VATP regulation in Hong Kong: The journey so far

Hong Kong is a virtual asset hub, with a number of businesses operating in and from Hong Kong or targeting the Hong Kong market. In the first of a series of articles, Pádraig Walsh from the Fintech practice group of Tanner De Witt reviews the regulatory journey to the current regulation of virtual asset trading platforms in Hong Kong.

Context

The history of cryptocurrency typically starts with the origin story of Satoshi Nakamoto, followed by the murky beginnings of the Silk Road marketplace, through the wild west ICO days, the rise of crypto titans, and to the nascent mainstream integration and institutionalisation of cryptocurrency. A hero’s journey.

But there is another storyline. This is the story of regulation. It does not have the same highs and lows. Rather it is a story of pragmatic evolution and sometimes slow progress. It is a story worth telling. It is the story of the turtle, not the hare.

International regulatory developments

The story of the regulation of virtual asset service providers (VASPs) has its roots in measures to combat money laundering and terrorist financing. These areas of regulation require an international approach. Bad actors using emerging technologies for illicit purposes will often use jurisdictional forum shopping as one of their strategies. International organisations such as the Financial Action Task Force (FATF), International Organisation of Securities Commissions (IOSCO), Financial Stability Board (FSB), Bank of International Settlements (BIS) and International Monetary Fund (IMF) have all looked at cryptocurrency. For quite a long time.

FATF

FATF began to focus on virtual assets in 2014,[1] which led to formal guidance on virtual currencies issued in 2015. [2] A key element of the 2015 guidance was the focus on the on and off ramps to traditional finance systems. This theme has remained constant since then, and has been supplemented by the rapid evolution of a variety of business models, including transactions entirely within the virtual domain.

FATF introduced the terms virtual asset and virtual asset service provider (VASP) to the vernacular in 2018, and made clear that FATF standards for anti-money laundering (AML) and counter-terrorist financing (CTF) applied to VASPs, including in respect of virtual-to-virtual transactions. Since then, there have been regular recommendations,[3] guidance notes and reports to provide detailed analysis on how to apply AML and CTF measures to virtual assets. These explained the application of a risk-based approach to virtual asset activities, and in particular, recommended licensing or registration systems for effective regulation and supervision.

This culminated in the publication of the Updated Guidance: A Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers in October 2021. This comprehensive paper included a detailed outline of FATF expectations on customer due diligence, record-keeping, transfers and the travel rule, and suspicious transaction reporting.

The work of FATF has been the main driver behind regulatory developments for virtual assets globally, including Hong Kong. As a global financial centre, it will always be vital for Hong Kong to be seen as contributing to and leading regulatory developments that provide enhanced AML and CTF measures. This context helps to explain why the legislative changes to enable the regulation of VASPs in Hong Kong appear in the Anti-Money Laundering and Counter-Terrorist Financing Ordinance[4] (AMLO). Regulators have viewed virtual assets through the lens of AML and CTF from the outset.

Other international bodies

The emergence of virtual assets attracted the interest and engagement of numerous other international bodies.

IOSCO first reported on distributed ledger technology in 2017.[5] IOSCO specifically addressed virtual asset trading platforms (VATPs) in its Consultation Report in 2019,[6] and identified key risk areas such as customer onboarding, custody, conflicts of interest and market integrity. In 2022, IOSCO established a board-level fintech task force, with a brief that included developing and implementing a regulatory agenda for virtual assets – dividing the work between crypto and digital assets (CDA) and decentralised finance. The CDA committee has produced a consultation report inviting responses to a comprehensive range of regulatory measures applying to VASPs.[7] The report highlights the global nature and unique characteristics of the market for virtual assets, and the need to robust regulatory standards and international regulatory co-operation. IOSCO is ultimately seeking optimal consistency in how virtual asset and securities markets are regulated, in accordance with the principle of “same activities, same risks, same regulatory outcomes”. This is a phrase the SFC in Hong Kong has often repeated.

IOSCO is of particular interest because in the period between 2016 and 2022, the CEO of the SFC in Hong Kong, Ashley Alder, also held the role of chair of the board of IOSCO. So, during the rapid emergence of virtual assets as an asset class of regulatory concern, the person chairing IOSCO was also leading the SFC.

