Hong Kong January 2025 VATP SFC compliance requirements

This newsletter summarises some key Hong Kong regulatory news and updates during January 2025.

Hong Kong’s SFC Publishes Circular for Hong Kong Virtual Asset Platform Regulations with Stricter Conduct Standards

On 16 January 2025, the Hong Kong Securities and Futures Commission (HK SFC) announced new regulatory standards for Virtual Asset Trading Platforms (VATPs). These measures, detailed in an official circular and its appendices (Appendix 1 and Appendix 2), were introduced following inspections of VATP applicants under the deemed licensing framework and supplement the requirements under the VATP Guidelines. Their aim is to enhance the security, compliance, and operational integrity of virtual asset trading platforms operating in Hong Kong.

The HK SFC conducted comprehensive reviews focusing on cybersecurity, safeguarding client assets, and Know-Your-Client (KYC) practices. Findings revealed areas of non-compliance among certain platforms, prompting the HK SFC’s issuance of detailed guidelines to ensure robust system management, adherence to legal obligations, and improved client protection.

The standards, set out in Appendix 1 of the Circular to Licensed Corporations, SFC-licensed Virtual Asset Service Providers and Associated Entities — Findings from inspections on deemed-to-be-licensed virtual asset trading platform applicants and expected standards of conduct for virtual asset trading platform opertors, target operational areas including cybersecurity, asset protection, and KYC compliance.

The HK SFC identified deficiencies in VATP cybersecurity, with issues such as inadequate network segmentation, outdated encryption algorithms, and weak access controls. To counter these risks, the HK SFC mandates advanced network segregation techniques, holistic privileged access management frameworks, and real-time monitoring through 24/7 security operations centres. Strong encryption must now secure all data storage and transmission, replacing vulnerable methods observed during inspections. Automated systems to detect unauthorised access to client accounts are also required to safeguard against hacking and fraud.

The protection of client assets was another area of focus for the HK SFC. The HK SFC elaborated on failures in segregating client funds from operational assets, improper wallet management, and breaches of the mandated “98/2 cold-to-hot wallet ratio.” Platforms must implement procedures to ensure that 98% of client assets are stored in cold wallets, implement wallet address whitelisting for withdrawals of client virtual assets, and secure private keys in certified environments within Hong Kong. Strict protocols for large withdrawals and deposits are required to minimise exposure to cyber threats and operational errors.

The HK SFC now requires VATPs to establish detailed recovery plans and ensure restoration of custody systems within 12 hours of a disruption. Platforms must also maintain fully functional backup facilities with equivalent security standards to primary sites and conduct regular tests to validate their recovery strategies.

The HK SFC also highlighted deficiencies in client access monitoring and control. Several platforms were found to allow unauthorised access from restricted jurisdictions¹ or lacked adequate geolocation tools to block such activities. VATPs must now implement advanced geolocation systems, regularly evaluate monitoring tools, and document their compliance efforts to ensure that only authorised users access their services.

Insurance and compensation arrangements for client assets were scrutinised for compliance with platforms’ obligation to maintain policies that cover 50% of assets in cold wallets and 100% in hot wallets. The new standards require VATP operators to evaluate these policies for adequacy, including reviewing exclusions and deductibles, to guarantee client protection in cases of loss or fraud.

The HK SFC identified lapses in financial management, including delays in transferring client funds to the segregated account of the VATP operator’s associated entity and weak controls over bank account operations. VATPs are now required to ensure that client funds are directly deposited into their associated entity’s segregated account and to implement stringent dual signatory arrangements for bank transactions to minimise fraud risks.

Under the new standards, VATPs must implement stringent cybersecurity measures, including secure network segmentation, privileged access management, and encryption protocols. Platforms are required to monitor systems in real time and maintain continuous security operations to promptly address potential threats. Enhanced controls over client assets are mandated, such as segregation of funds, compliance with the 98/2 cold-to-hot wallet storage ratio, and stricter oversight of private key access.

VATPs must also establish rigorous KYC procedures and geolocation tools to prevent unauthorised access, particularly from restricted jurisdictions.

