Crypto Regulations in Hong Kong

Hong Kong is considered one of the most attractive crypto destinations in the world. According to the Worldwide Crypto Readiness Report, Hong Kong was the most “crypto-ready” location in 2023, topping all categories including the number of blockchain startups per 100K people and the number of crypto ATMs proportional to the population. Notably, this put Hong Kong ahead of the United States and Switzerland in the rankings. 

Nevertheless, those who want to start a crypto business in Hong Kong need to comply with fresh anti-money laundering (AML) regulations. In December 2022, the Legislative Council of Hong Kong passed an amendment to the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO), introducing a licensing regime for Virtual Asset Service Providers (VASPs). These and some other requirements, including the Travel Rule, came into force in June 2023.

Hong Kong’s measures to reinforce information dissemination and investor education are going to get more robust as the result of the JPEX scandal that occurred in September 2023. The announced measures include publishing lists on Virtual Asset Trading Platforms (VATPs), launching public campaigns to inform people about fraudulent activities, and monitoring suspicious VATPs. To do so, the government has announced the creation of a special working group with focus on such illegal activities.

Hong Kong’s new regulatory framework

Hong Kong’s updated Anti-Money Laundering Ordinance aligns with FATF Recommendation 15, under which VASPs to fall under anti-money laundering (AML) and countering the financing of terrorism (CFT) regulations, with the requirement to obtain a license from the Securities and Futures Commission (SFC). 

In May 2023, the SFC issued a circular to highlight the documents and information necessary for license applicants and provide guidance on the new regulatory requirements. This includes the: 

• Guideline on Anti-Money Laundering and Counter- Financing of Terrorism (For Licensed Corporations and SFC-licensed Virtual Asset Service Providers), which among other things, contains a chapter on virtual assets regulation. It provides guidance on money laundering risks, related regulatory requirements, and standards for addressing risk. These include risk factors that should be taken into consideration when conducting risk assessments, virtual asset-specific requirements in conducting Customer Due Diligence and ongoing monitoring, and requirements in relation to virtual asset transfers,third-party deposits, and payments.
• Guidelines for Virtual Asset Trading Platform Operators, which apply to all Platform Operators (whether they are licensed under the SFO and/or the AMLO) and provide clarification on standards and requirements expected of VA Platforms on investor protection requirements, safe custody of assets, segregation of client assets, avoidance of conflicts of interest, and cybersecurity. 
• Prevention of Money Laundering and Terrorist Financing Guideline issued by the Securities and Futures Commission for Associated Entities of Licensed Corporations and SFC-licensed Virtual Asset Service Providers, which sets out relevant anti-money laundering and counter-financing of terrorism (AML/CFT) statutory and regulatory requirements, and the AML/CFT standards which licensed corporations (LCs) and virtual asset service providers licensed by the SFC under the AMLO (SFC-licensed VAS Providers) should meet in order to comply with the statutory requirements under the AMLO and the SFO. This Guideline is intended for use by associated entities (AEs) that are not authorized financial institutions and their officers and staff.

• FAQs on licensing matters and conduct-related matters.
• Licensing Handbook for Virtual Asset Trading Platform Operators, which sets out detailed procedures on how to apply for a license as well as the relevant ongoing notifications and other applications required of them after obtaining a license.

In the Circular, the SFC also designated an e-mail address for licensing enquiries, financial returns and relevant forms, reporting of material breach and non-compliance incidents, and a dedicated SFC webpage for virtual asset activities. 

Who’s affected

According to the licensing handbook, the following activities require a license: Type 1 (dealing in securities) and Type 7 (providing automated trading services), both of which are regulated activities under section 116 of the SFO.

Regulated activities also include:

Providing a VA service under section 53ZRK of the AMLO, namely operating a VA exchange, that is to say, providing services through means of electronic facilities— 

“(a) whereby—

• offers to sell or purchase virtual assets are regularly made or accepted in a way that forms or results in a binding transaction; or
• persons are regularly introduced, or identified to other persons in order that they may negotiate or conclude, or with the reasonable expectation that they will negotiate or conclude sales or purchases of virtual assets in a way that forms or results in a binding transaction; and

(b) where client money or client virtual assets comes into direct or indirect possession of the person providing such service.”

