On 18 December 2024, the Securities and Futures Commission (“SFC”) published a circular (the “Circular”) outlining streamlined licensing procedures for virtual asset trading platforms (“VATPs”) and revised second-phase assessment (“Second-phase Assessment”).[1] The SFC strives to continuously foster effective engagement and interactions between the SFC and the VATPs by way of becoming a “party to the engagement” in the Second-phase Assessment to be performed by VATPs.
…
The revised Second-phase Assessment emphasises on ensuring the policies, procedures, systems and controls (“P&P”) of the VATP are adequately created and executed as a direct assurance engagement.
- Licensing and regulatory procedures for VATPs
Subsequent to the on-site inspections targeting to ensure the applicants have complied with the relevant regulatory standards, the deemed-to-be-licensed VATP applicants (“Deemed Applicants”) would have to satisfy the SFC’s further regulatory expectations for improvement. They are mandated to provide a plan detailing the rectification strategies in response to the feedback from the SFC during the inspection. Upon agreement with the plan by the SFC, a conditional license will be issued to the Deemed Applicants accordingly. To satisfy the licensing requirements, the VATP is bound to carry out the rectification measures as outlined, and conduct penetration tests and vulnerability assessments performed by independent third parties. Satisfactory results must be obtained prior to functioning under a restricted operational scope by the VATP.
- Vulnerability Assessment
The independent third-party assessor should detect any susceptible risks within the VATP’s systems by adopting a thorough binary analysis of the custody system. The assessment will primarily focus on external and internal vulnerabilities, which will be categorised in accordance with their respective risk levels.
- Penetration Test
To enhance cybersecurity resilience and identify potential security loopholes in the platforms, security enhancement assessments and penetration tests are expected to be carried out by independent third-party assessors on multitudes of systems, including network devices, services, databases and e-wallets infrastructures. Following the notification by the SFC regarding its satisfactory completion of the stipulated assessments and testing, the VATP is permitted to operate within a restricted scope of business as a licensing condition. The VATP can then proceed to involve an External Assessor (“EA”) in performing the Second-phase Assessment.
- Revised Second-phase Assessment
The Second-phase Assessment is conducted through a tripartite agreement that includes the SFC, the VATP and the EA. It focuses on evaluating whether the updated P&P have been properly established and implemented after the VATP completes the rectification plan in accordance with the inspection comments provided by the SFC. In the event of any material alterations in the P&P, the VATP must promptly notify both the SFC and the EA. Any contraventions or breaches detected during the Second-phase Assessment shall also be promptly notified by the VATP to the SFC for further investigation.
The process is a direct assurance engagement, requiring certification by a practicing public accountant to ensure compliance with the relevant regulatory standards established by the SFC. Additionally, the EA is required to determine whether the P&P are adequately structured and executed to adhere to the Guidelines for Virtual Asset Trading Platform Operators and the Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations and SFC-licensed Virtual Asset Service Providers). Once the Second-phase Assessment is successfully completed, the SFC will uplift the licensing conditions that limit the VATP’s scope of business.
- Analysis and takeaways
As indicated in the Circular, the SFC has made considerable efforts to develop and refine regulatory regimes to establish the licensing requirements of VATPs. The comprehensive regulatory framework involving external parties, such as independent third-party assessors and certified accountants, intends to protect investors’ rights and reduce the risks of fraudulent activities occurring in the sector. Such an approach demonstrates the SFC’s dedication to cultivate a healthy trading environment while reinforcing its regulatory and enforcement roles in inspecting the VATPs with transparency and accountability.
Please contact our Partner Mr. Rodney Teoh for any enquiries or further information.
This news update is for information purposes only. Its content does not constitute legal advice and should not be treated as such. Stevenson, Wong & Co. will not be liable to you in respect of any special, indirect or consequential loss or damage arising from or in connection with any decision made, action or inaction taken in reliance on the information set out herein.”
[1] Please see our news update on the SFC’s latest licensing regime for VATPs here.