Contents
1. Introduction to the functions of Hong Kong VASP license
Hong Kong’s Virtual Asset Service Provider (VASP) licensing regime came into effect on June 2023, 6, specifically targeting virtual asset exchanges. The regime is intended to strengthen anti-money laundering (AML) and counter-terrorism financing (CFT) controls in the crypto space. Under this framework, only companies incorporated locally in Hong Kong and with a fixed place of business, or companies incorporated elsewhere but registered in Hong Kong, are eligible for a VASP license. The system emphasizes the need for adequate financial resources, risk management policies and customer asset protection measures, requiring that most customer virtual assets be kept in cold storage and ensure that these assets are separated from the exchange's assets.
Key features of the VASP licensing regime include strict controls on exchange activities, a requirement that customer assets must be held in trust, and the implementation of comprehensive measures to ensure that these assets are protected even in the event of bankruptcy. In addition, licensed exchanges are restricted from engaging in certain high-risk activities, such as derivatives trading and algorithmic trading, to reduce potential market risks.
The Hong Kong Securities and Futures Commission (SFC) has been granted significant regulatory powers over licensed VASPs, including conducting inspections, enforcing compliance, and imposing penalties for non-compliance. The system also provides for severe penalties for operating without a permit, including heavy fines and imprisonment.
2. Companies applying for a Hong Kong VASP license need to meet the following basic eligibility requirements:
- Company qualifications: Must be a company incorporated in Hong Kong or an overseas company registered under the Hong Kong Companies Ordinance and have a fixed place of business in Hong Kong.
- Registered capital: The company's paid-in capital must be more than HK$500 million, and the bank account deposit must not be less than HK$400 million; if it is a trust license, the paid-in capital is HK$300 million.
- Trust License：Wholly owned subsidiaries or affiliated companies must have a Hong Kong Trust License (TCSP) referenceTrust License (TCSP) Application.
- Responsible Officer：VASP license applicants must appoint at least 2 Responsible Officers (ROs) to oversee the operations of the VASP and ensure compliance with AML/CTF and other regulatory requirements. At least one of the responsible officers must be an executive director of the VASP and at least one of the responsible officers must ordinarily reside in Hong Kong.
- Licensed Representative: Individuals who will provide services on behalf of VASPs, including those who will be their responsible officers, need to be approved by the CSRC.
- Auditor: Auditors with experience in virtual currency business are needed.
- Suitable person：VASP applicants, responsible officers, licensed representatives, directors and ultimate owners must meet the Hong Kong Securities and Futures Commission's fit and proper criteria, which mainly examines whether they have a record of crime, fraud, or malpractice, their personal industry experience and qualifications, their personal reputation, and their financial stability.
- Record keeping: The applicant must seek the SFC’s approval for premises to be used for keeping records or documents required to be kept under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance. The premises must be non-residential premises suitable for the storage of relevant documents and records.
- business evaluation：It is necessary to appoint an external valuation expert to evaluate its business and submit the valuation expert's report to the SFC when submitting the license application and after obtaining the SFC's approval in principle.
- Insurance Requirements: You must purchase insurance of the corresponding amount, and the insurance coverage will be adjusted according to the transaction amount.
- Anti-money laundering measures: Establish an anti-money laundering system and KYC service provider.
- Client asset protection: Use cold wallets to store at least 98% of customers' virtual assets, and the seeds or private keys should be stored in Hong Kong.
- cyber security: Ensure network security and protect customer data and transactions from hacker attacks.
III. The detailed process of applying for a Hong Kong VASP license generally includes the following steps:
- Understand the application requirements: First of all, you need to understand in detail the specific requirements of the SFC (Hong Kong Securities and Futures Commission) for VASP license applications, including company qualifications, personnel requirements, compliance requirements, etc.
- Prepare application materials：Prepare relevant application materials according to SFC requirements, including but not limited to company registration certificate, business plan, compliance policy and procedure documents, financial reports, information of responsible personnel and licensed representatives, etc.
- 填写申请表格: Fill out the VASP license application form on the SFC official website and submit all required documents and information.
- Appointment of external evaluation experts：According to the SFC’s recommendation, applicants for virtual asset trading platforms need to engage external assessment experts to assess their business and submit the assessment expert’s report to the SFC when submitting the license application and after obtaining the SFC’s approval in principle.
