borrowing/lending, margin trading) and may involve additional regulatory approvals.
• Entities regulated: These include (i) existing intermediaries licensed by or registered with the SFC which provide VA dealing services, (ii) SFC-licensed VATPs, and (iii) unregulated VA dealing operators and VA fund managers, which are all required to be licenced or registered with the SFC.
• Entities exempted: HKMA-licensed stablecoin issuers which conduct the offering or redemption of stablecoins they issue in the primary market will be exempted from the licensing regime.
• Prohibition on active marketing unless duly licensed / registered: To prevent the investing public from being exposed to risks associated with unregulated VA dealing activities, a person is prohibited from actively marketing, whether in Hong Kong or elsewhere, to the public of Hong Kong the provision of, or holding out as providing in Hong Kong, VA dealing services, unless the person is licensed by or registered with the SFC for providing the VA dealing services.

• Eligible applicant: An applicant (except for banks) must be (i) a Hong Kong-incorporated company with a permanent place of business in Hong Kong, or (ii) a registered non-Hong Kong company under the Companies Ordinance (Cap. 622). The applicant would also be required to have suitable premises for its storage of books and records.
• Fitness and properness: An applicant, along with its substantial shareholders and individuals carrying out VA dealing services, must also meet the fit-and-proper criteria as prescribed by the SFC.
• Appointment of responsible officers: An applicant is required to designate at least two regulator-approved responsible officers or executive officers (as appropriate) to ensure adherence to AML/CFT and other regulatory requirements, who will be personally liable for any breaches. All executive directors must also be appointed as responsible officers with approval of the SFC.

• VAs permitted: While the consultation draft has not specified the requirements for the types of VAs which the client may trade in, the requirements are expected to broadly follow those applicable to VATPs (e.g. setting up a token admission and review committee to perform reasonable due diligence on VAs to be dealt with).
• Dealing with retail investors: VA dealing service providers offering services to retail investors must align their token offering procedures with those of licensed VATPs. This means they should only offer tokens of high-liquidity and, once the HKMA’s regime is in place, stablecoins issued by HKMA-licensed issuers. (You may refer to our previous insight on the proposed stablecoin licensing regime.)
• Trading through overseas VATPs: The SFC is considering to allow VA dealing service providers to execute client trades through non-SFC-licensed VATPs regulated in other jurisdictions or other liquidity providers, provided that robust investor protection measures are in place.
• It is, however, unclear how this will reconcile with the VATP regime, in particular the restriction for overseas unregulated VATP to market their services to the Hong Kong public. 

• VA dealing service providers are expected to implement risk-based transaction monitoring, similar to existing SFC-licensed VATPs. This includes detecting the origin and destination of VA transfers, monitoring counterparties on an ongoing basis using technologies like blockchain analytic tools. Additionally, client VAs must be held with licensed or registered VA custodians in Hong Kong.
• Licensees or registrants shall also adhere to the AML/CFT requirements stipulated in Schedule 2 to the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (“AMLO”) relating to CDD and record-keeping.

The SFC will only grant a licence or registration if all regulatory requirements are met, including:

• Financial resources: Minimum paid-up share capital of HK$5 million (except for banks), minimum liquid capital of up to HK$3 million (depending on the business model), and excess liquid capital equivalent to at least 12 months of operating expenses.
• Knowledge and experience: Proper corporate governance structure staffed by personnel with relevant regulatory knowledge and experience.
• Risk management: Risk management policies to manage ML/TF and other business risks that are commensurate with the scale and complexity of its business.
• Financial reporting: Observe auditing and disclosure obligations and submit audited accounts (except for banks).
• Conduct of business: Acting honestly, fairly, with due skill, care and diligence and in clients’ best interests while complying with all statutory and regulatory requirements.
• Information and notifications: Timely submission of up-to-date information such as wallet addresses used, scope and nature of business, and the types of services provided.
• Record keeping: Proper maintenance of records of its business activities that are accessible by regulators.
• Client asset protection: Client assets should be properly protected and segregated, potentially with licensed VA custodians in Hong Kong.
• Investor protection: Put in place appropriate investor protection measures such as conducting clients risk assessment and profiling, setting exposure limits, checking clients’ suitability, and managing conflict of interest.

