By a Circular dated 16 January 2025, Hong Kong's Securities and Futures Commission (SFC), the lead financial regulator for the licensing and supervision of virtual asset trading, introduced enhancements to its licensing regime for virtual asset trading platforms (VATPs). The enhancements extend the SFC's previously implemented swift licensing process to all new VATP applicants that submit applications after 18 December 2024.¹

By another Circular also dated 16 January 2025, the SFC published its observations from on-site inspections of VATP applicants that it had conducted to date, pursuant to the recently implemented swift licensing process.²

These recent developments signal Hong Kong's intentions to further promote the development of its local virtual assets ecosystem by streamlining its licensing process, whilst adhering to high compliance standards designed to protect investors.

The swift licensing process

The swift licensing process was initially deployed by the SFC in June 2024 on a limited basis for VATP applicants that had been granted a deemed-to-be-licensed status by the SFC (deemed applicants), following the end of the transitional period on 1 June 2024.³

Under the swift licensing process as initially introduced, the SFC conducted an on-site inspection of the deemed applicant's premises to ascertain their compliance with relevant regulatory requirements.⁴

Following the SFC's on-site inspection, deemed applicants might be granted a conditional licence upon agreement with the SFC on a rectification plan incorporating the SFC's feedback. This process allowed deemed applicants to operate under a restricted business scope whilst implementing enhancements required by the SFC.

Deemed applicants would then undergo a second-phase assessment conducted by an external assessor (EA) to establish whether its revised policies and procedures were suitably implemented following completion of its rectification plan in response to the SFC's inspection feedback.⁵ The external assessment included a test of the deemed applicant's cybersecurity measures, including performing penetration tests (a security exercise where the assessor attempts to find and exploit weaknesses in a computer system) to identify, rank and report vulnerabilities.

The EA conducted its assessment under a tripartite engagement, whereby the SFC would be included as a party to the agreement, thereby allowing the SFC to supervise the assessment, clarify regulatory requirements and offer feedback on the assessment's findings.

On 18 December 2024, four deemed applicants were granted licences by the SFC under the swift licensing process.⁶

Swift licensing process now extended to all new VATP applicants with further enhancements

Following the SFC's Circular of 16 January 2025, the swift licensing process will now be extended to all VATP applicants that submit licensing applications after 18 December 2024. The SFC has also introduced additional enhancements to further streamline the process.

The VATP licensing process may now be summarised as follows⁷:

• Submission of application: VATP applicants submit their licensing application bundle via WINGS, the SFC's online platform. The licensing application bundle should include, amongst other things, documentation to show that a suitable EA has been appointed to perform an external assessment of the VATP applicant.

• Initial assessment by the SFC: The SFC conducts its initial assessment including a consideration of, amongst other things, the VATP applicant's business structure, competence, and fit and proper status. The SFC also retains discretion to oppose the appointment of the EA by the VATP applicant and, if so, to return the application.

• Deploying systems and controls: After the SFC accepts the licensing application, the VATP applicant deploys its systems and controls in preparation for the external assessment. This includes implementing its AML and KYC tools together with solutions for custody of client assets.

• Revamped external assessment: Assessments of VATP applicants will no longer be in two phases and instead consolidated under a single assessment conducted by an EA. The tripartite engagement model initially implemented under the swift licensing process will apply to external assessments of all VATP applicants going forward. The EA's assessment is performed as a direct assurance engagement and must be signed off by a practising CPA.

• EA opinion issued: Following the external assessment, the EA is expected to form an opinion on whether the VATP applicant's policies and procedures are suitably designed and in compliance with the Guidelines for Virtual Asset Trading Platform Operators⁸ and the Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations and SFC-licensed Virtual Asset Service Providers).⁹

• Remediation measures and report: Where any findings and exceptions are identified by the EA, the VATP applicant must then take remedial measures to amend its policies and procedures in response. The VATP applicant then issues a report to the SFC for assessment.

• Licence granted: Upon completion of the external assessment and all other outstanding matters such as capital injection, the SFC will grant a licence to the VATP applicant if it is satisfied that the applicant is then fit and proper to be licensed.

SFC observations from inspections of deemed-to-be-licensed VATPs

The SFC's Circular dated 16 January 2025 contains the SFC's expected standards of conduct for VATP operators together with detailed observations on the systems and controls of deemed applicants in light of the SFC's recent on-site inspections.

The Circular and its two appendices indicate the SFC's areas of focus when assessing a VATP applicant's policies and procedures as part of the licensing process, revealing a particular emphasis on applicants' cybersecurity measures, safeguarding of client assets and know-your-client (KYC) procedures.

Key elements of the SFC's observations are summarised below.

Cybersecurity

• Network segmentation: VATPs are expected to properly segregate network segments to separate sensitive data from other network segments which are more vulnerable to hacking.¹⁰
• Governance frameworks: VATPs are expected to develop robust governance frameworks and policies for managing privileged accounts. In practice, this will mean ensuring senior management maintains full transparency of all the privileged accounts in their systems and by "whitelisting" website addresses and tailoring staff's internet access.¹¹
• Security measures: VATPs must use up-to-date encryption and secure transfer technology to manage security threats, store data and avoid weak or out-of-date algorithms. VATPs must invest in security operations centres to ensure 24/7 coverage and incident handling and in automated solutions to monitor unauthorised access to client accounts.¹²

