Circular to new virtual asset trading platforms seeking to be licensed – Enhanced licensing process and revamped external assessments

Introduction

1. The Securities and Futures Commission (SFC) recently announced its swift licensing process and revamped second-phase assessment for virtual asset trading platforms (VATPs) in its Circular issued on 18 December 2024. This circular focuses on the licensing process and revamped external assessment for new corporations applying for a licence to operate a VATP, and supersedes the Scope of External Assessment Reports issued in June 2023. All VATP applicants that submit licence applications after 18 December 2024 should refer to this circular.

2. The SFC’s proactive engagement and enhanced communication with VATPs to provide guidance directly and effectively on its expected regulatory standards are key to the swift licensing process. The SFC will continue to adopt this approach for all VATP applicants seeking licences.

3. Under the enhanced licensing process, VATP applicants will be required to engage an external assessor (EA) to perform an external assessment¹ after deploying all relevant systems and controls. The SFC will become a party to the engagement²  for the external assessment to be conducted by VATP applicants.

4. The SFC has also revamped the external assessment to enhance its effectiveness. The revamped external assessment will focus on ensuring that a VATP applicant’s policies, procedures, systems and controls (P&P) are suitably designed and implemented, and is required to be performed as a direct assurance engagement under relevant standards and frameworks³.

Licensing procedures for new corporations applying for a licence to operate a VATP

5. Each VATP applicant is required to submit its licensing application bundle to the SFC for assessment through WINGS, together with (1) copies of its written policies and procedures, (2) documentation to show that a suitable EA has been identified to perform an external assessment for the VATP applicant and (3) the capability statement of the EA. Details of the selection process and eligibility criteria for the EA, and documents to be submitted to the SFC relating to the appointment of an EA, are set out in the frequently asked questions on the SFC’s website.

6. As with all licensing applications, the SFC will assess, amongst others, the VATP applicant’s business structure, competence, fitness and properness of the VATP applicant and its ultimate controller(s), ultimate owner(s), substantial shareholder(s), proposed responsible officer(s) and proposed Manager(s)-In-Charge, as well as the capability of the proposed EA. Depending on the circumstances, the SFC may oppose or raise material concerns regarding the appointment of an EA by the VATP applicant or be of the view that the application is incomplete and/or has unresolved fundamental issues,  and return the application to the applicant with reasons⁴.

7. Upon acceptance of the licence application, the VATP applicant shall proceed to deploy its systems and controls. These include, among others, engaging external service providers for market surveillance, tools for anti-money laundering and counter-financing of terrorism and know-your-clients, implementing its custody solutions and fully adapting their P&P to ensure that they can operate as intended. 

8. After the VATP applicant has deployed its systems and controls and is ready to undergo an external assessment, it should then arrange to enter into a tripartite agreement with the SFC and the EA to assess its P&P under the external assessment requirement. As a party to the agreement, the SFC will supervise the whole external assessment process, clarify regulatory requirements and offer feedback on the assessment findings⁵. The VATP applicant should provide the EA with unrestricted access to all relevant persons and information, such as records, documentation and other materials.

9. It is anticipated that most of the findings and exceptions, if any are identified by the EA and the SFC, would be resolved during the external assessment process. Upon completion of the external assessment and all other outstanding matters such as capital injection, the SFC will grant a licence to the VATP applicant if it is satisfied that the applicant is then fit and proper to be licensed.

10. The above licensing procedures for VATP applicants are depicted in the Appendix to this circular.

Revamped external assessment

11. According to the SFC’s experience, substantial changes to a VATP’s P&P would be necessary upon the VATP’s deployment of hardware and software solutions. Therefore, it would be important to conduct the external assessment only after the VATP deploys its systems and controls and fully adapts its P&P to ensure that they can operate as intended.

12. As such, in addition to requiring an external assessment report to evaluate whether the P&P of a VATP applicant are suitably designed, the SFC has revamped the external assessment to focus on ensuring that the P&P are suitably designed and implemented by the VATP applicant.

13. The VATP applicant must notify the SFC and the EA of any subsequent material changes to its P&P as soon as practicable.

14. To ensure robustness, the SFC requires the assessment to be performed as a direct assurance engagement and signed off by a certified public accountant (practising). The EA should form an opinion on whether the VATP applicant’s P&P are suitably designed and implemented to comply with the Guidelines for Virtual Asset Trading Platform Operators and the Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations and SFC-licensed Virtual Asset Service Providers).

15. Given that the external assessment will be under a tripartite agreement among the SFC, the VATP applicant and the EA, the three parties should agree on the terms and scope before commencing the assessment.

16. For details of the terms of reference and the scope and areas to be covered in the external assessment, VATP applicants should contact the Fintech unit of the SFC by sending enquiries to vatp-licensing@sfc.hk.

Fintech unit
Intermediaries Division
Securities and Futures Commission

Enclosure

End

¹  For the avoidance of doubt, VATPs will no longer be required to conduct the first-phase and second-phase assessments. There will only be one external assessment throughout the licensing application process.
²  The external assessment will be performed under a tripartite agreement among the SFC, the VATP and the EA.
³  Relevant standards refer to HKSAE 3000 or equivalent standards, eg, ISAE 3000.
⁴  Examples of situations in which the SFC may return a licensing application are set out under paragraph 6.5.1 of the Licensing Handbook for Virtual Asset Trading Platform Operators.
⁵  The SFC will pay $1 and the VATP applicant will pay the balance of the total fees, disbursements and expenses in respect of the external assessment.