The FSB, an international body formed by the G20, monitors and gives recommendations on the global financial system. The FSB reviewed the implications of virtual assets for financial stability in a report published in 2018,[8] noting the reputational risks to financial institutions and their regulators, risks arising from exposures of financial institutions, and risks arising if virtual assets become widely used in payments and settlement. This analysis was supplemented by a further report in 2022.[9] In the relatively short period of four years, the FSB noted that the trajectory of growth in scale and interconnectedness of virtual assets to financial institutions could have implications for global financial stability.

The BIS and the IMF have likewise been researching and publishing papers on virtual assets for a number of years.

Hong Kong regulatory developments

The sandbox

The Hong Kong story for regulation of virtual assets began in earnest with the announcement in November 2018 of a new approach to regulating virtual assets.[10] In his accompanying speech, Mr. Alder, then CEO of the SFC, introduced the topic by reference to the top priority given to virtual assets at IOSCO and the FSB. The risks associated with virtual assets referenced in the formal SFC regulatory statement,[11] were practically a name-check of the risks that were identified in earlier IOSCO and FATF papers – volatility, auditing, security and custody, market integrity, money laundering, conflicts of interest, and fraud.

A key legal challenge to regulation of virtual assets was whether and how the SFC could exercise legal jurisdiction. The remit of the SFC extended (at that time) to the regulation of securities and futures contracts. VATP operators only providing trading services for virtual assets not falling within the definition of securities were not regulated. The other driving concern was whether VATPs were suitable for regulation. The SFC noted that VATPs were technically, structurally and qualitatively different from traditional stock and futures exchanges. The particular concern here was whether AML and CFT standards could be adhered to by VATPs.

Accordingly, the SFC started with an opt-in approach for centralised VATPs that provided trading, clearing and settlement services for virtual assets, and exercised control over investors’ assets. VATPs that proceeded would undergo a minimum 12-month review period in a sandbox environment before any formal application for regulatory approval could be submitted. From the VATP perspective, not a project for the faint of heart. For the regulators, baby, but positive, steps.

VATP licences for securities

12 months is a long time in the world of virtual assets, but a short time in regulatory developments. In that relatively short period, the SFC concluded that some types of centralised virtual asset trading platforms could be held to regulatory standards similar to those required of licensed automated trading service (ATS) providers or brokers.

On 6 November 2019, the SFC announced it was open to receive applications for licences from VATPs that include “at least one security crypto asset or token for trading”.[12] The applicable legislation was the Securities and Futures Ordinance[13] (SFO), and the relevant licences were for Type 1 (dealing in securities) and Type 7 (providing automated trading services) regulated activities. The regulatory framework[14] addressed for the first time in a comprehensive set of rules topics such as custody, AML and CFT, market integrity, acceptance criteria, and insurance. The VATP could only offer services to professional investors. This was still an opt-in system.

Even for those who opted in, there were still significant gaps. The regulatory framework only applied to VATPs that traded securities. If a virtual asset traded on a licensed platform was a security token, the authorisation process for an offer of investment and the prospectus registration regime in Hong Kong would not be triggered as the token could only offered to professional investors.

This was still a bold step for the SFC. The conservative approach might have been to delay until legislative changes occurred to broaden the remit of the SFC. The SFC determined that this conservative option would not serve the public interest.

The SFC noted that the time required for processing a licensing application from a VATP may be longer than for a standard licensing application. The first licence was granted on 15 December 2020. The second licence was granted on 9 November 2022. This was a licence for the few, not the many.

AMLO

The next important development was the announcement of the legislative response to bring virtual assets that are not securities under the regulatory remit of the SFC. One of the key drivers remained the push made by the FATF toward greater regulation of the virtual asset space, particularly by adopting recommendations and standards that required jurisdictions to license VASPs to enforce the same range of AML and CTF obligations upon VASPs as apply to financial institutions.

Following a public consultation exercise, AMLO was amended to introduce the new VASP licensing regime into law. The specific virtual asset service subject to regulation was – no surprise – centralised VATPs, and the designated regulator for the new regime was – no surprise – the SFC. The changes to AMLO were gazetted on 24 June 2022 and became effective on 7 December 2022.

The legislative changes achieved the regulatory objective of having a VATP environment where substantially all cryptocurrency exchanges operating in Hong Kong must be licensed, even if they only deal with virtual assets that are not securities or futures contracts.

