On 16 January 2025, the Securities and Futures Commission (“SFC”) announced a new, expedited licensing process for new virtual asset trading platform (“VATP”) applicants.
With the updated process, VATP applicants must implement their policies, procedures, systems, and controls before undergoing an external assessment, with the SFC supervising the process.
This new approach adopts the successful experience of the SFC in its direct engagement with “deemed-to-be-licensed” VATP applicants (“Deemed Applicants”) during risk-based on-site inspections. Read our previous article on this here.
To assist new VATP applicants, the SFC issued a circular (Circular to new virtual asset trading platforms seeking to be licensed –Enhanced licensing process and revamped external assessments) to guide new VATP applicants (“Circular on Licensing Procedures”), along with published findings from the SFC’s inspections to clarify regulatory standards (“Circular on Findings”).
1) CIRCULAR ON LICENSING PROCEDURES
The Circular on Licensing Procedures builds on the “Circular to virtual asset trading platforms on licensing process and revamped Second-phase Assessment” dated 18 December 2024 (click here to read our article on this circular).
The Circular on Licensing Procedures outlines the licensing procedure and updated external assessment for new companies seeking a licence to operate a VATP, replacing the Scope of External Assessment Reports issued in June 2023. All VATP applicants submitting license applications after 18 December 2024 should consult this Circular.
Under the improved licensing process, VATP applicants must hire an external assessor (“EA”) to conduct an external assessment after implementing all necessary systems and controls. The SFC will participate in this assessment process under a tripartite agreement among the SFC, the VATP and the EA.
Further, the SFC has updated the requirements for external assessment, emphasizing that the assessment will verify that the applicant’s policies, procedures, systems, and controls are well-designed and implemented. This assessment must be conducted as a direct assurance engagement according to relevant standards and frameworks.
Licensing procedures for new corporations applying for a VATP licence
- VATP applicants must submit their licensing application through the SFC’s WINGS platform, including:
- Written policies and procedures.
- Documentation confirming the selection of a suitable external assessor (EA).
- The EA’s capability statement.
- The SFC will evaluate the applicant’s business structure, competence, fitness and properness of the VATP applicant and its ultimate controller(s), ultimate owner(s), substantial shareholder(s), proposed responsible officer(s) and proposed Manager(s)-In-Charge, as well as the capability of the proposed EA. If the SFC finds any concerns or believes the application is incomplete, it may return the application with reasons.
- Once the application is accepted, applicants must deploy their systems and controls, including engaging external service providers for market surveillance, tools for anti-money laundering and counter-financing of terrorism and know-your-clients, implementing its custody solutions and fully adapting their policies, procedures, systems and controls (“P&P”) to ensure that they can operate as intended.
- After deployment, they must enter a tripartite agreement with the SFC and EA to assess its P&P under the external assessment, which the SFC will oversee. The VATP applicant must grant the EA unrestricted access to all relevant individuals and information.
- Most findings and issues identified by the external assessor (EA) and the SFC are expected to be addressed during the external assessment. Once the assessment and any outstanding matters, like capital injection, are completed, the SFC will issue a license if it deems the applicant fit and proper.
- A flowchart of the licensing procedures for VATP applicants is set out below:
Revamped external assessment
Based on the SFC’s observations, significant modifications to a VATP’s P&P are often necessary after implementing hardware and software solutions. Hence, the SFC now requires that the external assessment be conducted only after the VATP has deployed its systems and controls and fully adjusted its P&P to ensure proper functionality.
The EA report now needs to evaluate not only whether the VATP applicant’s P&P are appropriately designed but also confirm that the P&P are properly implemented.
The VATP applicant must promptly inform the SFC and the EA of any significant changes to its P&P.
The SFC mandates that the assessment be conducted as a direct assurance engagement and certified by a practising certified public accountant. The EA must determine if the VATP applicant’s P&P are suitably designed and implemented in accordance with the Guidelines for Virtual Asset Trading Platform Operators and the Anti-Money Laundering and Counter-Financing of Terrorism Guidelines (For Licensed Corporations and SFC-licensed Virtual Asset Service Providers) (“VATP Guidelines”).
As the external assessment will take place under a tripartite agreement between the SFC, the VATP applicant, and the EA, all parties should agree on the terms and scope before starting the assessment.
2. CIRCULAR ON FINDINGS
The SFC has conducted on-site inspections of Deemed Applicants to evaluate their compliance with regulatory requirements, including the VATP Guidelines.
The appendices to the Circular on Findings outline the expected standards of conduct for VATP operators (Appendix 1) and summarize key findings from the inspections, which concentrate on cybersecurity measures, client asset protection, and know-your-client processes (Appendix 2).
The SFC has reminded all platform operators — SFC-licensed, deemed applicants, and other VATP applicants — to ensure effective business operations through proper resource allocation and procedures. They must hire fit and proper staff with relevant qualifications and experience. Specifically, operators should deploy adequately qualified staff, expertise, technology, and financial resources to effectively design, develop, and manage their trading and custody systems.
Given the regulatory requirements and the SFC’s observations, platform operators must thoroughly review their policies, procedures, systems, and processes, taking immediate steps to address any shortcomings identified.
