The Securities and Futures Commission (SFC) of Hong Kong has finalized the detailed regulatory requirements for licensed virtual asset trading platform (VATP) operators. This significant development, announced on May 23, 2023, follows a consultation process that began in February of the same year. The new framework establishes a licensing regime under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) for platforms offering trading in non-security tokens, effective from June 1, 2023.
Overview of the New Regulatory Regime
The finalized guidelines mark a pivotal step in bringing clarity and security to the virtual asset ecosystem in Hong Kong. The SFC's approach aims to balance market innovation with robust investor protection and systemic risk mitigation.
Platforms intending to offer trading in security tokens must obtain separate licenses for Type 1 (dealing in securities) and Type 7 (providing automated trading services) regulated activities under the Securities and Futures Ordinance (SFO). Given the potential for virtual assets to be reclassified, the SFC recommends that VATP operators obtain licenses under both ordinances.
Key Published Guidelines
The comprehensive regulatory framework is detailed in several core documents:
- Guidelines for Virtual Asset Trading Platform Operators: Sets out operational requirements for all licensed central VATPs.
- Anti-Money Laundering and Counter-Terrorist Financing Guideline: Details AML/CFT obligations for licensed corporations and SFC-licensed VASPs.
- Guideline on Prevention of Money Laundering and Terrorist Financing for Associated Entities: Outlines requirements for entities linked to licensed platform operators.
- Disciplinary Fining Guidelines: Provides a framework for sanctions under the AMLO regime.
With the exception of the Disciplinary Fining Guidelines, these documents also apply to VATPs licensed under the SFO.
Access for Retail Investors
A landmark aspect of the new framework is the conditional allowance for licensed VATPs to serve retail investors. This access is contingent upon adherence to a stringent set of investor protection measures covering client onboarding, governance, disclosure, and token due diligence.
Defining Retail and Professional Investors
The guidelines define retail investors as those who are not institutional professional investors or qualified corporate professional investors. A qualified corporate professional investor is assessed based on three criteria:
- Possession of a suitable corporate structure with established investment procedures and controls.
- Relevant personnel having sufficient investment knowledge and experience.
- Awareness of the risks involved in virtual asset investment.
This assessment must be documented in writing and reviewed if the corporate client ceases trading for over two years. Individual professional investors, as defined under existing rules, are classified as retail investors and are entitled to the same protections.
Pre-Onboarding Requirements for Retail Clients
Before establishing a business relationship, platform operators must conduct several critical assessments:
- Knowledge Assessment: Evaluate the retail investor's understanding of virtual assets and their associated risks. Operators can only open an account if the investor possesses adequate knowledge or has been provided sufficient training.
- Suitability Assessment: Determine the suitability of virtual asset trading for the specific client by gathering information on their financial situation, investment experience, and objectives. The operator must also assess the client’s risk tolerance.
- Risk Exposure Limits: Set a reasonable upper limit on the amount of risk each retail client can assume in virtual assets, based on their financial standing. This limit must be communicated to the client and reviewed periodically.
The SFC has committed to providing further guidance on implementing these assessments through a set of Frequently Asked Questions (FAQs).
Governance and Token Due Diligence
Strong internal governance is a cornerstone of the new regulations. Licensed operators are required to establish a Token Admission and Review Committee.
Role of the Token Admission Committee
This committee, comprising senior management from core functions like business, compliance, risk management, and IT, is responsible for:
- Establishing and enforcing detailed token admission and review criteria.
- Making final decisions on listing, suspending, or delisting virtual assets.
- Regularly reviewing its policies and rules.
The committee must report to the operator's board of directors at least monthly.
General Token Admission Criteria
The SFC emphasizes that virtual assets themselves are not regulated. Therefore, the burden of due diligence falls on the platform operator. Before listing any token, licensed operators must conduct reasonable due diligence to ensure it meets their established criteria. Key factors for consideration include:
- Background of the management or development team.
- Regulatory status in Hong Kong and other jurisdictions.
- Supply, demand, market maturity, and liquidity (requiring a 12-month track record for non-security tokens).
- Technical aspects and development progress of the virtual asset.
- Market, governance, and legal risks.
- Utility and innovation of the asset, ensuring it does not appear fraudulent.
- Associated ML/TF risks.
Specific Criteria for Retail Access
To be offered to retail investors, a virtual asset must be deemed "highly liquid." This primarily means it must be a "qualified large-cap virtual asset," defined as being included in at least two accepted indices from two independent index providers.
An accepted index must be investable, objectively calculated, rules-based, and managed by a provider with relevant expertise. The index providers must be independent of each other, the platform operator, and the token issuer.
Meeting this index requirement is a minimum standard. Platform operators are expected to conduct additional due diligence to confirm the asset's actual liquidity. Furthermore, any token offered to retail investors must not be a security under the SFO, unless its public offering complies with relevant securities ordinances.
👉 Explore advanced compliance strategies for digital assets
Stablecoins will not be eligible for retail trading until a specific regulatory regime for them is established in Hong Kong, a process being led by the Hong Kong Monetary Authority (HKMA).
Additional Due Diligence Requirements
Operators must also ensure their internal systems can manage the risks of any token they list. Additionally, for assets reliant on smart contracts, an independent smart contract audit must be conducted to identify any vulnerabilities or security flaws.
