What do crypto businesses need to know about staying compliant in Hong Kong in 2023? Let’s clear things up.
Hong Kong is considered one of the most attractive crypto destinations in the world. According to the Worldwide Crypto Readiness Report, Hong Kong was the most “crypto-ready” location in 2023, topping all categories including the number of blockchain startups per 100K people and the number of crypto ATMs proportional to the population. Notably, this put Hong Kong ahead of the United States and Switzerland in the rankings.
Nevertheless, those who want to start a crypto business in Hong Kong need to comply with fresh anti-money laundering (AML) regulations. In December 2022, the Legislative Council of Hong Kong passed an amendment to the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO), introducing a licensing regime for Virtual Asset Service Providers (VASPs). These and some other requirements, including the Travel Rule, came into force in June 2023.
Hong Kong’s measures to reinforce information dissemination and investor education are going to get more robust as the result of the JPEX scandal that occurred in September 2023. The announced measures include publishing lists on Virtual Asset Trading Platforms (VATPs), launching public campaigns to inform people about fraudulent activities, and monitoring suspicious VATPs. To do so, the government has announced the creation of a special working group with focus on such illegal activities.
Hong Kong’s updated Anti-Money Laundering Ordinance aligns with FATF Recommendation 15, under which VASPs to fall under anti-money laundering (AML) and countering the financing of terrorism (CFT) regulations, with the requirement to obtain a license from the Securities and Futures Commission (SFC).
In May 2023, the SFC issued a circular to highlight the documents and information necessary for license applicants and provide guidance on the new regulatory requirements. This includes the:
In the Circular, the SFC also designated an e-mail address for licensing enquiries, financial returns and relevant forms, reporting of material breach and non-compliance incidents, and a dedicated SFC webpage for virtual asset activities.
According to the licensing handbook, the following activities require a license: Type 1 (dealing in securities) and Type 7 (providing automated trading services), both of which are regulated activities under section 116 of the SFO.
Regulated activities also include:
Providing a VA service under section 53ZRK of the AMLO, namely operating a VA exchange, that is to say, providing services through means of electronic facilities—
(b) where client money or client virtual assets comes into direct or indirect possession of the person providing such service.”
Therefore, licensing requirements apply if:
According to the AMLO, a person without a license must not:
Additionally, a person who is not a licensed representative within the meaning of the Ordinance must not:
The amended Ordinance also prohibits unlicensed persons from advertising VA services.
One of the main regulators in Hong Kong is the Securities and Futures Commission (SFC), which derives its investigative, remedial, and disciplinary powers from the Securities and Futures Ordinance (SFO) and subsidiary legislation. The organization sets and enforces regulations on different industries, investigates suspicious cases, and provides licenses.
Another important organization is the Hong Kong Monetary Authority (HKMA) – Hong Kong’s central banking institution. Together with the SFC, the HKMA has published regulatory approaches to Virtual Assets and Virtual Asset Service Providers. The SFC and the HKMA have jointly issued a set of updated guidelines for SFC regulated entities engaging in virtual asset-related activities in Hong Kong.
Under the updated regime, crypto businesses must obtain a license from the Securities and Futures Commission,
In line with the AMLO, here’s what the applicant should do to get licensed in Hong Kong:
The following persons are fit and proper person to be associated with the business of providing the VA service:
According to the AMLO, the SFC may impose any conditions on a granted license, including those relating to risk management, AML/CFT, financial resources, cybersecurity and other conditions, as specified in the details of Section 53 ZRK of the Ordinance. In June 2023, the SFC published the guidelines, as specified above, in relation to licensing requirements.
The application must be submitted to the Commission in the specified manner and accompanied by the prescribed fee.
The main regulations that companies need to follow are the AML Ordinance and the Guideline on Anti-Money Laundering and CounterFinancing of Terrorism. Under the Ordinance and Guidelines, crypto businesses must follow regulatory requirements including:
A licensed provider must, within one month after it becomes licensed, notify the SFC, by written notice, of the date on which its financial year ends. An auditable entity must also prepare financial statements and other documents for prescribed periods and submit it together with a report of the auditor to the Commission not later than 4 months after the end of the financial year to which they relate.
A licensed person must submit an annual return and pay a prescribed fee to the commission within 1 month after each anniversary of the date of grant of the license (or by another date approved by the Commission). The person must notify the Commission in writing of any change in information that the licensed person or their ultimate owner has provided under the requirements of the Ordinance, including intended cessation of business, intention to change the address at which it proposes to provide any VA service, etc.