These enhanced standards take effect immediately and require virtual asset trading platforms to align their policies, procedures and systems with the new standards. Although the HK SFC has not set a specific compliance deadline, the directive highlights the urgency of aligning practices with the prescribed regulations to avoid penalties or operational risks.

(Source: https://apps.sfc.hk/edistributionWeb/gateway/EN/circular/intermediaries/supervision/doc?refNo=25EC3)

HK SFC Fines Hang Seng Bank Limited HK$66.4 Million for Misconduct in Sales of Investment Products

The HK SFC has reprimanded and fined Hang Seng Bank Limited (Hang Seng) HK$66.4 million for serious breaches of the HK SFC’s regulatory requirements involved in its sale of collective investment schemes, sale and distribution of derivative products, excessive retention of monetary benefits, overcharging of clients and inadequate disclosure of fee arrangements.

Collective investment scheme sales practices

The HK SFC’s action originated from an investigation by the Hong Kong Monetary Authority into Hang Seng’s collective investment scheme sales practices during the 18 months ending on 30 November 2017. One hundred and eleven accounts were found to have conducted 100 or more collective investment scheme-related transactions during that period. Most of these transactions were declared as client’s “own choice” in forms signed by clients. The SFC found that in the case of 46 clients, Hang Seng had failed to ensure that the transactions declared by the clients to be “own choice” were conducted without solicitation or recommendation by Hang Seng. Its relationship managers were found to have recommended the transactions and to have encouraged and/or induced the clients to execute the transactions.

Hang Seng was also found to have breached the requirement under paragraph 5.2 of the SFC Code of Conduct² to ensure that its recommendations and solicitations to the 46 clients were suitable and reasonable given their particular circumstances. Hang Seng relationship managers were found to have procured the clients to conduct excessively frequent transactions with short holding periods which was generally contrary both to the funds’ investment objectives and the clients’ preferred investment tenor. The 46 clients also incurred substantial transaction fees on the frequent transactions.

The investigation also revealed that Hang Seng’s internal systems and controls were inadequate to properly supervise and monitor its sales of collective investment schemes. In particular, Hang Seng lacked a proper audit trail evidencing whether its relationship managers solicited or recommended transactions to clients. It also failed to properly monitor and follow up on accounts with excessively frequent trading. The deficiencies in Hang Seng’s internal systems and controls put it in breach of paragraphs 4.2, 4.3 and 12.1 of the SFC Code of Conduct and paragraph VII(8) of the Internal Control Guidelines.³

Regulatory breaches incurred in sale and distribution of derivative products

Between February 2014 and December 2018, 388 clients who had not been characterised by Hang Seng as having a general knowledge of the nature and risks of derivatives were allowed to buy derivative funds in 629 transactions through Hang Seng online banking. One hundred and forty-eight of these transactions involved products with a risk level that was higher than the relevant client’s risk tolerance level (Risk Mismatch Transactions). In the case of the Risk Management Transactions, the derivative funds were assessed by Hang Seng to be unsuitable for the relevant clients. While this was notified to clients through an alert message, they were allowed to proceed with the transactions if they acknowledged the alert message. The SFC found that Hang Seng had failed to ensure the Risk Mismatch Transactions in derivative products were suitable for its clients or were otherwise in their best interests as required by paragraph 5.1A(b)(ii) of the SFC Code of Conduct.

Retention of excessive benefits, overcharging of clients and inadequate disclosure of fee arrangements

Hang Seng was also found to have improperly retained monetary benefits in excess of the amounts disclosed which, in some cases, deprived clients of the benefit of price improvements. The SFC also found that Hang Seng had failed to provide written disclosure of trailer fees (i.e., commissions it received from fund houses as a distributor of funds) when processing fund subscription and switching transactions via telephone orders.

