Hong Kong Crypto Regulations

Hong Kong is one of the most attractive destinations for crypto activities in the world. Hong Kong topped categories including blockchain startups per 100,000 people and crypto ATM numbers as a share of the population to rank as the number one “crypto-ready” jurisdiction in the 2023 Worldwide Crypto Readiness Report, outshining the United States and Switzerland.

Still, those looking to launch a crypto business in Hong Kong are likely to have to consider newly imposed anti-money laundering requirements. In December 2022, Hong Kong’s Legislative Council passed an amendment to the AMLO, which implemented a licensing regime for so-called Virtual Asset Service Providers. Those rules, among others such as the Travel Rule, became effective in June of this year.

The current reaction to the JPEX scandal in September 2023 is for Hong Kong to step up its dissemination of information and investor education. These may range from the published lists of Virtual Asset Trading Platforms to the launch of large-scale campaigns for the public about the frauds committed and the monitoring of suspicious VATPs. The government has announced it will set up a special working group to combat illegal activities.

Hong Kong’s updated regulatory framework is in line with FATF Recommendation 15 to bring all VASPs within the ambit of AML/CFT laws. Compliance encompasses licensing by the Securities and Futures Commission. The SFC, in May 2023, released a circular for the license applicant that lays down minimum requisite documents and information that an applicant will need to provide.

Hong Kong

Capital	Population	Currency	GDP
Hong Kong	7,400,000	Hong Kong Dollar	369,2 billion

Key components of the regulatory framework

• Guideline on Anti-Money Laundering and Counter-Financing of Terrorism: This guideline discusses virtual asset specific requirements in respect of performing Customer Due Diligence, ongoing monitoring and risk assessments relating to money laundering risks.
• Guidelines for Virtual Asset Trading Platform Operators: These are applicable for all Virtual Asset Trading Platform Operators, which outline various standards and requirements applicable to investor protection, safety custody of assets, segregation of client assets, conflict of interest avoidance, and cybersecurity.
• Prevention of Money Laundering and Terrorist Financing Guideline: This is intended for use by associated entities and outlines the AML/CFT statutory and regulatory requirements for LIs and SFC-licensed Virtual Assets Service Providers.
• FAQs on licensing and conduct-related matters
• Licensing Handbook for Virtual Asset Trading Platform Operators: This provides the detailed procedures of the license application, ongoing notifications, and additional applications required after acquisition of a license.

The SFC has also designated in the Circular an email address to which inquiries related to the licensing, financial returns, submission of relevant forms, reporting material breaches and incidents of non-compliance are to be addressed. A dedicated SFC webpage for virtual asset activities has also been created.

Who is Affected

According to the licensing handbook, the following activities entail licensing: Type 1-dealing in securities and Type 7-providing automated trading services are each a regulated activity under section 116 of the SFO.

Other regulated activities include:

Offering a virtual asset service under section 53ZRK of the AMLO-operating a VA exchange.

This covers offering services through electronic facilities where:

• Offers to sell or purchase virtual assets are regularly made or accepted, resulting in a binding transaction.
• Persons are regularly introduced or identified to others for the negotiation or conclusion of sales or purchases of virtual assets, forming a binding transaction, and where client money or client virtual assets come into direct or indirect possession of the service provider.

Consequently, licensing requirements are imposed in case:

• An incorporated body carries on the relevant business activities in Hong Kong;
• An incorporated body actively markets, either directly or through an intermediary, services which comprise the relevant activities to the public in Hong Kong or from a place of business outside Hong Kong.
• Any individual performs a controlled function for and on behalf of a Platform Operator in respect of the relevant activities as a business; If so, the individual must be a licensed representative accredited to his principal; and if he is an executive director of any Platform Operator, he must be approved as a responsible officer.
• Carry on the business of providing any VA service.
• Hold out that it carries on the business of providing VA services.

More importantly, an unlicensed person as defined by the Ordinance should not:

• Carry on any regulated function in relation to the business of providing a VA service.
• Hold out that it carries on such a regulated function.

The amended Ordinance also clearly prohibits unlicensed persons from advertising VA services.

Who are the regulators?

In Hong Kong, the SFC is the most important regulating body, empowered by the Securities and Futures Ordinance and related legislation to wield investigative, remedial, and disciplinary powers. The SFC drafts and enforces legislation for various industries, investigates suspicious cases, and issues licenses.

Another key player is the Hong Kong Monetary Authority, Hong Kong’s central bank. In concert with the SFC, the HKMA has issued regulatory stances on Virtual Assets and Virtual Asset Service Providers. Together they have published refreshed guidance for SFC-regulated firms seeking to conduct virtual asset-related activities in Hong Kong.

How the license is granted

Under the new law, virtual asset providers are required to obtain a license with the Securities and Futures Commission.

According to the AMLO requirement, here is how one applies for licensing in Hong Kong:

1. One needs to give an indication of offering services within the Hong Kong market.
2. Passing the ‘fit and proper’ test: this covers items like criminal record checks, AML/CFT performance history, financial position, academic qualification, etc., as outlined in Section 53ZRJ of the Ordinance.
3. Having at least two persons who are fit and proper for the business of operating a Virtual Asset service apply as Officers to be Responsible Officers. Matters relating to the requirements on Officers are provided in the Ordinance.
4. Approval for the premises where records or documents are kept, as required under the Ordinance.

