A Giant LEAP Forward: Hong Kong Consults on Crypto Dealing and Custody

(a) for or with a view to acquiring, disposing of, subscribing for, or underwriting VAs; or
(b) the purpose or pretended purpose of which is to secure a profit to any of the parties from the yield of VAs or by reference to fluctuations in the value of VAs.

The equivalent definitions for securities and futures dealings in the SFO come with a range of exemptions that narrow the scope of the regulated activities (e.g., dealing as principal with a professional investor, dealing that is wholly incidental to another activity like asset management, and dealing through a licensed intermediary, etc.). The VA dealing consultation paper asks respondents to provide feedback on appropriate exemptions.  

– simple dealing services, including typically smaller-scale VA-VA and VA-fiat (and vice versa) conversions;
– more complex dealing services such as brokerage activities, block trading activities, and other relevant activities of advisors or asset managers; and
– irrespective of whether the services are to be provided through a physical outlet and/or other platforms.

Services like VA advisory (e.g., issuing VA investment research reports), asset management, staking, borrowing/lending, and margin trading will be subject to separate sets of regulatory requirements based on the “same activity, same risks, same regulation” principle, and may involve additional approvals from the SFC or the HKMA (where applicable).  

– Local presence: VA dealers (except for banks) must be (i) a locally incorporated company with a permanent place of business in Hong Kong, or (ii) a company incorporated elsewhere but registered in Hong Kong under the Companies Ordinance (i.e., a Hong Kong branch). All licensees will be required to identify suitable premises for its storage of books and records.
– Financial resources: minimum paid-up share capital of HK$5 million, minimum required liquid capital of up to HK$3 million (depending on the business model), and excess liquid capital equivalent to at least 12 months of its actual operating expenses.
– Knowledge and experience of personnel
– Risk management procedures
– Financial reporting and disclosure
– Conduct of business
– Information and notifications
– Record-keeping
– Proper protection of client assets (see also the consultation on VA custodian services)
– Other investor protection safeguards (e.g., risk profiling, exposure limits, etc.)

There will be fit-and-proper requirements for licensed personnel, directors, and substantial shareholders as well as a minimum of two responsible officers supervising the regulated business.
The SFC will conduct a separate consultation exercise on a range of regulatory requirements that will be in place for all licensees or registrants providing VA dealing services. The consultation will cover the fitness-and-properness of the applicant and relevant persons, ability and experience, AML/CFT controls, as well as conduct and risk management, among others.  

(i) VAs on behalf of clients; or
(ii) instruments enabling transfer of VAs of clients (including, but not limited to, private keys) on behalf of clients.

The reference to “instruments enabling transfer of VAs” is intended to capture safeguarding of private keys (or similar instruments, like authentication credentials for accessing the private keys), which would enable transfer of client VAs.
The activity must be carried on “by way of business,” and thus intends to cover safekeeping of VAs on behalf of clients or private keys (or similar instruments) that would enable transfer of client VAs as a business activity, instead of self-custody of one’s own VAs (i.e., only the client has possession of the private keys (or similar instruments)).
VA custodian service providers that also facilitate dealings in VAs (swaps/conversions or spot trades of VA for VA, fiat currency for VA, or vice versa) will need to apply for a licence or registration under the proposed VA dealing regime (unless otherwise exempted under that regime). Alternatively, they may need to set up a separate entity for providing such service.
The consultation paper proposes that services ancillary to the provision of VA custodian services (e.g., staking) may be allowed, subject to the SFC’s approval or the HKMA’s approval (as applicable) on a case-by-case basis, with adequate regulatory requirements imposed by the SFC on such activities.
The VA custodian service provider licences will be open-ended, consistent with the VATP and securities and futures licensing regimes.

– Existing VA custodians for SFC-licensed VATPs (these entities currently are required to be licensed as TCSP licensees, but they will need to be licensed as VA custodian service providers under the proposed regime).
– Banks, their subsidiaries, and SVFs that provide VA custody services (even if carried on as part of providing VA dealing services or acting as depositaries of SFC-authorised funds with VAs in the funds’ portfolios).
– SFC-licensed fund managers, if they provide self-custody to the funds under their management that invest in VAs by way of safekeeping the private keys (or similar instruments) that enable transfer of fund VAs.