Handling of clients' virtual assets

• Limited access rights: VATPs must limit employees' access to client virtual assets to only Responsible Officers, Managers and their delegate(s).¹³
• No comingling of assets: VATPs must avoid comingling of client virtual assets and their own (and associated entities') virtual assets.¹⁴
• Cold and hot wallet storage ratios: VATPs should store at least 98% of client virtual assets in cold wallets (i.e. offline storage). They should ensure that all client virtual assets they receive are included in the calculation of the relevant ratios, regardless of whether these virtual assets have passed their internal checking and verification processes.¹⁵
• Contingency plans:VATPs must implement a comprehensive contingency plan and risk assessment to protect against third-party failures and operational breakdowns. A number of applicants were criticised for being highly dependent on one single external system service provider for their entire virtual assets custody system and for having limited contingency plans to determine what would happen if the provider failed.¹⁶
• Insurance: VATPs should have an insurance policy in place to cover the Compensation Amount (50% of cold wallet assets and 100% of hot wallet assets) and ensure this is calculated properly.¹⁷
• Client money: VATPs are expected to only receive client funds into their associated entity's segregated bank accounts to be held on trust through those entities. Segregated bank accounts should only be operated by day-to-day managers of the Platform Operator (or its associate) with relevant fraud controls in place.¹⁸

Access to services

• To monitor access to their services, VATPs should conduct adequate due diligence and assessment using third-party (vendor) databases or geolocation, VPN and proxy detection features to identify IP addresses from Restricted Jurisdictions, VPNs and proxies.
• Where VATPs allow their clients to use VPNs and proxies, they should monitor usage and take steps to ensure virtual asset trading is not illegal in the clients' jurisdiction.¹⁹

Takeaways

The SFC's enhanced licensing regime reflects its commitment to fostering both a dynamic but also secure environment for virtual asset trading. The SFC has stated that the licensing regime attempts to strike a balance between safeguarding the interests of investors and facilitating continuous development for the virtual asset ecosystem in Hong Kong.²⁰

Potential new entrants into the virtual asset ecosystem who intend to seek a VATP licence may benefit from taking practical steps in areas such as:

• Gap analysis: Conducting a thorough review of existing policies and procedures against the SFC's standards, with particular attention to cybersecurity, client asset protection, and AML / KYC protocols.
• Early engagement: Applicants should prioritise early engagement with the SFC to align their policies and procedures with regulatory expectations, potentially reducing future delays in the licensing process.
• Hiring: Potential applicants should staff their teams with persons with sufficient expertise in key subject areas such as IT and compliance to meet the SFC's fit and proper requirements.
• Investment in infrastructure: Sufficient investment in systems and controls, particularly in cybersecurity, client custody and AML/KYC, will be crucial in meeting regulatory requirements.
• Compliance expertise: Potential applicants should consider engaging advisers familiar with the Hong Kong regulatory landscape to navigate regulatory assessments effectively.

Acknowledgements to Trainee Solicitor Faith Colenutt for research and contribution to this article.

1. SFC Circular to new virtual asset trading platforms seeking to be licensed - Enhanced licensing process and revamped external assessments dated 16 January 2025; See also SFC Press release dated 16 January 2025.
2. SFC Circular to Licensed Corporations, SFC-licensed Virtual Asset Service Providers and Associated Entities: Findings from inspections on deemed-to-be-licensed virtual asset trading platform applicants and expected standards of conduct for virtual asset trading platform operators dated 16 January 2025
3. See the SFC's Press Release dated 12 June 2024. The SFC introduced a new VATP licensing regime in June 2023 via amendments to the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap.615). Pursuant to the new licensing regime, the SFC implemented a transitional arrangement with a non-contravention period from 1 June 2023 to 31 May 2024, in order to allow VATPs that had operated in Hong Kong before 1 June 2023 time to comply with the requirements of the new regime, or to otherwise wind down their operations in an orderly fashion.
4. See the SFC's Press Release dated 12 June 2024.
5. SFC Circular to virtual asset trading platforms on licensing process and revamped second phase assessment dated 18 December 2024, paragraph 11.
6. SFC Press Release dated 18 December 2024. The four VATPs are Accumulus GBA Technology (Hongkong) Co., Limited, DFX Labs Company Limited, Hong Kong Digital Asset EX Limited and Thousand Whales Technology (BVI) Limited. There are currently seven licensed virtual asset trading platforms (as at 27 January 2025).
7. See the Appendix to the SFC's Circular to new virtual asset trading platforms seeking to be licensed - Enhanced licensing process and revamped external assessments dated 16 January 2025.
8. See Guidelines for Virtual Asset Trading Platform Operators, dated June 2023.
9. See Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations and SFC-licensed Virtual Asset Service Providers), dated June 2023.
10. SFC Circular to Licensed Corporations, SFC-licensed Virtual Asset Service Providers and Associated Entities: Findings from inspections on deemed-to-be-licensed virtual asset trading platform applicants and expected standards of conduct for virtual asset trading platform operators dated 16 January 2025, Appendix 1 (Appendix 1), Expected Standard A.
11. Appendix 1, Expected Standard B and Expected Standard F.
12. Appendix 1, Expected Standard C, Expected Standard D and Expected Standard E.
13. Appendix 1, Expected Standard G.
14. SFC Circular to Licensed Corporations, SFC-licensed Virtual Asset Service Providers and Associated Entities: Findings from inspections on deemed-to-be-licensed virtual asset trading platform applicants and expected standards of conduct for virtual asset trading platform operators dated 16 January 2025, Appendix 2 (Appendix 2), paragraph 15; Appendix 1, Expected Standard H.
15. Appendix 1, Expected Standard I.
16. Appendix 1, Expected Standard O and Appendix 2, paragraph 28.
17. Appendix 1, Expected Standard R and Expected Standard S.
18. Appendix 1, Expected Standard T and Expected Standard U.
19. Appendix 2, Expected Standard V.
20. SFC Press Release dated 18 December 2024.