(Sources: https://apps.sfc.hk/edistributionWeb/gateway/EN/news-and-announcements/news/doc?refNo=25PR14 and https://apps.sfc.hk/edistributionWeb/api/news/openAppendix?lang=EN&refNo=25PR14&appendix=0)

HK SFC Imposes Lifetime Ban on Chan Ka Him Following Court’s Fraud Conviction

On 6 January 2025, the Hong Kong Securities and Futures Commission (HK SFC) permanently barred Mr Chan Ka Him, a former insurance specialist at Standard Chartered Bank (Hong Kong) Limited (HK SCB), from re-entering the financial industry. The decision follows Chan’s criminal convictions for three counts of fraud and one count of attempted fraud, as ruled by the Hong Kong District Court on 2 February 2024. The court sentenced Chan to 20 months in prison, citing his deliberate and systematic deception of clients and the significant reputational harm caused to a leading financial institution.

The District Court found that between January and March 2019, Chan facilitated two clients in obtaining insurance policies. However, between August and September 2019, he induced these clients to transfer substantial sums; US$52,300 from one client and over HK$420,000 from another; into a bank account under his control. Having claimed these funds were for settling insurance premiums, Chan later attempted to cancel the clients’ policies by falsely representing to the insurer that they had requested cancellations. The court noted that Chan’s actions demonstrated a calculated breach of trust, taking advantage of his position at HK SCB, a prominent bank in Hong Kong.

In its sentencing, the court referenced established guidelines for fraud cases involving breaches of trust. For fraud involving HK$250,000 to HK$1,000,000, a starting point of 2 to 3 years’ imprisonment is typical. The court adopted a 27-month starting point for the fraud charges linked to the HK$420,000 amount and 24 months for the related insurance claims. While Chan could not benefit from the one-third sentencing discount granted for guilty pleas, the court acknowledged mitigating factors, including his repayment of the stolen funds before his arrest and his agreement with much of the prosecution’s evidence, which reduced trial time. These considerations led to sentence reductions, resulting in concurrent terms totalling 20 months.

The case underwent an extended timeline. Chan was arrested by the Hong Kong Independent Commission Against Corruption (ICAC) in January 2020. After a detailed investigation, he was charged in November 2022, with his trial beginning in October 2023 and concluding in January 2024.

The HK SFC stated that Chan’s criminal convictions and the court’s findings rendered him unfit and improper to serve as a regulated person under the Hong Kong Securities and Futures Ordinance. Chan was previously registered under that Ordinance to engage in Type 1 (dealing in securities) and Type 4 (advising on securities) regulated activities until October 2019. The judiciary has made the Reasons for Verdict and Reasons for Sentence in case no. DCCC 1157/2022 publicly available on its website.

(Source: https://apps.sfc.hk/edistributionWeb/gateway/EN/news-and-announcements/news/doc?refNo=25PR2)

HK SFC and HKEX Take Action against FingerTango Inc. and Former Directors Over HK$660 Million Losses

On 16 January 2025, the Hong Kong Securities and Futures Commission (HK SFC) and The Stock Exchange of Hong Kong Limited (HKEX) announced their joint enforcement action against FingerTango Inc., an HKEX Main Board-listed company, and its eight former directors for alleged misconduct resulting in losses exceeding HK$660 million. The coordinated efforts led to disciplinary sanctions being imposed by the HKEX and legal proceedings being initiated by the HK SFC at the Court of First Instance.

The case concerns improper investments and loans made by FingerTango and its subsidiaries, which resulted in substantial losses being incurred by the listed group. The misconduct identified by the HKEX in its Statement of Disciplinary Action includes breaches of directors’ duties, inadequate internal oversight, and lax governance policies. The HK SFC is seeking disqualification and compensation orders against the company’s former directors. It is seeking orders for the former directors to compensate Finger Tango for the losses, which the SFC alleges are attributable to the former directors’ breaches of their duties owed to the company.

FingerTango, listed on the HKEX in July 2018, raised significant capital through its initial public offering. However, at the time of listing, the board approved a policy that allowed investment decisions to be made without its approval. Shortly after listing, the company invested HK$450 million in a fund without the board’s knowledge. A partial redemption in December 2019 led to a subsequent investment of HK$250 million in loan notes issued by a small private firm. These investments resulted in a loss of HK$258.75 million following the issuer’s default.

