Hong Kong Crypto Regulations

Hong Kong stands out as one of the most enticing destinations for crypto activities globally. The Worldwide Crypto Readiness Report for 2023 positioned Hong Kong as the foremost “crypto-ready” location, excelling in categories such as the density of blockchain startups per 100,000 individuals and the proportion of crypto ATMs relative to the population. Notably, this achievement surpassed rankings for the United States and Switzerland.

However, individuals aspiring to establish a crypto business in Hong Kong must adhere to new anti-money laundering (AML) regulations. In December 2022, the Legislative Council of Hong Kong enacted an amendment to the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO), introducing a licensing framework for Virtual Asset Service Providers (VASPs). These regulations, along with additional requirements such as the Travel Rule, took effect in June 2023.

In response to the JPEX scandal in September 2023, Hong Kong is intensifying efforts to enhance information dissemination and investor education. Proposed measures include publishing lists of Virtual Asset Trading Platforms (VATPs), launching public awareness campaigns about fraudulent activities, and monitoring suspicious VATPs. To achieve this, the government has announced the establishment of a specialized working group focused on combating illegal activities.

Hong Kong’s updated regulatory framework aligns with FATF Recommendation 15, bringing VASPs under anti-money laundering (AML) and counter-financing of terrorism (CFT) regulations. Compliance involves obtaining a license from the Securities and Futures Commission (SFC). In May 2023, the SFC issued a circular outlining the necessary documents and information for license applicants, providing guidance on the new regulatory requirements.

Key components of the regulatory framework

1. Guideline on Anti-Money Laundering and Counter-Financing of Terrorism: This guideline addresses virtual asset-specific requirements for conducting Customer Due Diligence, ongoing monitoring, and risk assessments related to money laundering risks.
2. Guidelines for Virtual Asset Trading Platform Operators: Applicable to all Platform Operators, these guidelines clarify standards and requirements related to investor protection, safe custody of assets, segregation of client assets, avoidance of conflicts of interest, and cybersecurity.
3. Prevention of Money Laundering and Terrorist Financing Guideline: Intended for use by associated entities, this guideline outlines AML/CFT statutory and regulatory requirements for licensed corporations and SFC-licensed Virtual Asset Service Providers.
4. FAQs on licensing matters and conduct-related matters.
5. Licensing Handbook for Virtual Asset Trading Platform Operators: This handbook provides detailed procedures for license application, ongoing notifications, and additional applications required post-license acquisition.

In the Circular, the SFC has also designated an email address for inquiries related to licensing, financial returns, submission of relevant forms, reporting material breaches and incidents of non-compliance. Additionally, a dedicated SFC webpage for virtual asset activities has been established.

Who is Affected

According to the licensing handbook, a license is required for the following activities: Type 1 (dealing in securities) and Type 7 (providing automated trading services), both of which fall under regulated activities according to section 116 of the SFO.

Regulated activities also encompass:

Providing a virtual asset (VA) service under section 53ZRK of the AMLO, specifically operating a VA exchange. This involves offering services through electronic facilities where:

(a) offers to sell or purchase virtual assets are regularly made or accepted, resulting in a binding transaction; or

(b) persons are regularly introduced or identified to others for the negotiation or conclusion of sales or purchases of virtual assets, forming a binding transaction, and where client money or client virtual assets come into direct or indirect possession of the service provider.

Therefore, licensing requirements are applicable if:

• A corporation conducts the specified business activities in Hong Kong.
• A corporation actively markets, either directly or through an intermediary, services constituting the specified activities to the public in Hong Kong or from a location outside Hong Kong.
• An individual performs a regulated function on behalf of a Platform Operator regarding the specified activities as a business. In such cases, the individual must be a licensed representative accredited to their principal. Additionally, if they are an executive director of the Platform Operator, approval as a responsible officer is required.

Under the AMLO, a person without a license must not:

• Engage in the business of providing any VA service.
• Represent themselves as a business providing VA services.

Moreover, an unlicensed individual, as defined by the Ordinance, must not:

• Perform any regulated function in relation to the business of providing a VA service.
• Represent themselves as an individual providing such a regulated function.