• No deeming arrangement: Existing VA dealing service providers will not be automatically registered under the new regime. The licensing requirements will take full effect on the commencement date of the relevant statutory provisions. This appears to be aimed at preventing unscrupulous market players taking advantage of the deeming arrangement and creating confusion to the public. 
• Open-ended licence: Upon satisfying all the requisite requirements, VA dealing service providers will be granted an open-ended licence or registration, which would remain valid unless and until revoked by the regulator.
• Expedited application process: Licence and registration applications of entities that (i) have undergone assessments from the SFC or the HKMA in relation to their VA dealing services and (ii) are already engaged in the provision of such services can benefit from an expedited approval process that will be introduced in the future.

• Scope of regulation: Any person carrying on a business in Hong Kong of providing VA custodian service, i.e. by way of business, the safekeeping of (i) VAs on behalf of clients or (ii) instruments enabling transfer of VAs of clients (including, without limitation, private keys, smartcards, and authentication credentials for accessing private keys) on behalf of clients. Self-custody of one’s own VAs would not be caught under the proposed regime.
• Entities regulated: These include without limitation.
• Entities not regulated / exempted: These  include:
  • bank security vaults and security companies storing encrypted or deactivated back-up of private keys; and 
  • technical service providers that do not directly safekeep private keys (e.g. communication or IT network providers).
  • Incidental exemptions: Depending on the finalised definition of “VA custodian service”, SFC- or HKMA- regulated entities may be exempted from the proposed licensing requirements if (i) the safekeeping of client VAs is wholly incidental to their principal businesses and (ii) they do not hold clients’ private keys (or similar instruments) on the clients' behalf. An HKMA-licensed stablecoin issuer who carries on custody of only the stablecoin it issues for its client will also be exempted notwithstanding the safekeeping of private keys.
• The FSTB and the SFC recognise that VA custodian service providers may engage third parties (e.g. third-party technology infrastructure companies) or use multi-party cryptographic protocols (e.g. Multi Party Computation) in the course of providing their services. The regulators invite comments on the various business models, third-party involvements and technology infrastructure setups from industry participants.
• The FSTB and the SFC also invite comments on whether entities which do not safekeep private keys but arrange a third party to custody the client VAs or otherwise safekeep the private keys (such as a private fund trustee of a VA fund that delegates the safekeeping of private keys to a sub-custodian) should be required to obtain a licence. 
• It is proposed that licensed or registered entities (including fund managers) are required to use SFC-licensed or registered VA custodian service providers for safekeeping client assets.

• Eligible applicant: An applicant (except for banks and SVFs) must be (i) a Hong Kong-incorporated company with a permanent place of business in Hong Kong, or (ii) a registered non-Hong Kong company under the Companies Ordinance (Cap. 622). The applicant would also be required to have suitable premises for its storage of books and records.
• Fitness and properness: An applicant, along with its substantial shareholders and individuals carrying out VA custodian functions, must also meet the fit-and-proper criteria as prescribed by the SFC.
• Appointment of responsible officers: An applicant is required to designate at least two regulator-approved responsible officers or executive officers (as appropriate) to ensure adherence to AML/CFT and other regulatory requirements, who will be personally liable for breaches. All executive directors of a licensed VA custodian service provider must also be appointed as responsible officers with the SFC’s approval.

