Crypto Regulations in Hong Kong [Updated February 2023]

Hong Kong is considered one of the most attractive crypto destinations in the world.

According to the Worldwide Crypto Readiness Report, Hong Kong was the most “crypto-ready” location in 2022, topping all categories including number of blockchain startups per 100K people and the number of crypto ATMs proportional to the population. Notably, this put Hong Kong ahead of the United States and Switzerland in the rankings. 

Nevertheless, those who want to start a crypto business in Hong Kong need to comply with fresh anti-money laundering (AML) regulations. In December 2022, the Legislative Council of Hong Kong passed an amendment to the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) introducing a licensing regime for virtual asset service providers (VASPs).

Let’s see what VASPs need to comply with.

The highlights

1. Hong Kong’s new regulatory framework
2. Who’s affected
3. How to get licensed
4. Regulatory requirements for licensed businesses
5. Sanctions
6. Timing and next steps
7. FAQ

Hong Kong’s new regulatory framework

Hong Kong’s updated Anti-Money Laundering Ordinance aligns with FATF Recommendation 15, which requires VASPs to fall under anti-money laundering (AML) and countering the financing of terrorism (CFT) regulations. 

Hong Kong’s new cryptocurrency regulations therefore require all VASPs to obtain a license from the Securities and Futures Commission (SFC). Without a license, a person must not:

• carry on the business of providing any VA service; or
• declare themselves as a business providing VA services

Additionally, a person, who is not a licensed representative within the meaning of the Ordinance, must not:

• perform any regulated function in relation to the business of providing a VA service;
• declare themselves as an individual providing such regulated function.

The amended Ordinance also prohibits unlicensed persons from advertising VA services.

Who’s affected

Hong Kong regulates activities related to the provision of VA services. 

According to the Ordinance, VA services include, through means of electronic facilities, the following:

“(a) whereby—

• offers to sell or purchase virtual assets are regularly made or accepted in a way that forms or results in a binding transaction; or
• persons are regularly introduced, or identified to other persons in order that they may negotiate or conclude, or with the reasonable expectation that they will negotiate or conclude sales or purchases of virtual assets in a way that forms or results in a binding transaction; and

(b) where client money or client virtual assets comes into direct or indirect possession of the person providing such service.”

Crypto trading platforms that enable trading in financial products (securities and futures contracts) don’t fall under the new licensing regime since they’re already regulated under the SFO.

Note that the new licensing regime extends to all crypto exchanges registered in Hong Kong under the Companies Ordinance (Cap. 622). These include exchanges based outside HK that actively market to Hong Kong’s citizens.

How to get licensed

Under the new regime, crypto businesses must obtain a license from the Securities and Futures Commission, Hong Kong’s regulator of securities and futures markets.

To get licensed in Hong Kong, the applicant should:

• intend to provide services in Hong Kong market;
• pass a ‘fit and proper’ test that involves criminal background checks, AML/CFT performance history, financial standing, educational or other qualifications, reputation, experience, character, reliability and financial integrity of the person, etc (as specified in Section 53ZRJ of the Ordinance);
• be joined by at least two persons (determined to be fit and proper for the business of providing a VA service) applying to be Responsible Officers   (particular requirements for Officers are specified in the Ordinance);
• lodge for approval of premises to be used for keeping records or documents required under the Ordinance.

The following persons are fit and proper person to be associated with the business of providing the VA service:

• each director of the applicant (the company applying for the license);
• the ultimate owner (if any);

The SFC may impose any conditions on a granted license, including those relating to risk management, AML/CFT, financial resources, cybersecurity and other conditions, as specified in details in the Section 53 ZRK of the Ordinance.

The application must be submitted to the Commission in the specified manner and accompanied by the prescribed fee.

Case study: Indacoin Beats Fraud and Boosts Number of Orders with Sumsub

Regulatory requirements for licensed businesses

Under the new Ordinance, crypto businesses must follow regulatory requirements including:

• Introduce AML/CTF measures:

– customer due diligence (CDD),

– transaction monitoring and record-keeping,

– screen clients against international sanctions and watchlists for PEP status

– screen clients in adverse media;

– comply with Travel Rule requirements.

• Appoint an eligible auditor within 1 month after becoming a licensed provider and within 7 business days after making an appointment notify the Commission, by written notice, of the name and address of the auditor.  

A licensed provider must, within 1 month after it becomes licensed, notify the Commission, by written notice, of the date on which its financial year ends. 

