Hong Kong licensing regime for virtual asset exchanges to take effect on 1 March 2023

A new licensing regime for virtual asset service providers (VASPs) will come into effect on 1 March 2023 under proposed amendments to the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) (the AMLO) which were introduced to Hong Kong’s Legislative Council on 6 July 2022.[1] The proposed amendments are set out in the Anti-Money Laundering and Counter-Terrorist Financing (Amendment) Bill 2022 (Amendment Bill) which will also introduce a new registration regime for dealers in special metals and stones and other amendments addressing various technical issues raised by the Financial Action Task Force (FATF).

The legislative amendments are aimed at implementing the FATF requirements that virtual asset service providers are subject to the same anti-money laundering and counter-terrorist financing (AML/CTF) obligations as financial institutions and to a statutory licensing or registration regime. The introduction of the amendments follows the Financial Services and Treasury Bureau’s (the FSTB) public consultation which concluded in May 2021.

The FSTB has issued a Legislative Council brief summarising the proposed licensing regime. The Amendment Bill sets out certain key provisions of the new licensing regime, while the detailed regulatory requirements will be set by the SFC following a further public consultation conducted after the enactment of the amended AMLO and before its implementation.[2] 

VASP Licensing Requirement

Any person carrying on a business of providing a virtual asset service (VA service) in Hong Kong, or holding themselves out as doing so, will need be licensed as a VASP by the Securities and Futures Commission (the SFC).[3] 

It will also be an offence for a person to actively market any VA service it provides outside Hong Kong to the Hong Kong public without a VASP licence.

The only activity currently defined as “providing a VA service”[4] is operating a VA exchange, although the Secretary for Financial Services and the Treasury will be able to amend that definition by notice published in the Gazette.

Any person operating a VA exchange in Hong Kong will therefore need to apply for a licence or cease operations in Hong Kong. The Amendment Bill contains transitional provisions for operators of VA exchanges carrying on business in Hong Kong before 1 March 2023 (see below). Overseas VA exchanges will be prohibited from actively marketing their services in Hong Kong when the new regime takes effect.

Operating a VA exchange

Operating a VA exchange will be defined as providing services through means of electronic facilities:

(a)   whereby:

 (i)      offers to sell or purchase virtual assets are regularly made or accepted in a way that forms or results in a binding transaction; or

(ii)     persons are regularly introduced, or identified to others so that they can negotiate or conclude (or have a reasonable expectation of negotiating or concluding) sales or purchases of virtual assets; and

 
(b)   where client money or client virtual assets comes into the direct or indirect possession of the person providing the service.

The FSTB stated in its May 2021 Consultation Conclusions[5] (FSTB Consultation Conclusions) that the new licensing regime would not cover peer-to-peer platforms (that is platforms providing a forum where buyers and sellers of virtual assets can post bids and offers, with or without automatic matching mechanisms), provided that the actual transaction is conducted off-exchange and the exchange does not come into possession of any client money or virtual assets. Operators of peer-to-peer exchanges will therefore need to ensure that their Hong Kong operations do not bring them within the definition of a VA exchange.  

Virtual asset definition 

Virtual assets will be broadly defined as a cryptographically secured digital representation of value that:

(i)     is expressed as a unit of account or a store of economic value; 

(ii)    either:

(a)   is used, or intended to be used, as a medium of exchange accepted by the public for payment for goods or services, for the discharge of a debt and/or for investment; or 

(b)   provides rights, eligibility or access to vote on the management, administration or governance of the affairs in connection with, or to vote on any change of the terms of any arrangement applicable to, any cryptographically secured digital representation of value; and

(iii)   can be transferred, stored or traded electronically.[6]

The above definition would include Bitcoin, altcoins and, according to the FSTB Consultation Conclusions, stablecoins, irrespective of the form of the underlying assets. Governance tokens are also potentially within the scope of the above definition under paragraph (ii)(b).

The definition does not cover digital representations of fiat currencies, central bank digital currencies, financial assets already regulated under the SFO such as securities and futures contracts, stored value facilities which are separately regulated under the Payment Systems and Stored Value Facilities Ordinance (Cap. 584) or “limited purpose digital tokens” which include non-transferable, non-exchangeable and non-fungible closed-loop, limited purpose items, such as air miles, credit card rewards, gift cards, customer loyalty programmes and gaming coins. The FSTB has not indicated whether or not non-fungible tokens (NFTs) would be within the definition.

