Navigating your way to a VATP licence: Five frequently asked questions

The regulatory regime is robust and comprehensive, and there is a lot of information to digest. We set out below our views on five areas where our clients often have questions, to help you navigate the new requirements.

1. Application basics: One or two licences? Timing?

There are actually two regulatory regimes operating in parallel: Type 1 and Type 7 licences under the Securities and Futures Ordinance (Cap. 571) (SFO) and the VATP licence under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) (AMLO). Whether you need one licence or both licences depends on your business model and future plans.

A VATP licence allows you to provide non-security VA services, while Type 1 and Type 7 licences allow you to deal with securities and provide automated trading services.

You may question the need to obtain Type 1 and Type 7 licences if you do not intend to trade security tokens. However, do keep in mind that the terms and features of a VA may evolve over time, and a VA’s classification may change from a non-security token to a security token, or vice versa. If you do not wish to run the risk of carrying on activities that require Type 1 and Type 7 licences (without having the licences) or want the flexibility to expand your business, you should give serious consideration to the dual licensing process, given the SFC has offered a streamlined approach. We anticipate that the SFC will scrutinise and penalise unlicensed VA activities, so it is better to be prudent.

In terms of timing, it should be no surprise that the SFC does not commit to an application approval timeline, and as there is no track record for such applications (yet), it is unclear how long the SFC will take to consider an application. In general, we advise clients to submit a complete application with all necessary information and documents – this process may itself take some time – and to be prepared for a few rounds of questions from the SFC primarily relating to major regulatory concerns, such as investor protection, risk management and security.

2. Staffing: Who you need on your team

We are often asked whether staff need to be based in Hong Kong. The practical answer is yes, you do need some key staff to be based in Hong Kong, for example, at least one⁶ Responsible Officer (RO) must ordinarily reside in Hong Kong.⁷ In addition, you will need to appoint a Hong Kong-based complaints officer and have a local emergency contact person.⁸ We believe that there should be some flexibility for other staff to be based overseas, say, for example, if you also operate in other jurisdictions.

Next, it is important to ensure that your senior management has the necessary qualifications and experience. For example, the two ROs⁹ should have a minimum of three years’ industry experience and two years’ management experience (among other qualifications). At least one of them must be an executive director who participates in or supervises each regulated activity or the VA service. Our clients have expressed concern that talents with both financial experience and technical skills are not easy to find. The SFC says it is willing to take a pragmatic approach to assessing the experience of candidates.¹⁰

Additionally, you need to appoint managers-in-charge (MICs)¹¹ in the following areas: (i) overall management oversight; (ii) key business lines; (iii) operational control and review; (iv) risk management; (v) finance and accounting; (vi) information technology; (vii) compliance; and (viii) AML/CTF. There are no express requirements that MICs should reside in Hong Kong, although we advise clients that some MICs should be Hong Kong-based so that they can discharge their responsibilities effectively.

3. Local premises: Whether you need premises in Hong Kong

While the SFC does not clearly prescribe where a licensed corporation must operate its business, you will need to have non-domestic use premises in Hong Kong for record-keeping purposes,¹² and you will need to have a floorplan ready at the time of application.¹³ As mentioned above, you do need to have some Hong Kong-based staff, so it is difficult to see how you can operate responsibly and effectively without premises in Hong Kong.

If you intend to use a shared office, you will need to ensure that it meets certain requirements, such as having a secure and properly segregated office area that can be locked and designated for your exclusive use to prevent unauthorised access or leakage. Your office equipment and telecommunication systems should also be installed within an enclosed area that is secure and accessible only by your staff.¹⁴

4. Corporate and operational structures: How you will run your business

There is no requirement that an applicant corporation itself needs to be locally incorporated. If you decide to apply as a foreign company, you will need to be registered in Hong Kong as a non-Hong Kong company.¹⁵

The SFC will require certain information¹⁶ about your substantial shareholders and/or ultimate owners,¹⁷ and you are required to submit a corporate shareholding chart showing such details.

Great emphasis is placed on the protection of client assets. Operationally, you should have a locally incorporated wholly-owned associated entity to hold client assets on trust.¹⁸ Client money (fiat) should be kept in a local bank.¹⁹ In the case of client VAs stored in a cold wallet,²⁰ seeds and private keys should be securely stored in Hong Kong.²¹

A number of policies, procedures and controls will need to be established and submitted to the SFC at the time of the application.²² These should include, at least, an organisation chart depicting your management and governance structure, business and operational units and key human resources, MICs and their respective reporting lines; operational flowcharts; custody arrangements; Know Your Client and AML/CFT procedures; trading cycles; and market surveillance. You will also need to submit a Phase 1 external assessor report on the design effectiveness of your policies and procedures and a 12-month projection of your company's finances and expenses. There is also a Phase 2 report which is required after approval-in-principle is granted.