- Submit: Submit the prepared application materials and completed application form to SFC.
- SFC Review: The SFC will conduct a detailed review of the submitted application materials and may conduct an on-site inspection or request additional information.
- Simplify dual licence applications：If the platform applies for a license under the Securities and Futures Ordinance and a VASP license at the same time, the SFC provides a simplified application procedure. You only need to submit a comprehensive application form online and indicate that you are applying for both licenses at the same time.
- Transitional arrangements: For platforms that have provided virtual asset services in Hong Kong before June 2023, 6, the SFC provides a 1-month transition period, during which they can continue to conduct business, but they need to submit a license application within the specified time.
- Comply with regulatory requirements: Throughout the application process, applicants must ensure compliance with all regulatory requirements issued by the SFC, including but not limited to proper custody of assets, KYC procedures, AML/CTF, prevention of market manipulation and illegal activities, accounting and auditing, risk management, avoidance of conflicts of interest and cybersecurity.
- License issuance: After review, SFC will issue a VASP license to qualified applicants.
IV. When applying, you need to prepare a series of key documents and information, mainly including:
- Company registration certificate: Document proving that the company has been legally registered in Hong Kong.
- Business Plan：A plan detailing how the company will operate its virtual asset services business.
- Compliance Policy and Procedure Documents: Including anti-money laundering (AML) and counter-terrorist financing (CTF) policies, customer due diligence (CDD) processes, risk assessment, suspicious transaction reporting mechanisms, etc.
- Responsible Officer (RO) information: At least two responsible officers (ROs) with experience in virtual asset services are required, and their detailed information must be provided.
- Licensed Representative Information：Individuals who will provide services on behalf of VASPs, including those who will be their responsible officers, will need to obtain relevant documents approved by the CSRC.
- Auditor's report: A report from an auditor with experience in virtual currency business is required.
- Proof of capital: Proof that the company has met the paid-in capital requirements, such as the registered capital needs to be more than HK$500 million and the working capital needs to be more than HK$300 million.
- Proof of Insurance: Proof of purchasing corresponding insurance to hedge risks. The insurance coverage will be adjusted according to the transaction amount.3.
- External evaluation report：Applicants for virtual asset trading platforms are required to hire external evaluation experts to evaluate their business and provide an evaluation report.
- Record keeping application：Proof of application for SFC approval of premises for storage of records or documents8.
- Proof of fit and proper person: Proof that the applicant, its partners, directors and ultimate owners satisfy the SFC’s fit and proper test.
- Other legal and regulatory requirements documents: Including but not limited to corporate governance structure, internal control processes, network security measures, customer asset protection policies, etc.
5. What specific compliance and reporting requirements do companies holding a Hong Kong VASP license need to comply with?
Companies holding a Hong Kong VASP (Virtual Asset Service Provider) license are subject to specific compliance and reporting requirements:
-
- Comply with laws and regulations：Comply with the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) and relevant guidelines and regulations issued by the Securities and Futures Commission (SFC) of Hong Kong.
- Customer Due Diligence (CDD): Conduct thorough customer due diligence, including but not limited to verifying customer identity, understanding the nature of the customer’s business and source of funds.
- Enhanced Due Diligence (EDD): Conduct more in-depth due diligence on high-risk customers or transactions.
- risk assessment: Regularly assess the money laundering and terrorist financing risks in business operations and develop appropriate risk mitigation measures.
- Suspicious Transaction Report: Monitor and report all suspicious transaction activities that may involve money laundering or terrorist financing.
- Record keeping: Maintain detailed records of all transactions and due diligence processes and keep them for the prescribed period.
- Internal Control and Audit: Establish an effective internal control system, including compliance policies, procedures and checks, and conduct regular internal audits.
- Staff training and awareness raising: Provide regular anti-money laundering and counter-terrorist financing training to employees to ensure they are aware of relevant regulations and internal policies.
- License renewal and maintenance: Ensure license plate information is up to date and renew license plates when necessary.
- Regulatory reporting: Submit regular reports to the regulator upon request, including financial reports and reports on compliance with AMLO regulations.
- Capital and Margin Requirements: Meet the paid-in capital requirements, such as VASP paid-in capital must be more than HK$500 million, and the bank account margin must not be less than HK$400 million.
