Introduction: The Securities and Futures Commission (SFC) has introduced the Guidelines for Virtual Asset Trading Platform Operators, which came into force on 1 June 2023. This guide outlines the key requirements for virtual asset trading platforms or cryptocurrency exchanges seeking to obtain a VASP license in Hong Kong. Standard Kepler Limited, a trusted provider in the industry, can assist you with VASP licensing. Contact us to find out more about the process or if you have any questions regarding cryptocurrency regulation in Hong Kong.
Requirements for obtaining a VASP license in Hong Kong:
- Appoint “fit and proper” responsible officers and licensed representatives.
- Meet financial requirements: minimum paid-up share capital and liquid capital.
- Establish a token admission and review committee.
- Have written client agreements and provide necessary documents to clients.
- Ensure proper custody of client assets and maintain insurance or compensation arrangements.
- Avoid conflicts of interest and have policies for employee dealings.
- Ensure platform compliance with laws and regulations, including cybersecurity.
- Maintain proper record-keeping for at least seven years.
- Submit External Assessment Reports (EARs) during the license application process.
- Grant of the license is subject to SFC’s satisfaction with the second-phase EAR.
- The “Fit and Proper” Requirement:
To ensure compliance, platform operators must appoint responsible officers and licensed representatives who meet the “fit and proper” criteria. Factors considered include financial status, educational qualifications, relevant industry experience, and reputation. Exemptions from certain requirements may be available for individuals already licensed by the SFC. - Financial Resources and Soundness:
Platform operators are required to maintain a minimum paid-up share capital of HK$5,000,000 and ensure a sufficient level of liquid capital, either not less than HK$3,000,000 or based on the platform’s assets, liabilities, and transactions, as per the Financial Resources Rules. - Operational Arrangements for Token Admission and Trading:
Establish a token admission and review committee, comprising senior management members, to conduct reasonable due diligence before including a virtual asset for trading. Document the committee’s decisions and implement policies and procedures to prevent errors, fraud, and unauthorized activities. - Market Manipulative and Abusive Activities:
Platform operators must have written policies and controls to surveil trading activities effectively. An independent and reputable market surveillance system should be in place to identify, monitor, detect, and prevent market manipulative or abusive activities. The SFC should have access to this system for its own surveillance functions when required. - Client Agreement, Contract Notes, Monthly Statements, and Receipts:
A written client agreement with provisions required by the SFC, including a risk disclosure statement, is mandatory for each client. Platform operators should provide contract notes, monthly statements of account, and receipts to clients as required. - Custody of Client Assets:
Client assets should be held on trust through an associated entity, with virtual assets segregated from the platform operator’s assets. At least 98% of client virtual assets should be stored in secure cold storage, such as Hardware Security Module (HSM)-based cold storage, with seeds and private keys securely stored in Hong Kong. Adequate insurance or compensation arrangements should cover potential losses. - Conflicts of Interest:
Platform operators should refrain from engaging in proprietary trading in virtual assets for their own or related accounts unless permitted by the SFC on a case-by-case basis. Establish written policies governing employees’ dealings in virtual assets and virtual asset-related products. - Cybersecurity:
Ensure the platform, including the trading system and custody infrastructure, complies with applicable laws and regulations. Maintain a written contingency plan to address emergencies and disruptions, including cybersecurity incidents, related to the platform. - Record Keeping:
Proper record keeping for a minimum period of seven years is required. If any records are exclusively stored with an electronic data storage provider, prior written approval from the SFC should be sought. - External Assessment Report (EAR):
During the VASP license application process, a first-phase External Assessment Report (EAR) needs to be submitted. After receiving an approval-in-principle, a second-phase EAR focusing on the implementation and effectiveness of planned policies, procedures, systems, and controls must be provided. Grant of the license is subject to the SFC’s satisfaction with the result of the second-phase EAR.
Standard Kepler Limited can assist you in addressing the legal aspects of these reports. Contact us to find out more about VASP licensing or to inquire about cryptocurrency regulation in Hong Kong.