Hong Kong – SFC’s Revamped Second-Phase Assessment For Virtual Asset Trading Platforms.
On 18 December 2024, the Securities and Futures Commission (“SFC”) issued a circular outlining updates to the licensing process and the revamped Second-Phase Assessment[i] for virtual asset trading platforms (“VATPs”) in Hong Kong. These changes aim to strengthen the regulatory oversight, streamline the licensing procedures for VATPs, and enhance the operational resilience of the virtual asset industry in Hong Kong.
Proactive Engagement and Licensing Conditions
The SFC’s approach has shifted towards proactive engagement with VATP applicants. This includes direct communication with senior management and ultimate controllers during on-site inspections, and providing early and effective guidance on regulatory expectations to deemed-to-be-licensed VATPs (“Deemed Applicants”)[ii]. This collaborative approach extends to the Second-Phase Assessment, where the SFC becomes a direct participant in the Second-Phase Assessment (by for example being a party to the agreement with the VATP and the external assessor), ensuring transparency and facilitating a smoother licensing process.
Deemed Applicants must submit a rectification plan based on the inspection feedback from the SFC. The SFC will grant a conditional licence to a Deemed Applicant once the rectification plan is approved. As a licensing condition, the VATP must complete the rectifications and successfully complete a penetration test and vulnerability assessment performed by an independent third party before operating on a restricted scope of business.
The vulnerability assessment involves identifying and ranking potential vulnerabilities in the applicant’s IT environment. The penetration test includes security hardening reviews and tests on network devices, firewalls, servers, databases, wallets, and user applications. Both assessments must yield satisfactory results before the applicant can operate on a restricted scope of business. The restriction on the scope of business will be imposed as an initial licensing condition for the applicant when the SFC first grants the licence.
The restrictions or conditions typically include the following: –
- The licensee shall maintain its client virtual assets under custody to no more than USD25 million (“VA Custody Amount”) and shall immediately notify the SFC if it becomes aware that its client virtual assets under custody reaches 80% of the VA Custody Amount, after which it shall obtain the SFC’s prior written approval for any plan to increase the VA Custody Amount.
- The licensee shall only operate a centralised online virtual asset[iii] trading platform for trading of virtual assets on its platform and carry on off-platform virtual asset trading business and incidental services provided by it to its clients, and activities conducted in relation to such off-platform business.
Revamped Second-Phase Assessment
The VATP must appoint an External Assessor (“EA”) to evaluate its revised policies, procedures, systems and controls (“P&P”), including the updated procedures and controls, during the Second-Phase Assessment.
All three parties (i.e. the SFC, the VATP and the EA) must agree on the terms and scope of the tripartite agreement before commencing the assessment. The SFC, as a party to the agreement, will oversee the entire Second-Phase Assessment process, provide clarity on regulatory requirements, and offer feedback on the assessment findings.
The EA should assess whether the applicant’s P&P are appropriately designed and executed to adhere to the Guidelines for Virtual Asset Trading Platform Operators, as well as the Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations and SFC-licensed Virtual Asset Service Providers). The SFC will lift the applicant’s initial licensing conditions upon the successful completion of the Second-Phase Assessment.
The detailed licensing procedures for VATPs are outlined here. The SFC will provide further guidance early this year on the licensing process for new entities applying for a VATP licence.
Implications for VATP Applicants
The changes represent a significant increase in regulatory scrutiny. VATP applicants must demonstrate a robust commitment to cybersecurity and compliance. This necessitates:
- Proactive Approach: Engage early with the SFC and proactively address potential issues.
- Robust Internal Controls: Implement and rigorously test comprehensive P&P, ensuring alignment with SFC guidelines.
- Experienced Professionals: Engage experienced professionals to conduct the necessary assessments and ensure compliance.
- Continuous Monitoring: Promptly report any material changes to the P&P, as well as any material breaches, to the SFC and the EA during the Second-Phase Assessment.
To find out more on how Hauzen LLP can assist you obtain a VATP licence or for any help on financial regulations in Hong Kong, please contact us today.
[i] The Second-Phase Assessment will be conducted after approval-in-principle is granted. Find out more about the licensing procedures for VATPs here https://hauzen.hk/guide-to-obtaining-a-vasp-licence-in-hong-kong
[ii] The list of deeded-to-be licensed VATPs can be found on SFC’s website https://www.sfc.hk/en/Regulatory-functions/Intermediaries/Licensing/Register-of-licensed-persons-and-registered-institutions
[iii] The term “virtual asset” is as defined in the Guidelines for Virtual Asset Trading Platform Operators issued by the Commission.
