So you want to set up a securities token exchange under the SFC’s regulatory sandbox?

On 01 November 2018, the Securities and Futures Commission (SFC) issued a policy statement (Statement) which introduces, among others, a conceptual framework for licensing and regulating virtual asset trading platforms (Platforms) through a regulatory sandbox (Sandbox). The Statement provides clarity on the regulatory standards for operating a cryptocurrency exchange under the supervision of the SFC.

Scope of Supervision

The Statement provides that an operator of a Platform (Platform Operator) interested in entering the Sandbox should “operate an online trading platform in Hong Kong and offer trading of at least one or more virtual assets which fall under the definition of "securities" on its platform”.

This means, in our view, that to be eligible for admission into the Sandbox, a Platform Operator would have to (1) set up in Hong Kong and (2) offer to trade virtual assets that amount to “securities” as defined in the Securities and Futures Ordinance (Cap. 571) (SFO).

To run a cryptocurrency exchange which offers trading of these virtual assets, a Platform Operator would either need to (1) be licensed to conduct Type 1 (dealing in securities) and Type 7 (providing automated trading services) regulated activities (Part 5 Licensing); or (2) be authorised under Part III of the SFO (Part 3 Authorisation) to provide automated trading services (ATS) as a starting point. On entry into the Sandbox, further terms and conditions may be imposed, or terms and conditions that may be typically imposed on a provider of ATS varied or relaxed, as the SFC deems appropriate.

In addition, a Platform Operator would need to demonstrate its commitment to adhere to the high standards expected of it by the SFC in order to be qualified to enter the Sandbox.

The Sandbox only focuses on regulating Platforms which provide trading, clearing and settlement services for virtual assets and those which have control over investors’ assets. Exchanges which provide a direct peer-to-peer marketplace for transactions by investors who typically retain control over their own assets, or which trade virtual assets for clients but do not provide ATS are beyond the scope of the present Sandbox. Moreover, Platforms which offer trading of virtual assets which do not amount to “securities” are not subject to the purview of the SFC.

Overview of the Sandbox

The Sandbox operates in stages. In the initial exploratory stage, the SFC would not grant any licences to Platform Operators.

It would actively discuss its expected regulatory standards with them and observe the operations of their Platforms in light of those standards, or if there is no existing platform, a detailed business plan would need to be submitted which would, at a minimum, address the following matters:

  • description of the services and facilities that are intended to be performed, and any other business that is intended to be carried on
  • roles and functions to be performed by the Platform Operator
  • description of hardware, software, and other technology, including back up arrangements and testing plans to be used in providing the ATS
  • actual or estimated trading volume on the Platform
  • types of virtual assets to be traded on the Platform
  • types of “professional investors” to be served by the Platform Operator (see Core Principle (3) below which states that only professional investors will be allowed on the Platform)
  • an outline of the rules/procedures and key terms governing the use of the ATS
  • an outline of the fees and charges for using the ATS
  • projected operating expenses in the first 12 months after being licensed/authorised, and
  • financial position of the Platform Operator (eg audited group company accounts).

If the SFC, after the exploratory stage, is of the view that Platform Operators should be regulated, it would invite the Platform Operator to officially make a Part 5 Licensing or a Part 3 Authorisation application under the SFO.

The Statement sets out a number of core principles and specific terms and conditions, which are likely to be imposed as licensing conditions subject to modifications in accordance with the operational model, size and nature of business of each Platform Operator.

Proposed licensing conditions - Core principles

  1. All virtual asset trading activities under a single legal entity
    All virtual asset trading activities which are actively marketed to investors in Hong Kong or are conducted in Hong Kong must be carried out under a single legal entity licensed by the SFC.
  2. Compliance with applicable requirements by entire virtual asset trading business
    A Platform Operator must comply with all applicable regulatory requirements (including any licensing conditions imposed by the SFC) in conducting all virtual asset trading activities. Even if the activities may not relate to virtual assets which are “securities”, they may still affect the overall fitness and properness of the Platform Operator as a licensed entity.
  3. Services to be offered to “professional investors” only
    Only “professional investors” as defined in the SFO should be allowed on a Platform. Where a Platform Operator offers its trading systems to other companies as a technology solution, it should also ensure that its participants and all end users who are able to access its systems are “professional investors”.
  4. Limitations on trading of ICO tokens within the initial 12 months
    A Platform Operator should only admit a virtual asset issued by way of an initial coin offering (ICO) for trading on its Platform at least 12 months after the completion of the ICO or when the ICO project has started to generate profit, whichever is earlier. This requirement serves to ensure that sufficient market information and a performance track record are available to investors for their decision-making.
  5. Transactions to be pre-funded, and no leverage or virtual asset-related futures contracts or other derivative products
    A Platform Operator should only execute a trade for an investor if it is satisfied that there are sufficient fiat currencies or virtual assets in the investor’s account with the Platform to cover that trade. It is not allowed to provide any financial accommodation for investors to acquire virtual assets, or to conduct any trading activities in relation to virtual assets which are futures contracts or other derivatives.