Between May 2020 and March 2021, the company and its subsidiaries entered into 20 loan agreements worth over HK$500 million with 15 borrowers. Over 80% of these loans defaulted, causing an impairment loss of approximately HK$424 million. In total, FingerTango and its subsidiaries incurred combined losses exceeding HK$660 million.

In October 2023, the SFC launched legal proceedings under Section 214 of the Hong Kong Securities and Futures Ordinance (HK SFO) to hold the former directors accountable. The scope of the legal action was expanded in November 2024 to include the defaulted loans from 2020–2021, citing failures to conduct proper due diligence and ensure the implementation of proper internal controls. The directors named in the proceedings include Liu Jie (former chairman and CEO), Wang Zaicheng, Liu Zhanxi, Zhu Yanbin, and other former executives and independent directors.

The HK SFC and HKEX’s coordinated action underscores the importance of proactive governance and robust internal controls. Christopher Wilson, Executive Director of Enforcement at the HK SFC, discussed the role of corporate directors in overseeing management activities and ensuring the integrity of decision-making processes. He noted that lax policies cannot absolve directors of their responsibilities, highlighting the importance of fostering a culture of accountability and ethical conduct.

This enforcement action follows a joint statement issued in July 2023 by the HK SFC and the Hong Kong Accounting and Financial Reporting Council, stressing the need for stringent oversight of financial transactions, particularly loans. The statement called on boards of directors, including audit committees, to safeguard corporate assets and prevent their misuse.

(Source: https://apps.sfc.hk/edistributionWeb/gateway/EN/news-and-announcements/news/enforcement-news/doc?refNo=25PR7)

Hong Kong and Macao Launch Bond Market Linkage in Greater Bay Area Initiative

On 21 January 2025, the Hong Kong Monetary Authority (HKMA) and the Monetary Authority of Macao (AMCM) announced the official launch of a direct linkage between Hong Kong’s Central Moneymarkets Unit (CMU) and Macao’s Central Securities Depository System (CSD). This initiative aims to facilitate seamless cross-border investment and financing between the two regions, marking a significant milestone in financial collaboration within the Guangdong-Hong Kong-Macao Greater Bay Area.

The direct linkage, developed jointly by the HKMA and the AMCM since their announcement in September 2024, connects the CMU operated by CMU OmniClear Limited (a subsidiary of the HKMA) with Macao’s CSD operated by Macao Central Securities Depository and Clearing Limited (a subsidiary of the AMCM). This infrastructure is designed to streamline access for investors in both regions, allowing them to participate in each other’s bond markets more efficiently. The linkage provides a cross-border channel that simplifies trading, settlement, and custody of bond investments while leveraging the unique strengths of both regions.

Mr Eddie Yue, Chief Executive of the HKMA, discussed the significance of the initiative for Hong Kong’s financial ambitions stating: “To enhance the competitiveness of Hong Kong as an international financial centre, the HKMA has established connectivity with various neighbouring financial markets over the years, and continues to explore direct linkages with other central securities depositories. The direct linkage showcases Hong Kong’s role as a “super-connector” and represents a major step towards developing the CMU into an international CSD in Asia.” Meanwhile, Mr Benjamin Chan, Chairman of the AMCM, stated: “The official launch of the direct linkage between the bond markets of Macao and Hong Kong achieved the first connectivity of Macao’s bond market infrastructure established with a CSD located outside of Macao. This will provide international investors, including those from Portuguese-speaking countries, with a convenient channel to participate in the bond markets of Macao and Hong Kong, further strengthening Macao’s function as the financial services platform serving China and Portuguese speaking countries. The AMCM will continue to establish connectivity with the bond markets in Mainland and international markets, to gradually expand new financial services and to support the development of appropriate economic diversification for Macao.”

(Source: https://www.hkma.gov.hk/eng/news-and-media/press-releases/2025/01/20250121-3/)