- Insurance Requirements: Purchase insurance of the corresponding amount, and the insurance coverage will be adjusted according to the transaction amount.
- Audit and compliance reporting: Regularly submit audited accounts and financial information to the SFC, as well as business valuation reports provided by external valuation experts.
- Prevent market manipulation and illegal activities: Establish mechanisms to prevent and monitor market manipulation and illegal trading practices.
- cyber security: Ensure network security and protect customer data and transactions from hacker attacks.
- Client asset protection：Ensure the security and independence of customer assets and strictly isolate these assets from the company's own assets.
- Transparency and Disclosure: Provide full transparency and disclosure of business operations to customers and regulators.
- Comply with travel rules: Implement and comply with the FATF-recommended travel rule, which requires the transmission of information about senders and receivers when cross-border funds transfers occur.
- Dual license supervision: If you provide both security and non-security token trading services, you need to obtain dual licensing and approval from the SFC.
FAQs
The Hong Kong Securities and Futures Commission (SFC) does have specific requirements for the regulatory framework for virtual asset trading platforms, which include restrictions on investor qualifications. In some cases, the regulatory framework requires that virtual asset trading platforms can only provide services to "professional investors" in order to ensure that only investors with a certain level of risk identification and tolerance can participate in high-risk virtual asset investments.
However, OSL and ZA Bank announced plans to launch virtual asset trading services to retail investors, indicating that under the new licensing system, licensed institutions can provide services to retail investors. This could mean that the regulatory framework has been adjusted, or that OSL and ZA Bank have obtained the necessary regulatory approvals to provide services to retail investors subject to certain conditions.
Specifically, the Hong Kong Securities and Futures Commission clearly stated in the consultation summary of the "Guidelines for Virtual Asset Trading Platform Operators" issued on May 2023, 5 that licensed trading platforms are allowed to provide services to retail investors, but they must comply with a series of investor protection measures, including suitability testing, token due diligence, guidelines and disclosures.
This means that while licensing requirements may initially be designed for professional investors, as the regulatory environment changes and markets evolve, regulators may update their guidance to allow licensed institutions to provide services to retail investors, provided certain conditions and protections are met.
In summary, whether services can be provided to retail investors depends on a variety of factors, including the specific requirements of the regulatory framework, the compliance of licensed institutions and the approval of regulators. As Hong Kong’s virtual asset market develops, the regulatory environment is also evolving to adapt to market demand and protect investor interests.
VASP (Virtual Asset Service Provider) license applicants do need to demonstrate sufficient financial resources, but the document does not mention a specific minimum amount requirement. Typically, regulators require financial institutions to demonstrate that they have sufficient capital to cover operational risks and ensure that they can meet financial soundness requirements.
The specific amount of financial resources may be determined based on a variety of factors, including but not limited to:
- Business scale: The scope of services provided and the expected business volume.
- Risk Management: The institution’s risk management framework and capital adequacy ratio.
- Regulatory requirements: Minimum capital requirements imposed by regulators.
- operating costs: The costs required to start and maintain a business.
- Market environment: Market conditions and potential economic stress scenarios.
- In Hong Kong, VASP licensees can conduct over-the-counter (OTC) business, but this requires compliance with specific regulatory requirements and restrictions. Hong Kong's regulatory framework is generally strict and aims to ensure that all trading activities are conducted in a transparent and controlled environment to protect investors and maintain market fairness.
Specifically, VASP licensees need to ensure compliance with the following key regulatory requirements when conducting OTC business:
- Compliance and regulatory framework: Must operate under the regulatory framework of the Securities and Futures Commission (SFC) of Hong Kong, including compliance with relevant Anti-Money Laundering (AML) and Counter-Terrorism Financing (CFT) regulations.
- Investor Protection Measures: Appropriate risk disclosure and customer protection measures need to be implemented to ensure that customers understand the potential risks associated with OTC business.
- Transaction Records and Reports: It is necessary to maintain detailed transaction records and report transaction activities to regulators regularly to ensure the transparency and traceability of transactions.
- Market conduct rules: Market behavior rules must be followed to prevent market manipulation and unfair trading practices.
Although OTC business is allowed, licensed VASPs should carefully assess and manage the risks associated with such business and ensure that all operations strictly comply with Hong Kong's legal and regulatory requirements.
