Hong Kong Legislative Council Amends AML Regulations to Include VASPs

On December 7, 2022, the Legislative Council of Hong Kong passed an amendment to the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) that introduces a licensing regime for virtual asset service providers (VASPs).

According to the Secretary for Financial Services and the Treasury, Mr. Christopher Hui, the amendment reinforces Hong Kong’s status as an international financial center. At its core, the updated licensing regime formulates a “comprehensive and balanced regulatory framework” for virtual asset activities to protect investors and enhance Hong Kong’s regulatory regime for combating money laundering and terrorist financing. 

Initially, the new licensing regime was scheduled to go into operation on March 1, 2023. However, the Hong Kong Monetary Authority (HKMA) has since moved the date to June 1, 2023, to provide VASPs with more preparation time.

AMLO Amendments

Hong Kong’s amendment of the AMLO aligns with Recommendation 15 set out by the Financial Action Task Force (FATF), which requires VASPs to be regulated for anti-money laundering and countering the financing of terrorism (AML/CFT) purposes. According to the FATF, VASPs should also be licensed and subject to effective systems for monitoring or supervision.

Under the amended AMLO, VASPs will be required to:

• Apply for a license from the Securities and Futures Commission (SFC)
• Satisfy the “fit and proper test” and comply with anti-money laundering and counter-terrorist financing (AML/CTF) requirements, such as customer due diligence (CDD) and record-keeping
• Regularly submit audited accounts and financial information to the SFC
• Appoint at least two responsible officers who will be generally responsible for overseeing the operation of the licensed VASP and ensuring compliance with the AML/CTF and other regulatory requirements
• Seek the SFC’s approval of the premises to be used for keeping records

The update also introduces a two-tier registration regime for precious metals and stones dealers. Dealers that intend to engage in non-cash transactions at or above HK$120,000 will fall into Category A. These registrants will not be required to implement specified measures on CDD and record keeping. However, dealers seeking to engage in cash transactions at or above $120,000 will fall into Category B and be subject to AML/CTF supervision, as required by the FATF. 

Regarding this sector, firms should be aware that recent research by the think-tank, RUSI, found that dealers in precious metals and stones (DPMS) are at a particularly high risk of being involved in the evasion of economic sanctions, particularly by North Korea. 

Further amendments to the AMLO relevant to the banking sector include:

• An updated definition of politically exposed persons (PEPs) to align with FATF requirements
• Clarity around using recognized digital identification systems for the purposes of CDD and satisfying the additional requirements where a customer is not physically present for identification purposes
• Clarifying who a beneficial owner is where trusts are concerned

Policy Statement on the Development of Virtual Assets

The AMLO amendment follows a policy statement issued by the government on October 31 during Hong Kong FinTech Week. Focusing on Hong Kong’s vision and approach, regulations, and pilot programs, the policy statement sets out the government’s stance toward developing a “vibrant sector and ecosystem for virtual assets in Hong Kong.”  

As highlighted in the policy statement, compliance professionals should ensure they remain up-to-date with Hong Kong’s forthcoming pilot projects that aim to test the technological benefits of virtual assets and their further applications in the financial markets. 

Additionally, firms should look out for the SFC’s upcoming public consultation on how retail investors could be given suitable access to virtual assets.

Key Takeaways

VASP compliance teams should ensure they fully understand their new compliance obligations under the AMLO, reading the FATF’s Recommendation 15 and its interpretive note for clarity. 

Risk-based VASP AML/CFT controls include:

• CDD: VASPs should establish and verify the identities of their customers before commencing business relationships. The CDD process should involve names, addresses, and dates of birth. However, digital identifiers such as scans of official documents and biometric information may also be necessary in a cryptocurrency context. 
• Transaction monitoring: VASPs should monitor their customers’ transactional behavior to spot activity that does not match their established risk profile and could indicate criminal activity. 
• Screening and monitoring: VASPs should screen their customers against international sanctions and watchlists for PEP status and their involvement in adverse media stories. 
• Smart technology tools: Given the vast amount of digital transaction data involved in digital regulatory compliance, VASPs should seek to implement a suitable technological solution to meet their AML/CFT obligations.