The amended Ordinance also explicitly prohibits unlicensed persons from advertising VA services.

Who are the regulators?

In Hong Kong, the primary regulatory authority is the Securities and Futures Commission (SFC), empowered by the Securities and Futures Ordinance (SFO) and related legislation to wield investigative, remedial, and disciplinary authority. The SFC formulates and enforces regulations across various industries, investigates suspicious cases, and issues licenses.

Another pivotal entity is the Hong Kong Monetary Authority (HKMA), the central banking institution of Hong Kong. Collaborating with the SFC, the HKMA has outlined regulatory approaches to Virtual Assets and Virtual Asset Service Providers. Jointly, they have released updated guidelines for entities regulated by the SFC engaging in virtual asset-related activities in Hong Kong.

How to obtain a license

In accordance with the updated regulatory framework, cryptocurrency businesses must secure a license from the Securities and Futures Commission.

To comply with the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO), here’s the process for obtaining a license in Hong Kong:

1. Express the intention to provide services in the Hong Kong market.
2. Successfully pass a ‘fit and proper’ test, involving checks on criminal background, AML/CFT performance history, financial standing, educational qualifications, and other factors outlined in Section 53ZRJ of the Ordinance.
3. Include at least two individuals deemed fit and proper for the business of providing a Virtual Asset (VA) service, applying to be Responsible Officers. Specific requirements for Officers are detailed in the Ordinance.
4. Seek approval for the premises designated for keeping records or documents required under the Ordinance.

Fit and proper persons associated with the business of providing VA services include each director of the applicant company and the ultimate owner, if applicable.

According to the AMLO, the SFC has the authority to impose conditions on a granted license, encompassing aspects such as risk management, AML/CFT measures, financial resources, cybersecurity, and other specified conditions outlined in Section 53ZRK of the Ordinance. The SFC published guidelines in June 2023 regarding licensing requirements.

The application must be submitted to the Commission in the specified manner and accompanied by the prescribed fee.

Regulatory Requirements for Licensed Businesses in AML Compliance for VA Service Providers

Companies in the virtual asset (VA) service sector are bound by key regulations, primarily the Anti-Money Laundering (AML) Ordinance and the Guideline on Anti-Money Laundering and Counter-Financing of Terrorism. Under these provisions, crypto businesses must adhere to regulatory stipulations, including:

1.Implementation of AML/CTF Measures:

• Conducting Customer Due Diligence (CDD), Simplified Due Diligence, and Enhanced Due Diligence as applicable.
• Monitoring transactions.
• Establishing and maintaining record-keeping practices.
• Screening clients against national and international sanctions and watchlists, and assessing clients for Politically Exposed Person (PEP) status.
• Adhering to Travel Rule requirements.

2.Appointment of an Eligible Auditor:

• Appointing an eligible auditor within one month of obtaining a license.
• Notifying the Securities and Futures Commission (SFC) within seven business days of making such an appointment, providing details of the auditor’s name and address.

3.Financial Reporting Obligations:

• Notifying the SFC within one month of becoming licensed, specifying the date on which the financial year concludes.
• Preparing financial statements and other required documents for prescribed periods.
• Submitting the aforementioned documents, along with an auditor’s report, to the Commission within four months after the end of the financial year.

4.Annual Return Submission:

• Submitting an annual return and paying the prescribed fee to the Commission within one month after each anniversary of the license grant date (or an alternative date approved by the Commission).

5.Notification of Changes:

• Informing the Commission promptly, in writing, of any changes in information provided under the Ordinance’s requirements. This includes changes such as intended cessation of business or a planned alteration in the address for providing VA services.
• Detailed information regarding these requirements can be found in the Ordinance.

Travel Rule Compliance

The Travel Rule obligations, effective in Hong Kong from June 1, 2023, pertain to virtual asset transfers. Such transfers involve transactions initiated by an institution (ordering institution) on behalf of an originator, transferring virtual assets. These virtual assets are intended to be made available to a recipient, either the originator or another person, at a beneficiary institution. The beneficiary institution may be the ordering institution or another institution, with or without the participation of intermediary institutions in completing the transfer of virtual assets.