• Activities permitted: Depending on the final definition of “VA custodian service”, licenced or registered providers may safekeep VAs on behalf of clients through safekeeping instruments (e.g. private keys). They may also carry out functions that are integral to VA services, such as deposit and withdrawal of VAs and execution of settlement instructions for licensed intermediaries.
• VAs for which custodian services are permitted: The proposed regime does not impose any restriction on the types of VA that licensed VA custodian service providers may offer their services for, provided that (i) ML/TF risks can be managed through robust due diligence on the token and (ii) their infrastructure can support taking the token into custody.
• Ancillary services: Services ancillary to the provision of VA custodian services (e.g. staking) may be allowed subject to the relevant regulator’s approval on a case-by-case basis and compliance with applicable SFC regulatory requirements.
• VA dealing: Unless otherwise exempted, licensed or registered VA custodian service providers seeking to provide VA dealing services (i.e. VA conversion or spot trading) will also need to apply for a licence or registration under the proposed VA dealing regime (see our summary in Section 1 above). 

• Licenced representatives and relevant individuals: Under the proposed regime, staff members who (i) perform more than a clerical role in a business function directly relating to the VA custodian service provider’s regulatory obligations or (ii) assume oversight duties of the custody functions are required to be licensed by the SFC, or be engaged as relevant individuals. 
• Responsible and executive officers: Specifically for staff members who (i) directly supervise the conduct of the custodian functions, (ii) approve instructions or transactions, and (iii) approve asset transfers, they should also obtain approval from the SFC to be responsible officers or from the HKMA to be executive officers.
• Staff not required to be licensed: Staff members of internal corporate functions, such as human resources, finance and accounting, and legal and compliance do not need to be licensed or engaged as relevant individuals.

• Appointment of third-party VA custodian service providers: VA custodians which do not safekeep private keys (or similar instruments) but appoint other VA custodian service providers, including those  regulated by the SFC or overseas regulators, are expected to follow standards similar to those imposed on depositaries of SFC-authorised funds licensed for Type 13 regulated activity, (if it is decided that they should be licensed). In particular, robust internal controls must be established for oversight of the delegates or third parties.
• Safekeeping private keys: Apart from requirements regarding segregation of client VAs and staff competence, VA custodian service providers that safekeep private keys must meet strict requirements on private key management, cybersecurity and business continuity planning. These standards will align with those for SFC-licensed VATPs and will be finalised upon a separate public consultation.
• AML: Licensees or registrants shall also adhere to the AML/CFT requirements stipulated in Schedule 2 to the AMLO relating to CDD and record-keeping.

The SFC will only grant a licence or registration if all regulatory requirements are met, including:

• Financial resources: Minimum paid-up share capital of HK$10 million and minimum liquid capital of up to HK$3 million (depending on the business model). Additional financial requirements tied to operating expenses and/or the scale of business activities may be introduced. A separate consultation will be conducted with respect to compensation and insurance arrangement, custodial infrastructure and internal control requirements.
• Knowledge and experience: Proper corporate governance structure staffed by personnel with relevant regulatory knowledge and experience.
• Risk management: Risk management policies to manage ML/TF, cybersecurity and other risks (e.g. system failure) that are commensurate with the scale and complexity of the business.
• Financial reporting and disclosure: Observe auditing and disclosure obligations and publish audited accounts (except for banks).
• Conduct of business: Acting honestly, fairly, with due skill, care and diligence and in clients’ best interests while complying with all applicable statutory and regulatory requirements.
• Information and notifications: Timely submission of up-to-date information such as wallet addresses used, scope and nature of business, and the types of services provided.
• Record keeping: Proper maintenance of records of its business activities that are accessible by regulators.

• No deeming arrangement: Similar to the proposed VA dealing licensing regime, there will be no deeming arrangement for existing VA custodian service providers. The licensing requirements will take full effect on the commencement date of the relevant statutory provisions. Industry stakeholders are encouraged to reach out to the SFC or the HKMA.
• External assessment: Similar to the swift licensing process for VATPs, VA custodian service providers that safekeeping private keys must engage an external assessor to perform a post-deployment assessment of their policies, systems, controls, and procedures. The assessment shall be conducted as a direct assurance engagement with the SFC involved as a party to the engagement.
• Expedited application process: Licence and registration applications of entities that (i) have undergone assessments from the SFC or the HKMA in relation to their VA custodian services and (ii) are already engaged in the provision of such services can benefit from an expedited approval process that will be introduced in the future.