Of course, running a licensed entity requires more than following procedures and reviewing reports. You (particularly your ROs and MICs) should be prepared to exercise judgement in areas where the SFC has set out broad principles. For example, you will be expected to take all reasonable measures to ensure that VA product information is not false, biased, misleading or deceptive. What reasonable measures are taken will depend on your client base, the VA products offered, the information provided by the VA issuer, etc.

5. Finally, your advisors: Who you can turn to for help

Being licensed is the start of your status as an SFC-licensed entity. Going forward, you will need the support of professional advisors to help you operate a VA exchange business in Hong Kong. This team should include:

• Accountants and auditors (there are minimum financial resources requirements and requirements to submit monthly and yearly returns and statements²³).
• Bankers (you should already have bank accounts opened (including at least one segregated trust account of the wholly-owned associated entity to hold client money) in Hong Kong before your application can be approved²⁴).
• Insurers (upon consultation, the SFC has set out less onerous requirements – you should arrange a combination of third-party insurance, funds or VAs set aside on trust and/or bank guarantees provided by Hong Kong banks to cover the potential loss of 50% of client VAs in cold storage and 100% of client VAs in hot and other storages²⁵).
• System auditors (at least an annual technology audit by a suitably qualified independent professional is required²⁶).
• Last but not least: Legal advisors to help you navigate the complex legal landscape and meet the SFC’s regulatory expectations.

Conclusion

The new regulatory framework has generated great interest in Hong Kong and overseas, and many industry players are now considering applications to the SFC. Applicants should appreciate that they will need to commit sufficient time and resources and work with experienced legal counsel who can guide them through the process, coordinate with other professional advisors and liaise with the SFC.

If you have any questions or would like to discuss your business needs further, please feel free to contact us.

1. This was issued on 20 February 2023. Reed Smith has closely monitored the consultation process of the Guidelines, which you can find on reedsmith.com.
2. A VA that is included in a minimum of two acceptable indices issued by two independent and different index providers.
3. Including onboarding, governance, disclosure and token due diligence and admission, etc. The SFC will also step up education efforts.
4. The Travel Rule refers to the requirements for VA transfers to or from an institution set out in paragraphs 12.11.5 to 12.11.24 of the Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations and SFC-licensed Virtual Asset Service Providers). Under the Travel Rule, licensed VATPs are required (i) when acting as the ordering institution, to obtain, hold and submit required information about the originator and recipient to the beneficiary institution immediately and securely; and (ii) when acting as the beneficiary institution, to obtain such information from the ordering institution and hold it securely.
5. Albeit some interim measures are permitted. The SFC will issue FAQs.
6. Out of a minimum of two ROs.
7. Section 53ZRO(1)(c) of AMLO.
8. Sections 3.1 and 3.2 of the Application for Licence – Corporation (Form VA 1U) (Form VA).
9. Who should be responsible for overseeing the design, development, implementation and maintenance of the systems and technologies (i.e., the CTO or CIO).
10. Section 3 of the Guidelines.
11. While some of these roles can be filled by the same person, you should segregate key duties to avoid conflicts of interest.
12. Section 130 of SFO; section 53ZRR of AMLO.
13. Section 2.13 of Form VA.
14. Sections 2.4-2.12 of Form VA.
15. Section 53ZRK(3) of AMLO.
16. Section 6 of Form VA.
17. At a high level, 10% and 25% of share capital/voting powers respectively, see complete definition at section 6 of Part 1, Schedule 1 of SFO and section 53ZR of AMLO.
18. Section 10.1 of the Guidelines.
19. Section 10.11(a) of the Guidelines.
20. Section 10.6(c) of the Guidelines, which requires 98% of client VAs to be stored in cold storage (such as Hardware Security Module (HSM)-based cold storage).
21. Section 10.8(e) of the Guidelines.
22. Section 9 of Form VA.
23. Section 6 of the Guidelines.
24. Section 14 of Form VA.
25. Section 10.22 of the Guidelines.
26. Section 12.7 of the Guidelines.

In-depth 2023-123