The New Hong Kong Regulatory Framework for Crypto Exchanges: 10 Things You Need to Know!

On 6 November 2019, the Hong Kong Securities and Futures Commission (SFC) issued guidance on the regulation of crypto exchanges. If you don’t have time to read the 60+ pages of the new framework, here are the 10 things you need to know: 

1. Can a crypto exchange get regulated in Hong Kong?

Yes. A crypto exchange that operates in Hong Kong and offers trading of at least one security token on its platform would fall within the jurisdiction of the SFC and require Type 1 (dealing in securities) and Type 7 (providing Automated Trading Services) licenses. Subject to meeting other licensing requirements, including the fit and proper criteria, the SFC may then grant a licence.

2. What type of crypto exchanges can get regulated?

Initially, the SFC will only focus its efforts on regulating centralised crypto exchanges (e.g. platforms which provide trading, clearing and settlement services for digital assets, and have control over investors’ assets)

The SFC will not accept licensing applications from decentralised exchanges (e.g. platforms which only provide a direct peer-to-peer marketplace for transactions by investors who typically retain control over their own crypto or fiat assets). 

3. Is being regulated mandatory? 

No. The framework is essentially an opt-in to regulation. 

By way of background, it is important to understand that the SFC has no jurisdiction to grant a licence to or supervise a platform that only trades non-security digital assets or tokens.

This means that if a crypto exchange only offers digital assets that are not securities (e.g. cryptocurrencies, utility tokens), it can continue to operate as an entirely unregulated business and the SFC openly acknowledges this reality. 

However, if a crypto exchange decides to include at least one security (which will give the SFC jurisdiction), then it can apply for the SFC license. 

4. What type of clients can such a regulated crypto exchange have?

It is important to note that a regulated crypto exchange can only provide services to professional investors. For individuals, being a professional investor generally means having a portfolio of not less than HK$8 million (approx. US$1 million) and for corporations, a portfolio of not less than HK$8 million (approx. US$1 million) or total assets of not less than $40 million (approx. US$5 million).

There are no such restrictions for crypto exchanges that decide not to get regulated and will only offer digital assets that are not securities.

5. What are the obligations of a regulated crypto exchange?

A crypto exchange, upon becoming licensed, will be a “licensed corporation” and must comply with the relevant legal and regulatory provisions applicable to other licensed corporations (e.g. Securities and Futures Ordinance and its subsidiary legislation, Code of Conduct and guidelines, circulars and FAQ published by the SFC)

In addition to these existing requirements, the SFC has included additional requirements, called the “Licensing Conditions and Terms and Conditions for Virtual Asset Trading Platform Operators” (Terms and Conditions) which are drafted to address the unique features of digital assets and blockchain/DLT technology. 

6. What are some these specific requirements?

There are numerous requirements drafted in the Terms and Conditions to address the unique features of digital assets. These include:

• Hot and cold wallets - a crypto exchange needs to store 98% of client digital assets in cold wallets and limits its holdings of client digital assets in hot wallets to not more than 2%. 
• Hard and soft forks - a crypto exchange is expected to have detailed procedures to deal with events such as hard forks or air drops from an operational and technical point of view.
• Insurance - a crypto exchange needs to ensure that an insurance policy covering the risks associated with the custody of digital assets held in both hot storage (full coverage) and cold storage (a substantial coverage, eg, 95%) is in effect at all times.
• Key management - a crypto exchange needs to set up and implement strong internal controls and governance procedures for private key management to ensure all cryptographic seeds and keys are securely generated, stored and backed up.
• KYC and AML - a crypto exchange needs to comply with all relevant KYC requirements and take all reasonable steps to establish the true and full identity of each of its clients, their financial situation, investment experience and investment objectives. It also needs to establish and implement adequate and appropriate AML/CFT policies, procedures and controls.
• Customer education - a crypto exchange needs to ensure that their client has sufficient knowledge of digital assets, including knowledge of the relevant risks, before providing any services. If the client does not possess such knowledge, it may only provide services after providing training.  
• Client suitability - a crypto exchange needs to set trading limits, position limits or both with reference to the client’s financial situation to ensure that the client has sufficient net worth to assume the risks and bear the potential trading losses. 
• Policies and controls - a crypto exchange needs to establish and implement written policies and controls for the proper surveillance of activities on its platform in order to identify, prevent and report any market manipulative or abusive trading activities. 
• Audit - a crypto exchange needs to select and appoint auditors for its financial statements, and should have regard to their experience and track record in auditing digital asset related businesses and their capability to audit a crypto exchange.
• Funding - a crypto exchange should require customers to pre-fund their accounts and is prohibited from providing any financial accommodation for clients to acquire digital assets. 
• Conflicts of interest - a crypto exchange should also have a policy governing employees’ dealings in digital assets to eliminate, avoid, manage or disclose actual or potential conflicts of interest.
• Due diligence - a crypto exchange should perform all reasonable due diligence on all digital assets before including them on its platform for trading, and ensure that they continue to satisfy all application criteria. 
• Legal opinions - a crypto exchange should obtain and submit to the SFC written legal advice in the form of a legal opinion or memorandum on the legal and regulatory status of every digital asset that will be made available in Hong Kong, in particular, whether that digital asset falls within the definition of “securities” under Hong Kong laws.