VATP licences for non-securities

Following a brief consultation period, the SFC announced and published its regulatory requirements for licence applications for VATPs on 1 June 2023.[15]

It is a comprehensive, prescriptive regime. Many of the notable features, though, have been present from the start. The regulatory object remains a level playing field and unified system of regulation for VATPs. The SFC specifically states that, as a virtual asset’s classification may change from a non-security token to a security token (or vice versa), VATPs should apply for licences under both the SFO and AMLO regimes. The general guidelines[16] address in detail the priority regulatory concerns of market integrity, custody of assets, insurance, and conflicts of interest. AML and CFT Guidelines[17] are extensive, and contain comprehensive guidance on customer due diligence, record-keeping, transfers and the travel rule, suspicious transaction reporting, and other AML and KYC concerns for virtual assets.

Conclusion

Hong Kong is a jurisdiction with an open-mind to virtual assets, and has public government policy statements recording its vision for Hong Kong to be a global and regional hub for virtual asset businesses.[18] The regulators in Hong Kong are recognised as being at the forefront of initiatives to prudently regulate virtual assets. This leadership has been very much in step with the international developments in virtual asset regulation, and indeed Hong Kong regulators have been instrumental in leading and developing those international initiatives.

This does not translate to a soft regulatory environment. Instead, the benchmark set by the SFC for the VATP licence approval is high. This is consistent with the status of Hong Kong as a global financial services centre. That status is only accorded to jurisdictions that apply rigorous regulatory standards that ensure market integrity and stability and provide investor protection. The VATP licensing regime has been designed to maintain Hong Kong’s global position and standing.

The SFC is mindful that granting a VATP licence is a tacit endorsement of the licence holder. Those who are licensed will attract the confidence of investors. Nonetheless, this remains a licence for the few, not the many. A VATP licence will be difficult to obtain and maintain. Deservedly so.

The VATP licensing regime in Hong Kong is not a new initiative pieced together to cast some rules around a novel market opportunity. The seeds were sewn several years ago in collaboration with international regulators, and progressed pragmatically through incremental developments, market consultations and legislative changes. It is part of a long-term vision. Regulators in Hong Kong rightly saw virtual asset market development as a marathon, not a sprint, and the role of the regulator to be the turtle, not the hare.

If you would like to discuss any of the matters raised in this article, please contact:

Pádraig Walsh

Partner | E-mail

Disclaimer: This publication is general in nature and is not intended to constitute legal advice. You should seek professional advice before taking any action in relation to the matters dealt with in this publication. This article was last updated on 1 June 2023.

---

[1] See FATF, Virtual Currencies: Key Definitions and Potential AML/CFT Risks (June 2014)

[2] See FATF, Guidance for a Risk-Based Approach to Virtual Currencies (June 2015)

[3] See in particular, FATF, Interpretive Note to Recommendation 15 (June 2019)

[4] Chapter 615, Laws of Hong Kong

[5] See IOSCO, Research Report on Financial Technologies (Fintech) (February 2017)

[6] See IOSCO, Consultation Report on Issues, Risks and Regulatory Considerations Relating to Crypto-Asset Trading Platforms (May 2019)

[7] See IOSCO, Consultation Report on Policy Recommendations for Crypto and Digital Asset Markets (May 2023)

[8] See FSB, Crypto-asset markets: Potential channels for future financial stability implications (10 October 2018)

[9] See FSB, Assessment of Risks to Financial Stability from Crypto-Assets (16 February 2022)

[10] SFC sets out new regulatory approach for virtual assets[link]

[11] See SFC, Statement on regulatory framework for virtual asset portfolios managers, fund distributors and trading platform operators [link] and the charmingly title SFC, Conceptual framework for the potential regulation of virtual asset trading platform operators [link] (both 1 November 2018)

[12] Fintech: a regulatory strategy for a dynamic industry Keynote speech at Hong Kong FinTech Week 2019 [link]

[13] Chapter 571, Laws of Hong Kong

[14] See SFC, Position paper: Regulation of virtual asset trading platforms (6 November 2019) [link]

[15] Virtual asset trading platforms operators [link]

[16] Guidelines for Virtual Asset Trading Platform Operators [link]

[17] Guideline on Anti-Money Laundering and CounterFinancing of Terrorism (For Licensed Corporations and SFC-licensed Virtual Asset Service Providers)[link]

[18] Policy Statement on Development of Virtual Assets in Hong Kong [link]