More detailed information regarding the requirements may be found in the Ordinance.
Travel Rule obligations came into force in Hong Kong on June 1, 2023. A virtual asset transfer is a transaction carried out:
For a virtual asset transfers over $8,000, the following data should be transferred to beneficiary VASP:
For a virtual asset transfer involving virtual assets that amount to less than $8,000, the following data should be transferred to the beneficiary VASP:
An ordering institution should not execute a virtual asset transfer when it cannot ensure that the required information can be submitted to a beneficiary institution or, where applicable, an intermediary institution in a secure manner. To ensure that the required information is submitted in a secure manner, an ordering institution should undertake VA transfer counterparty due diligence measures and take other appropriate measures and controls as specified in the Guideline.
When the required information cannot be submitted to the beneficiary institution immediately, the SFC accepts submission as soon as practicable (after the virtual asset transfer) as an interim measure until 1 January 2024.
To learn more about the Travel Rule in Hong Kong, check out our Help Desk with all the necessary information.
The Ordinance determined a wide range of offenses. Here’s a breakdown of some of the sanctions businesses can face (for the exact list, please see the Ordinance):
Operation without a license: businesses can be fined as much as 5,000,000 HKD (640,000 USD), while senior management can face imprisonment for up to seven years, and, in the case of a continuing offense, a further fine of 100,000 HKD (12,700 USD) for every day during which the offense continues. The same will apply where an unlicensed person actively markets a VA service they provide outside Hong Kong to the Hong Kong public.
Violation of AML rules: In case of non-compliance with the statutory AML/CTF requirements, the licensed VASP and its responsible officers are liable to a fine of 1,000,000 HKD (128,000 USD) and to imprisonment for two years if convicted on indictment. They may also be subject to a range of disciplinary sanctions, including suspension or revocation of licenses, reprimand, an order to take remedial action, and a pecuniary penalty (not exceeding 10,000,000 HKD ((1,277,000 USD)), or three times the amount of the profit gained or loss avoided, whichever is the greater) for misconduct such as contravening the AML/CTF or other regulatory requirements.
Provision of false, deceptive, or misleading statements about a business’s compliance status when filing a license application: A fine of 1,000,000 HKD (127,000 USD) and imprisonment for up to two years—on summary conviction, a fine at level 6 and imprisonment for 1 year.
Offense involving fraudulent or deceptive devices in VA transactions: A fine of 10,000,000 HKD (1,277,000 USD) and imprisonment for 10 years; or on summary conviction, a fine of 1,000,000 HKD (127,000 USD) and imprisonment for 3 years.
Fraudulently or recklessly inducing others to invest in virtual assets: A fine of 1,000,000 HKD (127,000 USD) and imprisonment for 7 years—or, on summary conviction, a fine at level 6 and imprisonment for 6 months.
Offenses to destroy, conceal, or alter accounts, records, or documents: A fine of 1,000,000 HKD (127,000 USD) and imprisonment for 7 years—or, on summary conviction, a fine of 500,000 HKD (64,000 USD) and imprisonment for 1 year.
The SFC will be given broad powers to supervise AML/CTF and regulatory compliance by licensed VASPs. This will include powers to impose sanctions.
The Ordinance came into effect on June 1 2023. Under it, all affected companies have to obtain a license from the SFC. There is, however, a transitional period of one year. To be eligible for it, a Virtual Asset Trading Platforms (VATP) must have already been providing a VA service in Hong Kong before June 1, 2023. The transitional arrangements apply only to VATPs providing trading services in non-security tokens. You can learn more about the specifics of the transitional period here.
Although there is a one year transition period, we recommend businesses to start preparing for the new regulations as soon as possible, reviewing existing AML/CTF policies and controls to identify potential gaps with the requirements.
Yes, crypto is regulated under the Anti-Money Laundering and Counter-Terrorist Financing (Amendment) Ordinance 2022. Securities and futures contracts, as well as stored value facilities, are separately regulated under the Securities and Futures Ordinance (SFO) and other regulations.
The Hong Kong Monetary Authority and the Securities and Futures Commission are the two main crypto regulators in Hong Kong.
Yes. The new amendment to the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) introduced a licensing regime for crypto exchanges.