SFC Issues Regulations for Licensed Crypto Exchanges

The SFC issued a Position Paper: Regulation of Virtual Asset Trading Platforms (SFC Position Paper) on 6 November 2019, setting out new regulations for licensing cryptocurrency exchanges with a strong emphasis on investor protection issues including custody of virtual assets, anti-money laundering obligations and obligations on licensed platforms to ensure that professional investors to whom they offer services have sufficient knowledge of virtual asset investments.

The SFC’s latest statement on crypto regulation comes a year after it invited crypto exchanges to enter the SFC Regulatory Sandbox in its November 2018 statement on a  Regulatory Framework For Virtual Assets Portfolios Managers, Fund Distributors and Trading Platform Operators.  For further details of the November 2018 Statement, please refer to Charltons’ 2018 newsletter.  

The SFC has now determined that crypto exchanges are suitable for licensing and is imposing a regulatory framework similar to that applicable to licensed securities dealers, with additional requirements to deal with risks specific to crypto assets.

Licensing is not however mandatory for crypto exchanges that do not trade security tokens.  The SFC’s ability to regulate crypto exchanges operating in Hong Kong is constrained by the restriction of its regulatory remit to investment products that are either “securities” or “futures contracts” as defined by the Securities and Futures Ordinance (SFO).  The SFC is thus only able to regulate activities relating to crypto assets that are “securities” as statutorily defined.  Most cryptocurrencies, such as Bitcoin and Ether, are not however securities, which means that crypto exchanges which only trade crypto assets that are not securities are not required to be licensed by the SFC, and indeed could not seek a licence if they wished to do so.  A pre-condition for licensing under the new regime is that the crypto exchange must trade at least one crypto asset which is a security (i.e. is a “security token”).

The  SFC’s Position Paper thus establishes opt-in regulation which allows platform operators to apply for a licence if they trade at least one security token.

Hong Kong Crypto Exchanges

While China banned initial coin offerings (ICOs) and exchange trading of crypto assets in 2017, Hong Kong has developed as a crypto and ICO hub.  The ICO market was particularly vibrant in 2017 and early 2018 and Hong Kong hosted a number of successful ICOs including Gatecoin which raised US$14.5 million in January 2018, Airswap which raised US$36 million in October 2017 and the OAX Foundation which raised US$18 million in July 2017.   ICO activity waned during the “crypto winter” of 2018, but dozens of crypto exchanges, including some of the world’s largest, are active in the city.  They include BTCC, Coinsuper, OKCoin, Huobi, and LakeBTC.   

A major problem facing crypto exchanges is the difficulty of opening bank accounts.  The largest banks such as HSBC and JPMorgan Chase routinely refuse basic banking services to crypto businesses, even those attracting investment from multibillion-dollar institutions such as Singapore’s sovereign wealth fund. In March 2019, Hong Kong-based crypto exchange, Gatecoin, went into liquidation after unsuccessfully seeking to recover funds lost in a dispute with a payment services provider.  Gatecoin was one of the first crypto exchanges to set up in Hong Kong and it operated here for six years before being wound up.  During that time, nine Hong Kong banks froze the company’s bank accounts, leading it to switch to a French payment service provider that ultimately failed to return Gatecoin funds linked to a large volume of transfers.  Licensing of exchanges may potentially make it easier for them to open bank accounts. 

Requirements for SFC Licensed Crypto Exchanges

The SFC Position Paper sets robust regulatory standards for licensed crypto exchanges comparable to those applicable to licensed securities brokers and automated trading venues, with additional requirements addressing the specific risks associated with crypto assets.

Licensing Conditions for Hong Kong Crypto Exchanges

The SFC will impose the following licensing conditions on crypto exchange operators (Licensees):

1. services may only be provided to professional investors;

2. the Licensee must comply with “Terms and Conditions for Virtual Asset Trading Platform Operators” (the Terms and Conditions);

3. the SFC’s prior written approval will be required for offering a new service or activity, or making a material change to an existing service or activity;

4. prior written approval of the SFC must be obtained for any plan or proposal to add a product to a Licensee’s trading platform;

5. the Licensee must provide the SFC with monthly reports on its business activities in the format prescribed by the SFC; and

6. the Licensee must engage an independent professional firm to conduct an annual review of its activities and prepare a report confirming compliance with the licensing conditions and all relevant legal and regulatory requirements.

Terms and Conditions for Hong Kong Operators of Crypto Exchanges

A condition of licensing is that the operator of the exchange or platform must comply with the Terms and Conditions. The key Terms and Conditions are set out below.

Safe custody of crypto assets

1. Trust structure

   The SFC expects a Licensee to adopt an operational structure and use technology which ensure that it can offer client protection equivalent to that provided by traditional financial institutions in the securities sector. Licensees will be required to hold client assets on trust to enhance safekeeping of client virtual assets and ensure that they are properly segregated from those of the Licensee. The SFC also expects a Licensee to make full disclosure of any material legal uncertainties to its clients, particularly as to the nature of any legal claims they may have over virtual assets traded by them on its platform.