Given the rapid evolution of virtual assets, the amended AMLO will empower the SFC to prescribe characteristics that bring a crypto asset within, or exclude it from, the definition of a virtual asset by publication of notice in the Gazette. The Secretary for Financial Services and the Treasury will also be able to specify in the Gazette that a particular crypto asset, or category of crypto assets, is or is not a virtual asset.

Transitional Arrangements for Existing VA Exchanges

Existing VA exchanges operating in Hong Kong immediately before 1 March 2023 will be able to continue to operate without a VASP licence for up to 12 months (i.e. until 29 February 2024). If they want to continue operation after 29 February 2024, they will have to apply to the SFC for a VASP licence. Provided that an existing VA exchange submits its licence application to the SFC on or before 30 November 2023, the VA exchange will be able to continue to operate after 29 February 2024 under a deemed licence if its licence application is still pending until the earlier of: (i) the SFC’s grant or refusal to grant a licence; and (ii) withdrawal of the licence application. To rely on this provision, the VA exchange’s licence application must confirm that: (i) it has been providing a VA service in Hong Kong immediately before 1 March 2023; and (ii) with effect from 1 March 2024, it will comply (and will have arrangements in place to ensure its compliance) with the regulatory requirements applicable to licensed VASPs. VA exchanges considering entering the Hong Kong market should consider doing so as soon as possible in order to get the benefit of the transitional provisions.

If an existing VA exchange withdraws its licence application or is refused a VASP licence, it will have three months to close down its business in Hong Kong. During the closing-down period, a VA exchange’s activities must have the sole purpose of closing down its VA business. A VA exchange can apply to the SFC for an extension of the closing-down period. The application must be made in writing within the closing-down period.

The amended AMLO will include similar transitional provisions for individuals who provide VA services on behalf of a VA exchange operating in Hong Kong immediately before 1 March 2023.

The SFC will be able to issue a notice to any licence applicant it considers unsuitable for licensing informing them that they will not have deemed licensed status.

VASP Licensing Requirements

Eligibility for VASP licensing

Hong Kong incorporated companies which have a permanent place of business in Hong Kong and overseas companies which are registered under the Hong Kong Companies Ordinance (Cap. 622) will be eligible to be licensed as VASPs.[7] Businesses without a separate legal personality (such as partnerships and sole traders), individuals and overseas companies that are not registered in Hong Kong will not be able to obtain a VASP licence.

Appointment of Responsible Officers

VASP licensing applicants will be required to appoint at least two responsible officers who will be generally responsible for overseeing the operation of the licensed VASP and ensuring compliance with the AML/CTF and other regulatory requirements. The requirements for the responsible officers of VASPs mirror those for the responsible officers of licensed corporations under the SFO and require that:

• at least one responsible officer must be an executive director of the VASP;
• if the VASP has more than one executive director, they must all be appointed as responsible officers;
• at least one responsible officer must be ordinarily resident in Hong Kong; and
• at least one responsible officer must be available at all times to supervise the business of the VA service.

Licensed Representatives

Individuals who will provide VA services on behalf of a VASP, including those who will be its responsible officers, will need to be approved by the SFC as licensed representatives accredited to the VASP.

Fit and proper test

An applicant for a VASP licence, its responsible officers, licensed representatives, directors and ultimate owners will be required to satisfy a fit and proper test. “Ultimate owner” is defined to include any individual who owns or controls (directly or indirectly) more than 25% of the issued share capital of the VASP; controls more than 25% of the voting rights at its general meetings; or controls its management.

The factors which the SFC will take into consideration in determining whether a person is fit and proper are modelled on the fit and proper requirements for licensed corporations, their responsible officers and licensed representatives under the SFO. They include: the person’s financial status or solvency, their educational or other qualifications and experience; evidence of their competence, honesty and financial integrity; their conviction in Hong Kong or elsewhere for any money laundering or terrorist financing offence or other offence involving fraudulent, corrupt or dishonest conduct; and failure to comply with the AML/CTF obligations or other obligations of licensed VASPs. 

SFC approval of premises

Applicants for a VASP licence will have to seek the SFC’s approval of the premises to be used for keeping records or documents required to be kept under the AMLO. The premises must be non-domestic premises suitable for storing relevant documents and records.

Open-ended licences

VASP licences granted by the SFC will be open-ended – i.e. they will continue unless revoked by the SFC (for example because of misconduct or the VASP ceasing operations).

Obligations of Licensed VASPs

Compliance with AML/CTF requirements

Licensed VASPs will be subject to the AML and CTF requirements of the AMLO, including the customer due diligence and record-keeping requirements set out in Schedule 2 of the AMLO. In the case of non-compliance by a VASP with the statutory AML and CTF obligations, both the VASP and its responsible officers will commit an offence carrying maximum penalties of a HK$1 million fine and two years’ imprisonment (or seven years’ imprisonment if the non-compliance is committed with intent to defraud).   