Therefore, licensing requirements apply if:

• a corporation carries out the business activities set out above in Hong Kong
• a corporation actively markets, on its behalf or through an intermediary and whether in Hong Kong or from a place outside Hong Kong, to the public any services constituting the activities set out above if provided in Hong Kong
• an individual performs a regulated function on behalf of a  Platform Operator in relation to the activities set out above as a business. In that case, they have to be a licensed representative accredited to their principal. In addition, if they are an executive director of the Platform Operator, they need to be approved as a responsible officer

According to the AMLO, a person without a license must not:

• Carry out the business of providing any VA service
• Declare themselves as a business providing VA services

Additionally, a person who is not a licensed representative within the meaning of the Ordinance must not:

• Perform any regulated function in relation to the business of providing a VA service
• Declare themselves as an individual providing such regulated function

The amended Ordinance also prohibits unlicensed persons from advertising VA services.

Who are the regulators?

One of the main regulators in Hong Kong is the Securities and Futures Commission (SFC), which derives its investigative, remedial, and disciplinary powers from the Securities and Futures Ordinance (SFO) and subsidiary legislation. The organization sets and enforces regulations on different industries, investigates suspicious cases, and provides licenses.

Another important organization is the Hong Kong Monetary Authority (HKMA) – Hong Kong’s central banking institution. Together with the SFC, the HKMA has published regulatory approaches to Virtual Assets and Virtual Asset Service Providers. The SFC and the HKMA have jointly issued a set of updated guidelines for SFC regulated entities engaging in virtual asset-related activities in Hong Kong.

How to get licensed

Under the updated regime, crypto businesses must obtain a license from the Securities and Futures Commission, 

In line with the AMLO, here’s what the applicant should do to get licensed in Hong Kong:

• intend to provide services in Hong Kong market
• pass a ‘fit and proper’ test that involves criminal background checks, AML/CFT performance history, financial standing, educational or other qualifications, reputation, experience, character, reliability and financial integrity of the person, etc (as specified in Section 53ZRJ of the Ordinance)
• be joined by at least two persons (determined to be fit and proper for the business of providing a VA service) applying to be Responsible Officers  (particular requirements for Officers are specified in the Ordinance)
• lodge for approval of premises to be used for keeping records or documents required under the Ordinance

The following persons are fit and proper person to be associated with the business of providing the VA service:

• each director of the applicant (the company applying for the license)
• the ultimate owner (if any)

According to the AMLO, the SFC may impose any conditions on a granted license, including those relating to risk management, AML/CFT, financial resources, cybersecurity and other conditions, as specified in the details of Section 53 ZRK of the Ordinance. In June 2023, the SFC published the guidelines, as specified above, in relation to licensing requirements. 

The application must be submitted to the Commission in the specified manner and accompanied by the prescribed fee.

Regulatory requirements for licensed businesses

AML regulations for VA service businesses

The main regulations that companies need to follow are the AML Ordinance and the Guideline on Anti-Money Laundering and CounterFinancing of Terrorism. Under the Ordinance and Guidelines, crypto businesses must follow regulatory requirements including:

• Introducing AML/CTF measures:
  • Carrying out Customer Due Diligence (CDD), Simplified Due Diligence and Enhanced Due Diligence (where applicable) 
  • Carrying out transaction monitoring 
  • Implementing record-keeping
  • Screening clients against national and international sanctions and watchlists, as well as screen clients for PEP status
  • Complying with Travel Rule requirements
• Appointing an eligible auditor within 1 month after getting a licensed provider and within 7 business days after making an appointment notifying the Commission, by written notice, of the name and address of the auditor

A licensed provider must, within one month after it becomes licensed, notify the SFC, by written notice, of the date on which its financial year ends. An auditable entity must also prepare financial statements and other documents for prescribed periods and submit it together with a report of the auditor to the Commission not later than 4 months after the end of the financial year to which they relate.

A licensed person must submit an annual return and pay a prescribed fee to the commission within 1 month after each anniversary of the date of grant of the license (or by another date approved by the Commission). The person must notify the Commission in writing of any change in information that the licensed person or their ultimate owner has provided under the requirements of the Ordinance, including intended cessation of business, intention to change the address at which it proposes to provide any VA service, etc.

More detailed information regarding the requirements may be found in the Ordinance.

Travel Rule

Travel Rule obligations came into force in Hong Kong on June 1, 2023. A virtual asset transfer is a transaction carried out:

• By an institution (ordering institution) on behalf of an originator by transferring any virtual assets; and
• With a view to making the virtual assets available:
  • To that person or another person (recipient); and
  • At an institution (beneficiary institution), which may be the ordering institution or another institution, whether or not one or more other institutions (intermediary institutions) participate in completion of the transfer of the virtual assets.