As regards the VA business, fit and proper persons include each director of the applicant company and the ultimate owner, where applicable.

According to the AMLO, the SFC has the right to impose any condition on a licence granted, including conditions relating to risk management, AML/CFT measures, financial resources, cybersecurity, and other conditions stipulated under Section 53ZRK of the Ordinance. In June 2023, the SFC published guidelines on the licensing regime under the AMLO.

The application should be made to the Commission in the form and manner as may be provided and should be accompanied by the prescribed fee.

Compliance Requirements of Licensed Businesses in AML for Virtual Asset Service Providers

The major legislation that primarily binds the VA service providers is the Anti-Money Laundering Ordinance and the Guideline on Anti-Money Laundering and Counter-Financing of Terrorism. Consequently, crypto businesses must adhere to the regulatory prescriptions provided therein, including:

Travel Rule Compliance

The Travel Rule requirements, beginning with their June 1, 2023, effective date in Hong Kong, have to do with virtual asset transfers. Such transfers involve transactions initiated by an institution, called the ordering institution, upon request from or on behalf of an originator, for transferring virtual assets, to be made available to a recipient either as the originator or another person at a beneficiary institution. This beneficiary institution may be the same as the ordering institution or any other institution, with or without other intermediary institutions participating in completing the transfer of virtual assets.

In cases where the virtual asset transfers are equal to or greater than $8,000, the following information shall be sent to the recipient VASP:

• Name of the originator;
• Number of the account maintained with the financial institution, from which the virtual assets are transferred, or a unique reference number assigned to the virtual asset transfer in the absence of any such account.
• Originator’s address, customer identification number, identification document number, or in cases of individual originators, the originator’s date and place of birth;
• Recipient’s name;
• Number of the recipient’s account maintained with the beneficiary institution to which the virtual assets are transferred, or a unique reference number assigned by the beneficiary institution in the absence of such account.

With transfers of virtual assets below $8,000, the beneficiary VASP shall receive information obtained and held about the transfer under subsections A, B, D, and E.

An ordering institution shall not execute a virtual asset transfer if it is not in a position to ensure that the information required under this section is submitted in a secure way to the beneficiary institution or, where applicable, an intermediary institution. For the purpose of ensuring that such a submission is executed in a secure manner, the ordering institution shall conduct virtual asset transfer counterparty due diligence measures as well as take other appropriate controls provided for in the Guideline.

Where this is not possible, the SFC allows submission as soon as practicable as an interim measure for a limited period up until January 1, 2024.

Penalties

The Ordinance contains a wide range of offenses and below are some of the possible penalties of the businesses – the full list can be found at the Ordinance:

• Operating without a license: The companies will be liable to a fine of up to 5,000,000 HKD (640,000 USD), and for the senior management, imprisonment of up to seven years. In the case of a continuing offense, an extra fine of 100,000 HKD (12,700 USD) for each day will apply. Similar penalties are meant if an unlicensed entity from outside of the region actively markets a VA service to the Hong Kong public.
• Contravention of AML law and regulations: The non-compliance with the statutory requirements of Anti-Money Laundering/Counter-Terrorist Financing shall attract a fine of 1,000,000 HKD (128,000 USD) and imprisonment for two years upon indictment for the licensed Virtual Asset Service Provider and its responsible officers. The other forms of disciplinary measures may include suspension or revocation of licenses, reprimand, an order to take remedial action, and a pecuniary penalty not exceeding 10,000,000 HKD or three times the amount of the profit gained or loss avoided, whichever is greater for misconduct such as contravening AML/CTF or other regulatory requirements. Making a false statement in an application for a license; 1,000,000 HKD fine (127,000 USD) and imprisonment for two years, or on summary conviction, a fine at level 6 and imprisonment for one year. Fraudulent device in transaction involving VA: 10,000,000 HKD fine (1,277,000 USD), and imprisonment for ten years or on summary conviction, 1,000,000 HKD fine (127,000 USD) and three-year imprisonment.
• The offenses charged include: fraudulently inducing investments in virtual assets: fine of 1,000,000 HKD (127,000 USD) and imprisonment for 7 years, or on summary conviction, a fine at level 6 and imprisonment for 6 months.
• Offenses related to altering records or documents: In respect thereof, a fine of 1,000,000 HKD (127,000 USD) and imprisonment for 7 years or on summary conviction, a fine of 500,000 HKD (64,000 USD) and imprisonment for 1 year.

The SFC would, in that case, be given the significant authority to monitor AML/CTF and regulatory compliance of licensed VASPs, including the powers of sanctioning.

Timing and Next Steps

The Ordinance came into operation on 1 June 2023. Accordingly, the SFC licensing requirement will apply to all affected firms, which can enjoy a transitional period of one year. A VATP will be eligible if it has been providing a VA service in Hong Kong on or before 1 June 2023. Transitional arrangements apply only to VATPs which provide a VA trading service in non-security tokens. Please refer to here for further information on the transitional arrangement.

Notwithstanding the one-year transition period, it is the case that businesses are advised to start now in the process of getting themselves ready by revisiting existing AML/CTF policies and controls regarding their inability to meet the requirements.