Hong Kong regulator may revoke licenses for some crypto exchanges over security flaws

Some cryptocurrency exchanges that have applied for a license to operate legally in Hong Kong might see some of their applications revoked before final approval.

A report from Bloomberg states that Hong Kong’s Securities and Futures Commission (SFC) has found shortcomings in some applicants who are currently “deemed to be licensed.” The regulator has found some virtual asset trading platforms (VATPs) lacking in security.

The SFC discovered the problems while conducting on-site inspections of the applicant’s offices to corroborate compliance with the regulator’s requirements. 

On June 1, 2024, the non-contravention period to apply for a virtual asset service provider (VASP) license in Hong Kong, which was announced the previous year, ended. Following this, any platform that was not bearing the “deemed to be licensed” status given by the SFC was considered an illegal entity.

This temporary classification was designated to platforms already operating in the region before the licensing requirements were introduced.  The platforms approved under this status could remain operational in the area while their applications were being reviewed.

As the grace period for applying for a license came to an end, the SFC, on May 28, announced that it would conduct on-site inspections and would specifically scrutinize the measures these applicants were taking to safeguard client assets while also ensuring that proper customer due diligence processes were being followed.

However, per the Bloomberg report, during its recent inspections, the SFC found that some of these entities were not managing cybersecurity risks properly. Among other issues, some VATPs were heavily reliant on a small number of individuals to oversee client assets.

No exchanges have been named, per an unnamed spokesperson, but the SFC has warned that applicants who don’t address the “critical deficiencies” identified could have their deemed-to-be-licensed status revoked or their applications rejected. In such a scenario, regulations state that a VATP has to submit a plan to disclose how it intends to wind up its operations.

Major exchanges skip Hong Kong license

At the time of publication, the SFC’s website lists 16 exchanges that have applied for a license. The only two approved platforms currently are OSL Exchange and HashKey Exchange.

So far, the SFC has only rejected one application from Meex Digital Securities Limited, but at least 13 exchanges have withdrawn their applications. 

Crypto exchange KuCoin was one of the first platforms to step back, citing regulatory challenges due to charges brought upon by the United States Department of Justice. Seychelles-based OKX, which has its roots in China, also withdrew its application in May but did not provide any specific reason.

In the meantime, regulators expect to bolster cryptocurrency regulations regarding supervision and enforcement in Hong Kong, as suggested by David Chiu, a member of the Legislative Council of the Hong Kong Special Administrative Region. Chiu’s comments came during his speech at the Foresight 2024 annual summit.