The Securities and Futures Commission of Hong Kong is going to impose licensing conditions on firms which manage or intend to manage portfolios that invest in virtual assets, irrespective of whether those assets are classified as securities or futures contracts.

The SFC (which regulates most, but not all, futures contracts and securities) believes that the act of investing in virtual assets carries with it some serious risks. These are as follows.

• Valuation, volatility and liquidity. Virtual assets are generally not backed by physical assets. They are also not guaranteed by any government - this is actually a major selling-point for them as few canny investors trust fiat currencies as much as they used to, but the SFC is a governmental creature and this is therefore one of its worries. There are no generally accepted valuation principles that govern certain types of virtual assets - the word 'accepted' presumably meaning 'accepted by a government.' Prices on the secondary market are volatile, as with every new asset.
• Accounting and auditing. There are no agreed accounting standards for auditors who perform 'assurance' procedures that help them to obtain evidence for the existence and ownership of virtual assets or ascertain the reasonableness of the valuations.
• Cybersecurity. Trading platform operators and portfolio managers may store clients' assets in so-called hot wallets (which operate online). These can be prone to hacking.
• Custodial problems. Virtual-asset funds suffer from the limited availability of qualified/effective custodial software.
• Market integrity. Unlike regulated stock exchanges, the market for virtual assets is nascent. 'Outages' are not uncommon. Here the SFC has the audacity to lament the fact that they suffer from market manipulation, a standard feature of all financial markets at all times.
• The likelihood of money laundering and terrorist finance. Virtual assets are generally transacted or held anonymously. Again, the regulator displays some temerity by complaining that investors in these currencies "may not be able to get back their investments as a result of law enforcement action," a fact that is hard to attribute to one market as 99.9% of all laundered money is never recovered. Moreover, some 'investors' (i.e. terrorist financiers who hold virtual currency) do not want to recover their assets and are keen to see them being used by terrorists.
• Conflicts of interest. The operators of virtual asset trading platforms may act as agents for clients as well as principals.
• Fraud. Virtual assets, like all others, may be used as a means to defraud investors.

The SFC is keen to gather more virtual asset portfolio management activities than ever into its regulatory net, citing these drawbacks as a pretext. The Securities and Futures Ordinance does not call for the regulation of the management of funds that invest solely in virtual assets. The regulator, nevertheless, states in no uncertain terms that it is going to regulate firms that manage funds which invest solely in virtual assets that do not constitute securities or futures contracts and distribute the same in Hong Kong, forcing them to become licensed for 'Type 1' regulated activity (dealing in securities) and regulating the management of these funds through the imposition of licensing conditions; and firms which are licensed for 'Type 9' regulated activity (asset management) for managing portfolios in securities and/or futures contracts. Firms which distribute funds that invest solely or partially in virtual assets in Hong Kong will require a 'Type 1' licence.

Terms and conditions

The SFC has developed a set of standard terms and conditions that adapt the existing requirements (which securities and futures firms now obey, including the Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission and the Fund Manager Code of Conduct and guidelines) for virtual assets. These are as follows.

• Firms should only allow professional investors (as defined by the ordinance) to invest in any portfolio under their management with (i) a stated investment objective to invest in virtual assets; or (ii) an intention to invest 10% or more of the gross asset value of the portfolio in virtual assets. They should also describe all the associated risks to potential investors and distributors of their funds.
• They should make appropriate custodial arrangements, according to whether they are in respect of so-called hot wallets, cold wallets or deep cold wallets; the time required to
• transfer the virtual assets to the trading venue; and whether the custodial facilities are secure from cyberattacks and other things.
• When one of them appoints and monitors (a never-ending process) its custodian, it should look at its track record of providing custodial services for virtual assets; its regulatory status; its corporate governance structure; the backgrounds of the senior managers; its financial resources and insurance cover; and its operational capabilities (such as 'wallet' arrangements and cybersecurity risk management).

A hot wallet refers to a Bitcoin wallet that is online and connected in some way to the Internet. A cold wallet is not connected to the Internet and 'deep cold storage' refers to keeping a reserve of Bitcoins offline, using a method that makes retrieving them from storage significantly more difficult than sending them there. A typical example of this would be a memory stick containing an encrypted wallet file lodged in a safe deposit box.

The regulator has no answer to the portfolio valuation problem. It says that firms should call in independent auditors to audit the financial statements of the funds under their management. On the subject of counterparty risk, it calls on firms to set limits in respect of each product and market in which the portfolios invest and of each counterparty to which they 'have exposure.' For example, they should consider setting a cap on the portfolios’ investment in illiquid virtual assets and newly-launched ICO (initial coin offering) tokens. They should also conduct periodic stress-testing to gauge the likely effect of market ructions on these portfolios. The intermediaries division of the SFC is handling things.

The SFC also yearns for the day when it regulates platform operators, lamenting: "Some of the world's largest virtual asset trading platforms have been seen operating in Hong Kong but they fall outside the regulatory remit of the SFC and any other regulators." Today's statement contains a few halcyon visions of a future in which this might be the case.

Guidelines for intermediaries

In an accompanying circular, the SFC provides detailed guidelines and reminds firms which distribute funds that invest in virtual assets that it should be registering or regulating them. It obliges them in Note 5 to look at their 'suitability obligations' when distributing these funds. The main meat of the circular concerns "due diligence on virtual asset funds not authorised by the SFC." It exhorts each intermediary that distributes one of the funds to check the fund manager's background, regulatory status (already regulated is good; not already regulated is bad) and regulatory history; internal controls and systems, which hopefully keep portfolio management, risk management, valuation and custody of assets separate; the people who are allowed to transfer assets from the fund; the people who reconcile transactions and positions; and the people who price each virtual asset and their methods. It also asks them to check the fund manager's IT system and risk management policies and procedures.

When looking at the fund itself, the intermediary should look at the investors it is chasing; the list of instruments in which it intends to trade; its valuation policy; its use of debt, if any; its target return per annum; the risks it runs; and the auditors. It should also look at the legal status, IT systems and track records of the funds' counterparties.

To help clients make informed investment decisions, intermediaries should warn them about such dangers as price volatility; price manipulation; the absence of secondary markets for certain virtual assets; counterparty risk; risk of loss of assets from hot wallets; cyber-risks and the continuing evolution of virtual assets and how this may be affected by global regulatory developments.