Proposed licensing conditions - Other terms and conditions

  • Financial soundness: The SFC may require a Platform Operator to maintain a reserve equivalent to 12 months of operating expenses as a financial buffer, depending on the characteristics and circumstances of each Platform and Platform Operator.
  • Insurance: A Platform Operator should take out an insurance policy to address the risks associated with the custody of virtual assets. In this regard, the SFC expects the insurance policy to provide full coverage for virtual assets held in hot storage and a substantial coverage (for instance, 95%) for those held in cold storage.
  • Know-your-client (KYC) procedures: Except for institutional professional investors, a Platform Operator should satisfy itself as to a client’s knowledge of virtual assets in the KYC procedures before providing any actual services. Where the client does not possess such knowledge, it may only proceed to provide any services if it would be acting in the best interests of the client.
  • Anti-money laundering and counter-financing of terrorism (AML/CTF): A Platform Operator should put in place proper AML/CTF systems. Examples of specific measures include obtaining sufficient contact information of the client, applying enhanced customer due diligence and ongoing monitoring where necessary, establishing systems to monitor transactions involving virtual assets and evaluating potentially suspicious transactions.
  • Disclosure requirements: Risks associated with trading virtual assets and using virtual asset trading services should be fully disclosed in a clear and fair manner. Examples of specific disclosure include the unavailability of protection offered by Investor Compensation Fund and the irreversibility of transactions in virtual assets. Information relating to fees and charges should also be disclosed.
  • Virtual assets to be admitted for trading: The SFC requires a Platform Operator to perform product due diligence before listing a virtual asset on its Platform. A Platform Operator should also establish and disclose the criteria for admitting a virtual asset for trading, which may include factors such as the regulatory status of a virtual asset in relevant jurisdictions, its demand and supply, maturity and liquidity and its technical aspects. A committee should be set up for making decisions as to admission of a virtual asset for trading in accordance with the criteria.
  • Trading rules: Comprehensive trading rules governing the operations of a Platform should be developed and published of the Platform Operator’s website.
  • Prevention of market manipulative and abusive activities: A Platform Operator should put in place written policies and procedures to identify, prevent and report malicious actors behind any market manipulative or abusive activities such as the creation of false or misleading appearance of active trading in a virtual asset.
  • Employee dealings: A Platform Operation should establish and maintain written policies and procedures in relation to employees’ dealings in virtual assets so as to eliminate, avoid, manage or disclose any actual or potential conflicts of interest.
  • Proprietary trading: Clients’ orders in virtual assets should have priority over orders for the account of a Platform Operator or any accounts in which the Platform Operator has an interest or the accounts of any employees or agents of the Platform Operator.
  • Segregation and custody of clients’ money and virtual assets: Clients’ virtual assets, whether they are “securities” or not, should be held in a segregated account which is designated as a client account and established by the Platform Operator for the purpose of holding virtual assets on behalf of clients only. Moreover, a sizable amount of clients’ assets (for instance, 98%) which are not required to be immediately available should be stored in cold storage to minimise exposure to losses arising from a system compromise or hacking.
  • Ongoing reporting obligations: A Platform Operator is required to submit certain information to the SFC on a regular basis, including changes in the scope and details of its services, details of any new virtual assets to be admitted for trading on the Platform and the identities and locations of its clients.

Other requirements

The SFC also expects a Platform Operator to comply with all relevant legal and regulatory requirements, namely, the SFO and its subsidiary legislation, the Code of Conduct for Persons Licensed by or Registered with the SFC (Code of Conduct), guidelines, circulars and frequently asked questions issued by the SFC from time to time. In particular, a licensed Platform Operator would be required to comply with the KYC procedures and suitability requirement under the Code of Conduct as well as the Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations).


While, on the face of it, the Sandbox seems to be an open invitation for any cryptocurrency exchange that is currently operating (or for anyone proposing to operate an exchange) to approach the SFC and to seek to be admitted, the Statement actually sets out some rather stringent requirements that need to be met before entry into the Sandbox can be contemplated.

In our view, at a minimum, any Platform Operator seeking entry should prepare its paperwork as if it were about to launch an application for Part 3 Authorisation, or Part 5 Licensing, under the SFO (and ensure that the SFC has that paperwork in front of it as part of any exploratory discussion to be held with the SFC).

It is to be expected that only after such discussions have concluded, and the SFC has come to a view that the Platform Operator should be properly regulated under the Sandbox, should guidance be expected from the SFC as to, among other things, which type of application should be made (Part 3 Authorisation or Part 5 Licensing), and the likely terms and conditions that will be imposed as part of such authorisation or licensing.

If you would like more information, or would like to discuss a possible approach to the SFC, feel free to come have a chat with us!

This document (and any information accessed through links in this document) is provided for information purposes only and does not constitute legal advice. Professional legal advice should be obtained before taking or refraining from any action as a result of the contents of this document.