2. Hot and cold wallets

   Licensees must store 98% of client virtual assets in “cold wallets” (i.e. where private keys are kept offline) and limit their holdings of client virtual assets in “hot wallets” (i.e. where private keys are kept online rendering them vulnerable to external threats) to no more than 2%. Licensees must also minimise transactions out of the cold wallet in which a majority of client virtual assets are held.

   Licensees are also expected to have detailed procedures to deal with events such as hard forks (i.e. a radical change to a network’s protocol that makes previously invalid blocks and transactions valid, or vice-versa), or air drops (i.e. distribution of tokens or coins to numerous wallet addresses, resulting in a larger user-base and a wider disbursement of coins) from an operational and technical point of view.

   A Licensee should also have adequate processes in place for handling requests for deposits and withdrawals of client virtual assets to guard against loss arising from theft, fraud and other dishonest acts, professional misconduct or omissions.

3. Insurance

   Licensees must have an insurance policy covering the risks associated with the custody of virtual assets held in both hot storage (full coverage) and cold storage (a substantial coverage) which is in effect at all times.

4. Private key management

   Access to and custody of a virtual asset is effected by the usage of a private key. The SFC expects a Licensee to set up and implement strong internal controls and governance procedures for private key management to ensure all cryptographic seeds and keys are securely generated, stored and backed up.

SFC Know-Your-Client (KYC) Requirements for Crypto Exchanges

The SFC requires that a Licensee takes all reasonable steps to establish the true and full identity of each of its clients, and of each client’s financial situation, investment experience and investment objectives. Before providing any services to the client, a Licensee must ensure that a client has sufficient knowledge of virtual assets, including knowledge of the relevant risks associated with virtual assets. Where a client does not possess such knowledge, a Licensee may only provide services if it has provided training to the client and enquired into the client’s personal circumstances.

Anti-money laundering and counter-financing of terrorism (AML/CFT)

Licensees are required to establish and implement adequate and appropriate AML/CFT policies, procedures and controls (AML/CFT Systems) to counter the money laundering and terrorist financing risks associated with virtual assets’ anonymity. A Licensee should also regularly review the effectiveness of its AML/CFT Systems and effect enhancements where appropriate. A Licensee can also deploy virtual asset tracking tools to trace transaction histories against a database of known addresses connected to criminal activities.

Prevention of market manipulative and abusive activities

Licensees are required to establish and implement written policies and controls for the proper surveillance of activities on its platform in order to identify, prevent and report any market manipulative or abusive trading activities. Additionally, a Licensee should adopt an effective market surveillance system, and provide the SFC access to this system to perform its own surveillance.

Accounting and auditing

A Licensee is expected to exercise due skill, care and diligence in the selection and appointment of auditors for its financial statements.

Risk management

A Licensee needs to have a sound risk management framework which enables them to identify, measure, monitor and manage the full range of risks arising from their businesses and operations. Clients should be pre-fund their own accounts, as a Licensee is prohibited from providing any financial accommodation for clients to acquire virtual assets.

Conflict of interest

A Licensee should not engage in proprietary trading or market-making activities on a proprietary basis. Should a Licensee plan to use market-making services to enhance liquidity in its market, this must be done at arm’s length and be provided by an independent external party using normal user access channels. A Licensee must also have a policy governing employees’ dealings in virtual assets to eliminate, avoid, manage or disclose actual or potential conflicts of interests.

Virtual assets for trading

Licensees will need to set up a function responsible for establishing, implementing and enforcing the rules which set out the obligations of, and restrictions on, virtual asset issuers, and the criteria for a virtual asset to be included on and/or withdrawn from its platform.

Challenges of Regulation of Cryptocurrencies in Hong Kong

While the SFC Position Statement represents a step forward in Hong Kong crypto regulation, the SFC is still unable to license or supervise platforms which only trade the many crypto assets that do not qualify as “securities” under Hong Kong law. Thus, unless new legislation is put in place to more comprehensively address the burgeoning virtual assets sector, platforms that only trade non-security crypto assets will continue to be unregulated.

To be eligible for SFC licensing, a crypto exchange must trade at least one security token i.e.  a virtual asset which has the characteristics of traditional securities: e.g. it carries rights to receive a share of profits and is thus analogous to shares, it carries a right to repayment of the purchase price and thus is similar to debt securities, or the funds raised from its sale are invested in projects on the understanding that holders will share in returns from the project.  Certain types of crypto assets whose price is linked to the value of underlying assets may also constitute “regulated investment agreements” which are also securities under the SFO.

Moreover, the new framework applies only to centralised exchanges and not to decentralised exchanges on which investors trade on a peer-to-peer basis. A key limitation which may deter crypto exchanges from seeking licences is the restriction to providing trading services only to professional investors.  Most virtual asset trading platforms operating in Hong Kong are open to retail investors and the restriction to professional investors may be unattractive to these platforms.

SFC Crypto Futures Contracts Warning

Simultaneously with the position paper, the SFC issued a statement warning investors about the risks associated with the purchase of virtual asset futures contracts, as they are largely unregulated, highly leveraged and subject to extreme price volatility.   The SFC also notes that trading platforms or persons which offer and/or provide trading services in virtual asset futures contracts without being licensed under the SFO may be in breach of that ordinance.  Virtual asset futures contracts may also constitute “contracts for differences” under the Gambling Ordinance which may be illegal unless authorised under that ordinance.