For a virtual asset transfers over $8,000, the following data should be transferred to beneficiary VASP:

1. The originator’s name
2. The number of the originator’s account maintained with the financial institution and from which the virtual assets are transferred or, in the absence of such an account, a unique reference number assigned to the virtual asset transfer by the financial institution
3. The originator’s address, the originator’s customer identification number or identification document number or, if the originator is an individual, the originator’s date and place of birth
4. The recipient’s name 
5. The number of the recipient’s account maintained with the beneficiary institution and to which the virtual assets are transferred or, in the absence of such an account, a unique reference number assigned to the virtual asset transfer by the beneficiary institution

For a virtual asset transfer involving virtual assets that amount to less than $8,000, the following data should be transferred to the beneficiary VASP:

• the information obtained and held under subsection (A), (B), (D) and (E) in relation to the transfer.

An ordering institution should not execute a virtual asset transfer when it cannot ensure that the required information can be submitted to a beneficiary institution or, where applicable, an intermediary institution in a secure manner. To ensure that the required information is submitted in a secure manner, an ordering institution should undertake VA transfer counterparty due diligence measures and take other appropriate measures and controls as specified in the Guideline.

When the required information cannot be submitted to the beneficiary institution immediately, the SFC accepts submission as soon as practicable (after the virtual asset transfer) as an interim measure until 1 January 2024.

To learn more about the Travel Rule in Hong Kong, check out our Help Desk with all the necessary information.

Sanctions

The Ordinance determined a wide range of offenses. Here’s a breakdown of some of the sanctions businesses can face (for the exact list, please see the Ordinance):

Operation without a license: businesses can be fined as much as 5,000,000 HKD (640,000 USD), while senior management can face imprisonment for up to seven years, and, in the case of a continuing offense, a further fine of 100,000 HKD (12,700 USD) for every day during which the offense continues. The same will apply where an unlicensed person actively markets a VA service they provide outside Hong Kong to the Hong Kong public.

Violation of AML rules: In case of non-compliance with the statutory AML/CTF requirements, the licensed VASP and its responsible officers are liable to a fine of 1,000,000 HKD (128,000 USD) and to imprisonment for two years if convicted on indictment. They may also be subject to a range of disciplinary sanctions, including suspension or revocation of licenses, reprimand, an order to take remedial action, and a pecuniary penalty (not exceeding 10,000,000 HKD ((1,277,000 USD)), or three times the amount of the profit gained or loss avoided, whichever is the greater) for misconduct such as contravening the AML/CTF or other regulatory requirements.

Provision of false, deceptive, or misleading statements about a business’s compliance status when filing a license application: A fine of 1,000,000 HKD (127,000 USD) and imprisonment for up to two years—on summary conviction, a fine at level 6 and imprisonment for 1 year.

Offense involving fraudulent or deceptive devices in VA transactions: A fine of 10,000,000 HKD (1,277,000 USD) and imprisonment for 10 years; or on summary conviction, a fine of 1,000,000 HKD (127,000 USD) and imprisonment for 3 years.

Fraudulently or recklessly inducing others to invest in virtual assets: A fine of 1,000,000 HKD (127,000 USD) and imprisonment for 7 years—or, on summary conviction, a fine at level 6 and imprisonment for 6 months.

Offenses to destroy, conceal, or alter accounts, records, or documents: A fine of 1,000,000 HKD (127,000 USD) and imprisonment for 7 years—or, on summary conviction, a fine of 500,000 HKD (64,000 USD) and imprisonment for 1 year.

The SFC will be given broad powers to supervise AML/CTF and regulatory compliance by licensed VASPs. This will include powers to impose sanctions.

Timing and next steps

The Ordinance came into effect on June 1 2023. Under it, all affected companies have to obtain a license from the SFC. There is, however, a transitional period of one year. To be eligible for it, a Virtual Asset Trading Platforms (VATP) must have already been providing a VA service in Hong Kong before June 1, 2023. The transitional arrangements apply only to VATPs providing trading services in non-security tokens. You can learn more about the specifics of the transitional period here. 

Although there is a one year transition period, we recommend businesses to start preparing for the new regulations as soon as possible, reviewing existing AML/CTF policies and controls to identify potential gaps with the requirements.

FAQ

• Is cryptocurrency regulated in Hong Kong?

  Yes, crypto is regulated under the Anti-Money Laundering and Counter-Terrorist Financing (Amendment) Ordinance 2022. Securities and futures contracts, as well as stored value facilities, are separately regulated under the Securities and Futures Ordinance (SFO) and other regulations.

• Who regulates crypto in Hong Kong?

  The Hong Kong Monetary Authority and the Securities and Futures Commission are the two main crypto regulators in Hong Kong.

• Does a Hong Kong crypto exchange need a license?

  Yes. The new amendment to the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) introduced a licensing regime for crypto exchanges.