All of these businesses will need to liaise with the SFC early to facilitate the transition to being licensed/registered VA custodian service providers under the new rules, as there may not be any transitional period permitted by the SFC (see below).
VA wallet providers that allow customers to hold VAs on a custodial basis also would be in-scope for licensing under the new regime (noting that these providers typically provide other dealing services and so may need to be licensed under the VA dealing regime as well).
It is not clear whether VA custodian service providers that do not safekeep private keys (or similar instruments), but appoint other VA custodian service providers licensed by or registered with the SFC or other VA custodians under the regulation of other jurisdictions for safekeeping the private keys (or similar instruments), will be required to obtain a licence under the new regime. If the consultation concludes they are required to be licensed or registered under this new regime, they will be expected to adhere to regulatory requirements similar to those imposed on depositaries of SFC-authorised funds licensed for Type 13 regulated activity under the SFO corresponding to a depositary’s custody and oversight role and responsibilities. In particular, robust internal controls must be established for oversight of delegates or third parties.  

– Bank security vaults storing encrypted/de-activated backup of private keys.
– Security companies storing encrypted/de-activated backup of private keys.
– Technical service providers supporting the provision of the VA custodian services, but not safekeeping private keys (e.g., providing communication or information technology networks).
– Exemptions for SFC/HKMA-regulated entities where the safekeeping of client VAs is “wholly incidental” to the principal business of providing the VA service or carrying on a regulated activity for which they are licensed, provided that the regulated entities do not safekeep the private keys (or similar instruments) on behalf of clients.
– HKMA-licensed stablecoin issuers carrying on custody of only the stablecoins they issue for their clients also will be exempt from the requirement to have a separate licence for VA custodian services notwithstanding that the stablecoin issuer safekeeps the private keys. This exemption is proposed on the grounds that the relevant stablecoin issuer and its activities are subject to the HKMA’s regulation and ongoing supervision.  

– Local presence: VA custodian service providers (except for banks and SVFs) must be (i) a locally incorporated company with a permanent place of business in Hong Kong, or (ii) a company incorporated elsewhere but registered in Hong Kong under the Companies Ordinance (i.e., a Hong Kong branch). The physical presence requirement ensures that local anchorage is available for the SFC and/or HKMA to supervise and the SFC to enforce regulatory requirements against licensed or registered VA custodian service providers. All licensees will be required to identify suitable premises for its storage of books and records.
– Financial resources: Minimum paid-up share capital of HK$10 million or minimum required liquid capital of up to HK$3 million (depending on the business model). The SFC and FSTB are considering whether additional financial resources requirements, such as requirements calibrated with reference to operating expenses and/or the scale of the business activities, are required for a licensed custodian. This will be considered in a holistic manner with the current regulatory requirements applicable to VATPs that seek to mitigate risk of loss of client VAs and govern compensation for loss of client VAs. This review of current requirements would be the subject of a separate consultation exercise that will cover, for example, compensation and insurance arrangements, the custodial infrastructure deployed, and internal control requirements.
– Knowledge and experience of personnel: Individuals responsible for the VA custodian service are expected to be licensed by the SFC and accredited to the VA custodian service provider. This will include staff members who perform “more than a clerical role” in a business function directly relating to the VA custodian service provider’s discharge of its regulatory obligations (e.g., making business decisions, oversight duties, approving transactions, etc.), whereas clerical functions would include administrative or back-office functions like document filing and data input. The consultation expressly seeks feedback on whether persons who sign VA transactions should be required to be licensed and, if so, what step(s) of approving a transaction should trigger the licensing requirement.
– Conduct of business
– Risk management procedures
– Information and notifications
– Record-keeping
– Financial reporting and disclosure

There will be fit-and-proper requirements for licensed personnel, directors, and substantial shareholders. Further, there will need to be a minimum of two responsible officers supervising the regulated business.