For virtual asset transfers exceeding $8,000, the beneficiary Virtual Asset Service Provider (VASP) must receive the following data:

• Originator’s name
• Number of the originator’s account maintained with the financial institution, from which the virtual assets are transferred, or a unique reference number assigned to the virtual asset transfer in the absence of such an account
• Originator’s address, customer identification number, identification document number, or, for individuals, the originator’s date and place of birth
• Recipient’s name
• Number of the recipient’s account maintained with the beneficiary institution, to which the virtual assets are transferred, or a unique reference number assigned by the beneficiary institution in the absence of such an account.

For virtual asset transfers involving an amount less than $8,000, the beneficiary VASP should receive the information obtained and held regarding the transfer under subsections (A), (B), (D), and (E).

An ordering institution is prohibited from executing a virtual asset transfer if it cannot ensure the secure submission of required information to the beneficiary institution or, if applicable, an intermediary institution. To guarantee secure submission, the ordering institution must conduct virtual asset transfer counterparty due diligence measures and implement other appropriate controls specified in the Guideline.

If immediate submission of required information to the beneficiary institution is not possible, the Securities and Futures Commission (SFC) allows submission as soon as practicable as an interim measure until January 1, 2024.

Sanctions

The Ordinance prescribes an extensive array of offenses, and the following details some of the penalties businesses may incur (for the complete list, please refer to the Ordinance):

• Operation without a license: Businesses can face fines of up to 5,000,000 HKD (640,000 USD), with senior management potentially receiving imprisonment for a maximum of seven years. For a continuing offense, an additional fine of 100,000 HKD (12,700 USD) may be imposed for each day the offense persists. Similar penalties apply if an unlicensed entity actively markets a Virtual Asset (VA) service to the Hong Kong public from outside the region.
• Violation of AML rules: Non-compliance with statutory Anti-Money Laundering/Counter-Terrorist Financing (AML/CTF) requirements can result in a fine of 1,000,000 HKD (128,000 USD) and imprisonment for two years upon indictment for the licensed Virtual Asset Service Provider (VASP) and its responsible officers. Disciplinary measures may also include suspension or revocation of licenses, reprimand, an order to take remedial action, and a pecuniary penalty (not exceeding 10,000,000 HKD (1,277,000 USD), or three times the amount of the profit gained or loss avoided, whichever is greater) for misconduct such as contravening AML/CTF or other regulatory requirements.
• Provision of false statements during license application: A fine of 1,000,000 HKD (127,000 USD) and imprisonment for up to two years, or on summary conviction, a fine at level 6 and imprisonment for one year.
• Fraudulent devices in VA transactions: A fine of 10,000,000 HKD (1,277,000 USD) and imprisonment for 10 years, or on summary conviction, a fine of 1,000,000 HKD (127,000 USD) and imprisonment for 3 years.
• Fraudulently inducing investments in virtual assets: A fine of 1,000,000 HKD (127,000 USD) and imprisonment for 7 years, or on summary conviction, a fine at level 6 and imprisonment for 6 months.
• Offenses related to altering records or documents: A fine of 1,000,000 HKD (127,000 USD) and imprisonment for 7 years, or on summary conviction, a fine of 500,000 HKD (64,000 USD) and imprisonment for 1 year.

The Securities and Futures Commission (SFC) will wield broad powers to supervise AML/CTF and regulatory compliance by licensed VASPs, including the authority to impose sanctions.

Timing and Next Steps

The Ordinance took effect on June 1, 2023. All affected companies are required to obtain a license from the SFC, with a transitional period of one year. To qualify, a Virtual Asset Trading Platform (VATP) must have been offering a VA service in Hong Kong before June 1, 2023. Transitional arrangements specifically pertain to VATPs providing trading services in non-security tokens. More details about the transitional period can be found here.

Despite the one-year transition period, businesses are advised to commence preparations for the new regulations promptly, reviewing existing AML/CTF policies and controls to identify potential gaps with the requirements.