• An auditable entity must also prepare financial statements and other documents for prescribed periods and submit it together with a report of the auditor to the Commission not later than 4 months after the end of the financial year to which they relate.
• A licensed person must submit an annual return to the Commission and pay to the Commission a prescribed fee within 1 month after each anniversary of the date of grant of the license (or by another date approved by the Commission);
• Notify the Commission in writing of any change in information that the licensed person or ultimate owner has provided under the requirements of the Ordinance, including intended cessation of business, intention to change the address at which it proposes to provide any VA service, etc.

More detailed information regarding the requirements may be found in the Ordinance.

Violating these rules can be considered an offense. We’ll cover the sanctions in the next section.It should be noted that  the corresponding Legislative Council Brief mentioned plans to impose requirements on licensed VASPs at the initial stage so they may only offer services to professional investors. It is also stated there that the professional investor requirement will be imposed as a regulatory requirement made by the SFC with the power given in the AMLO. In line with SFC’s usual practice, the SFC will finalize the detailed regulatory requirements upon the enactment of the amended ordinance, and consult the sector and the public on the whole set of requirements before promulgation.

Sanctions

The Ordinance determined a wide range of offenses. Here’s a breakdown of some of the sanctions businesses can face (for the exact list, please see the Ordinance):

Operation without a license: businesses can be fined as much as 5,000,000 HKD (640,000 USD), while senior management can face imprisonment for up to seven years, and, in the case of a continuing offense, a further fine of 100,000 HKD (12,700 USD) for every day during which the offense continues. The same will apply where an unlicensed person actively markets a VA service they provide outside Hong Kong to the Hong Kong public.

Violation of AML rules: in case of non-compliance with the statutory AML/CTF requirements, the licensed VASP and its responsible officers are liable to a fine of 1,000,000 HKD (128,000 USD) and to imprisonment for two years if convicted on indictment. They may also be subject to a range of disciplinary sanctions, including suspension or revocation of licenses, reprimand, an order to take remedial action and a pecuniary penalty (not exceeding 10,000,000 HKD (1,277,000 USD), or three times the amount of the profit gained or loss avoided, whichever is the greater) for misconduct such as contravening the AML/CTF or other regulatory requirements.

Provision of false, deceptive, or misleading statements about a business’s compliance status when filing a license application: a fine of 1,000,000 HKD (127,000 USD) and imprisonment for up to two years; on summary conviction a fine at level 6 and to imprisonment for 1 year.

Offense involving fraudulent or deceptive devices in VA transactions: a fine of 10,000,000 HKD (1,277,000 USD) and imprisonment for 10 years; or on summary conviction  a fine of 1,000,000 HKD (127,000 USD) and imprisonment for 3 years.

Fraudulently or recklessly inducing others to invest in virtual assets: a fine of 1,000,000 HKD (127,000 USD) and imprisonment for 7 years; or on summary conviction, a fine at level 6 and imprisonment for 6 months.

Offenses to destroy, conceal, or alter accounts, records, or documents: a fine of 1,000,000 HKD (127,000 USD) and imprisonment for 7 years; or on summary conviction, a fine of 500,000 HKD (64,000 USD) and imprisonment for 1 year.

The SFC will be given broad powers to supervise AML/CTF and regulatory compliance by licensed VASPs. This will include powers to impose sanctions.

Timing and next steps

The Ordinance comes into effect on 1 April 2023. 

Some of the provisions, however, including licensing requirements, come into effect on 1 June 2023:

• Section 4 (in so far as it relates to the new sections 53ZRD, 53ZRE and 53ZTY);
• Section 5 (in so far as it relates to the new Schedule 3G);
• Section 6;

and a number of others.

Although there is a 180-day transition period, we recommend businesses to start preparing for the new regulations as soon as possible and reviewing existing AML/CTF policies and controls to identify potential gaps with the requirements. Then, introduce the missing elements and stay updated on future SFC guidelines.

FAQ

• Is cryptocurrency regulated in Hong Kong?

  Yes, crypto is regulated under the Anti-Money Laundering and Counter-Terrorist Financing (Amendment) Ordinance 2022. Securities and futures contracts, as well as stored value facilities, are separately regulated under the Securities and Futures Ordinance (SFO) and other regulations.

• Who regulates crypto in Hong Kong?

  The Hong Kong Monetary Authority and the Securities and Futures Commission are the two main crypto regulators in Hong Kong.

• Is Hong Kong banning cryptocurrency?

  No, cryptocurrency is not banned, and is not planned to be banned in Hong Kong. Rather, regulators are paying more attention to crypto with the new amendment recently introduced.

• Does a Hong Kong crypto exchange need a license?

  Yes. The new amendment to AMLO introduced a licensing regime for crypto exchanges.