Licensing conditions

Licensed VASPs will have to comply with a stringent set of requirements which the SFC will impose as licence conditions. The matters that may be covered by licence conditions are broad in scope and include the VASP’s: financial resources; knowledge and experience; risk management policies and procedures; management of client assets; virtual asset listing and trading policies; financial reporting and disclosure; prevention of market manipulation and abusive activities; and avoidance of conflicts of interest.[8]

Restriction to professional investors

Licensed VASPs will only be allowed to provide services to professional investors, at least during the initial stage of the licensing regime. This restriction will not be included in the legislation, but will be imposed as a licensing condition.[9] The FSTB and SFC will monitor the market and review the position regarding retail investors as the market matures.

SFC approval of a VASP’s ultimate owner

Any person who proposes to become an ultimate owner of a licensed VASP must be approved in writing by the SFC. The SFC will need to be satisfied that the VASP will continue to be fit and proper if the ultimate owner is approved. In granting its approval, the SFC may impose conditions on the licensed VASP or the ultimate owner. A person who becomes the ultimate owner of a VASP without the SFC’s approval, without reasonable excuse, will commit an offence for which the maximum penalty is a fine of HK$1 million, two years’ imprisonment and a further fine of HK$5,000 for every day that the offence continues.

Filing of annual returns and fees                         

A licensed VASP will be required to submit an annual return and pay an annual fee to the SFC within one month of each anniversary of the date of the grant of its licence.

Auditor appointment and preparation of audited accounts  

Licensed VASPs and their associated entities (i.e. their Hong Kong incorporated wholly owned subsidiaries that receive or hold client assets) will be required to appoint an auditor within one month of the grant of the VASP licence and file audited financial statements with the SFC within four months of the end of their financial year.

Notification requirements

The SFC will need to be notified of various matters including:

• any change in any information provided by the licensed VASP or its ultimate owner;
• an intention to cease business as a VA service provider;
• a change in the address at which a VA service is provided;
• a change in the VASP’s directors;
• an auditor of a licensed VASP or an associated entity ceasing to act; and
• a licensed representative ceasing to act for a licensed VASP.

Sanctions for Non-compliance or Misconduct

The amended AMLO will include various offences punishable by fines and/or imprisonment, including the following:

Carrying on a business of providing a VA service without a VASP licence

It will be an offence to carry on a business of providing a VA service in Hong Kong, or to hold oneself out as doing so, without a licence. The offence will carry maximum penalties of a HK$5 million fine and seven years’ imprisonment and a daily fine of HK$100,000 for each day that the offence continues. The same penalties will apply where an unlicensed person actively markets a VA service they provide outside Hong Kong to the Hong Kong public.

Fraudulently or recklessly inducing others to invest in virtual assets

Making a fraudulent or reckless misrepresentation to induce an acquisition or disposal of a virtual asset will be an offence whether the transaction takes place on a licensed VA exchange or not. The offence will carry maximum penalties of a HK$1 million fine and seven years’ imprisonment.

Offence involving fraudulent or deceptive devices etc. in virtual asset transactions

A person will commit an offence, if in a transaction involving virtual assets, the person: (i) employs any device, scheme or artifice with intent to defraud or deceive; or (ii) engages in any fraudulent or deceptive act, practice or business. Maximum penalties for this offence are a HK$10 million fine and 10 years’ imprisonment.

Offence to issue advertisements relating to an unlicensed person’s provision of a VA service

It will be an offence for an unlicensed person to issue, or possess for the purpose of issue, an advertisement which holds the person out as prepared to provide a VA service. The offence carries sanctions of a HK$50,000 fine and six months’ imprisonment.

SFC Powers in Respect of Licensed Virtual Asset Exchanges

The SFC will have broad supervisory powers to enforce the AML/CTF and other regulatory requirements under the revised AMLO. It will be able to enter the business premises of licensed VASPs and their associated entities to conduct routine inspections; request production of documents and records; investigate breaches and sanction licensed persons involved in the breaches. Possible sanctions include a reprimand, an order for remedial action, a fine and suspension or revocation of a person’s licence.

The SFC will also be able to appoint an auditor to conduct an investigation into the affairs of a licensed VASP and its associated entities where it has reason to believe that there has been a breach of the AMLO or any code or guideline published under it. In addition, the SFC will be given intervention powers to impose restrictions and prohibitions on the operations of a licensed VASP and its associated entities in certain circumstances, for example where it is necessary to protect client assets.