7. How much time could the application process take? 

In the author's personal experience, a “traditional” regulatory application (not for digital assets) for Type 1 and 7 SFC licenses could easily take 6 to 9 months. This estimate may vary tremendously depending on a broad range of factors from the readiness of the applicant to the back and forth with the regulators. 

Whilst it is impossible to give an accurate estimate for the timeline of the licensing of a crypto exchange, the SFC has mentioned that the process may be longer than for a standard licensing application.

8. What are the considerations of being regulated?

Any regulatory licensing process is never easy and there are many considerations. For example, a crypto exchange can take the view that the SFC’s regulatory expectations are too difficult or too costly, and that they would much rather continue as an entirely unregulated business. 

There are some practical considerations as well. For example, once regulated, the SFC rules will apply to all the operations of the crypto exchange, even if the vast majority of other digital assets traded on the platform are not securities. In addition, a crypto exchange, upon becoming licensed, will be placed in the SFC Regulatory Sandbox. This would typically mean more frequent reporting, monitoring and reviews. 

9. What are some of the benefits of being regulated?

There are, of course, numerous benefits of being regulated including the ability to mention to clients that your exchange is a supervised business, which will allow investors to distinguish easily between regulated and unregulated crypto exchanges. Being regulated may also allow you to accept institutional players as clients for whom dealing only with regulated counterparties is often a requirement. 

Also, the licensing process may ensure that the exchange has in place the proper institutional infrastructure and, through the close supervision of the SFC Sandbox, the SFC may be able to highlight areas where the crypto exchange could improve its internal controls and risk management.

There are also numerous additional commercial benefits, from being able to perhaps get a higher valuation for your business from your investors to being able to more easily open a bank account. 

10. Where can you find more information?

The two main documents you should read are the SFC's policy on crypto exchanges that was highlighted in a recent speech and the SFC’s position paper, that includes the Terms and Conditions, that is available here and contains all the relevant details.

The author can be reached at Henri.Arslanian@hk.pwc.com

*Please note that this article reflects the author’s personal views and should not be seen as legal or regulatory advice.

About the author:

Henri Arslanian is the PwC Global Crypto Leader, the Chairman of the FinTech Association of Hong Kong and an Adjunct Associate Professor at the University of Hong Kong where he teaches the first FinTech university course in Asia.

Henri leads PwC’s crypto efforts and advises many of the world’s leading crypto exchanges, funds, custodians and token issuers on a broad range of crypto matters from regulatory and tax to governance and capital raising. He also advises many of the world’s leading financial institutions on their crypto initiatives as well numerous governments, regulators and central banks on crypto regulatory and policy matters

With over 500,000 LinkedIn followers, Henri is a TEDx and global keynote speaker, a best-selling published author and is regularly featured in global media including Bloomberg, CNBC, CNN, The Wall Street Journal and the Financial Times.

Henri was named by LinkedIn as one of the global Top Voices in Economy & Finance and is the host of the FinTechCapsules? and CryptoCapsules? social media series.

Henri has been also awarded many industry and academic awards over the years from being regularly named one of the Most Influential Individuals in FinTech in Asia to being awarded the Governor General of Canada Gold Medal for Academic Excellence. Chambers Global recent named him the “highest profile FinTech consultant in Hong Kong” and Asian Private Banker awarded him the “FinTech Changemaker of the Year” award.

Henri’s latest book “The Future of Finance: The Impact of FinTech, AI and Crypto on Financial Services” published by Palgrave Macmillan, was ranked as one of Amazon’s global top 10 best-sellers in financial services and was recognized as one of the “Best FinTech Books of All Time” by Bookauthority.

Before joining PwC, Henri was with a FinTech start-up and previously spent many years with UBS Investment Bank in Hong Kong. Henri started his career as a financial markets and funds lawyer in Canada and Hong Kong.

Other recent articles from the author include:

• 6 Key Takeaways from Facebook's Testimony on Libra
• Understanding Facebook’s Libra Cryptocurrency: 6 Things You Need to Know
• The New Regulatory Framework for Crypto Funds in Hong Kong: 10 Things You Need to Know
• Want to launch a crypto fund? 6 Things You Need to Know