Disclosure Obligations
Transparency is paramount. Licensed platform operators must provide clients with sufficient product information to make informed investment decisions. This information, which must be available on the operator's website, includes:
- Price and trading volume data.
- Information on the management or development team.
- Issuance date and key features of the virtual asset.
- Details of any connection between the platform and the asset's issuer.
- Links to the asset's official website, whitepaper, and audit reports.
- The platform's policy for handling voting rights, if applicable.
All product materials must be accurate and not false, biased, or misleading. Operators must also disclose their financial position to clients upon request.
A prominent risk disclosure statement, as set out in the guidelines, must be provided to all retail investors.
Custody of Client Assets
Client assets (both fiat currency and virtual assets) must be held through an associated entity—a subsidiary that is a licensed Trust or Company Service Provider and has notified the SFC of its status.
- At least 98% of client virtual assets must be stored in cold storage to minimize hacking risks.
- Operators must implement strict internal controls for the secure generation, storage, and backup of all cryptographic seeds and private keys. Access must be restricted to a limited number of authorized personnel in Hong Kong.
Compensation Arrangements
To protect clients from losses due to events like hacking or platform default, licensed operators must maintain SFC-approved compensation arrangements. These arrangements can consist of:
- Third-party insurance.
- Funds set aside in trust by the operator or its group.
- Bank guarantees from recognized financial institutions in Hong Kong.
This compensation must cover 100% of losses for online-stored assets and 50% for cold-stored assets. Operators must daily monitor the value of client assets under custody to ensure it does not exceed the coverage limit.
Permitted and Prohibited Activities
The framework clearly outlines what licensed VATPs can and cannot do.
Prohibited Activities Include:
- Providing financial accommodation to clients for purchasing virtual assets.
- Trading virtual asset futures contracts or derivatives.
- Using client virtual assets to generate returns (e.g., through lending or staking services).
- Offering gifts to promote specific virtual assets (fee discounts are allowed).
- Advertising specific virtual assets.
- Providing algorithmic trading services to clients.
- Engaging in proprietary trading (with limited exceptions for off-platform back-to-back trades).
- Conducting proprietary market-making activities.
- Allowing group companies to conduct proprietary trading through the platform.
The SFC noted growing institutional interest in virtual asset derivatives for hedging and may consider allowing them under a separate review in the future.
Transitional Arrangements
The new AMLO licensing regime took effect on June 1, 2023. However, a transitional period is in place for existing platforms.
- Existing Operators (Pre-June 2023): Platforms with a "meaningful and substantial presence" in Hong Kong before June 1, 2023, can continue operating without a license until May 31, 2024, provided they submit their license application by February 29, 2024.
- Deemed Licensing: Applicants who apply by the deadline will be "deemed licensed" from June 1, 2024, until their application is approved, withdrawn, or rejected.
- New Operators: Platforms not operating in Hong Kong before June 1, 2023, must obtain a formal license before commencing operations or actively marketing to Hong Kong investors.
The SFC will publish lists on its website identifying licensed platforms, deemed-to-be-licensed platforms, closing-down platforms, and unlicensed "illegal" platforms.
Application Process
The SFC encourages dual licensing under both the SFO and AMLO regimes. The application process has been streamlined, allowing for a combined application form. For existing SFO-licensed platforms, the process involves submitting additional data required under the AMLO.
A key requirement is the submission of two external assessment reports. A Phase One Report, submitted with the application, assesses the design effectiveness of the platform's proposed systems and controls. A Phase Two Report, submitted after in-principle approval, assesses the implementation and operational effectiveness of these systems, including vulnerability scans and penetration tests. Final approval is contingent on the SFC being satisfied with the Phase Two report findings.
Frequently Asked Questions
Q: Can any virtual asset trading platform now serve retail investors in Hong Kong?
A: No. Only platforms licensed by the SFC are permitted to operate, and they can only offer retail access if they comply with strict investor protection rules, including knowledge assessments, suitability checks, and risk limits for each client.
Q: What are the main custody requirements for client assets?
A: Client assets must be held by a licensed associated entity. The vast majority (98%) of client virtual assets must be stored in cold storage, and stringent controls must govern the management of private keys and seeds.
Q: What happens to existing platforms that are not licensed?
A: Existing platforms that had a presence in Hong Kong before June 1, 2023, have a transition period to apply for a license. Those that do not intend to apply must wind down their Hong Kong operations by May 31, 2024.
Q: Are stablecoins available for trading on these platforms?
A: No. The SFC has stated that stablecoins should not be offered to retail investors until a specific regulatory regime for stablecoins is enacted in Hong Kong.
Q: What is the "deemed licensing" arrangement?
A: Eligible existing platforms that submit a complete license application by February 29, 2024, will be automatically treated as licensed from June 1, 2024, until the SFC makes a final decision on their application. They must comply with all licensing rules during this period.
Q: How does the compensation arrangement work?
A: Licensed platforms must have insurance or other compensation arrangements in place to cover potential client losses from events like hacking or platform default. Coverage must be 100% for online-stored assets and 50% for cold-stored assets.
👉 Discover comprehensive resources for digital asset management