Joint Circular on Intermediaries’ Virtual Asset-Related Activities

Appendix 1 Non-exhaustive criteria for assessing whether a client can be regarded as having knowledge of virtual assets

1. Whether the client has undergone training or attended courses on virtual assets or VA￾related products;
2. Whether the client has current or previous work experience related to virtual assets or VA-related products; or
3. Whether the client has prior trading experience in virtual assets or VA-related products.

Appendix 2 List of designated jurisdictions for exchange-traded unauthorised VA derivative funds ▪ Australia ▪ France ▪ Germany ▪ Ireland ▪ Luxembourg ▪ Malaysia ▪ The Netherlands ▪ Switzerland ▪ Taiwan, China ▪ Thailand ▪ United Kingdom ▪ United States of America

Appendix 3 Funds traded on the SEHK and authorised by the SFC Non-derivative products Derivative products Other unlisted products Unlisted funds authorised by the SFC8 Complex product Complex product Complex exchange￾traded non￾derivative VA fund Other listed/ unlisted products • VA knowledge test & risk disclosure • Derivative product requirements6 • Complex product requirements4 • For professional investors only5 • VA knowledge test & risk disclosure • VA knowledge test & risk disclosure • Complex product requirements4 • For professional investors only5 • VA knowledge test & risk disclosure • Complex product requirements4 1 Virtual asset-related products refer to investment products which: (a) have a principal investment objective or strategy to invest in virtual assets; (b) derive their value principally from the value and characteristics of virtual assets; or (c) track or replicate the investment results or returns which closely match or correspond to virtual assets. 2 “Specified exchange” refers to the list of specified exchanges in Schedule 3 to the Securities and Futures (Financial Resources) Rules and the Stock Exchange of Hong Kong Limited (SEHK). 3 This refers to exchange-traded VA funds traded on specified exchanges and authorised or approved in a designated jurisdiction for offering to retail investors by the respective regulator. 3A “Designated jurisdictions” are Australia; France; Germany; Ireland; Luxembourg; Malaysia; the Netherlands; Switzerland; Taiwan, China; Thailand; the United Kingdom and the United States. 4 This includes ensuring suitability, minimum information and warning statements. 5 In addition to existing selling restrictions, only professional investors will be allowed to invest in the product if it is classified as complex. 6 This refers to paragraphs 5.1A (derivative knowledge assessment) and 5.3 (eg, ensure sufficient net worth) of the Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission. 7 The non-exhaustive list of examples of non-complex and complex products can be accessed at https://www.sfc.hk/en/Rules-and-standards/Suitability-requirement/Non-complex-and-complex-products. 8 This includes the unlisted share/ unit class of VA ETFs authorised by the SFC. Assess factors in paragraph 6.1 of the Guidelines on Online Distribution and Advisory Platforms (Guidelines) and subject to paragraph 6.2 of the Guidelines Traded on a specified exchange2 and, in the case of funds, also authorised by the SFC/ approved in a designated jurisdiction3 3A Traded on a non￾specified exchange2 or, in the case of funds, not authorised by the SFC/ not approved in a designated jurisdiction3 3A Investment products with exposure to virtual assets Exercise caution when determining whether the product is the same type as a complex exchange-traded derivative product in the list of examples of non￾complex and complex products7 • VA knowledge test & risk disclosure • Derivative product requirements6 • Complex product requirements4 • For professional investors only5 Complex exchange-traded derivatives under para 6.5 of the Guidelines • VA knowledge test & risk disclosure • Derivative product requirements6 • Complex product requirements4 • Derivative product requirements6 (where applicable) Virtual asset related products1 • Follow existing applicable requirements Yes OR No Yes OR OR Determine whether the product is the same type as a non-complex product in the list of examples of non￾complex and complex products7 No No Yes Non-complex product Unlisted funds authorised by the SFC8 • VA knowledge test & risk disclosure • Derivative product requirements6 • Complex product requirements4

• This flowchart is for illustration purposes only. Please refer to the Joint circular on intermediaries’ virtual asset-related activities issued by the SFC and the HKMA regarding the specific requirements for determining whether or not a virtual asset-related product is a complex product.

Appendix 4 Product due diligence – non-SFC authorised VA funds Additional due diligence requirements Intermediaries distributing VA funds which are not authorised by the SFC should conduct proper due diligence on the funds as well as their fund managers and the parties which provide trading and custodian services for the funds. This should include, but is not limited to, scrutinising the fund’s constitutive documents and due diligence questionnaire and making enquiries with the fund manager to develop an in-depth understanding of the following matters where applicable: (A) About the fund manager (a) General ▪ Its background, relevant experience and, where applicable, the track record of its senior management, including its chief investment, operation, risk and technology officers; ▪ its regulatory status, for example, whether the fund manager is subject to any regulatory oversight and its robustness; and ▪ its compliance history, for example, whether any regulatory authorities have taken any disciplinary or regulatory actions against it. (b) Operations ▪ its internal controls and systems, for example: − whether there is a proper segregation of key functions, such as portfolio management, risk management, valuation and custody of assets, and, if not, whether there are any adequate compensating controls to prevent abuse; − the persons who can transfer assets from the fund or custodians and what safeguards are in place; − the persons responsible for and the procedures for reconciling transactions and positions, including the frequency at which such reconciliations are performed; − the methodology and persons responsible for determining the pricing and assessment of the reasonableness of the determined price of each virtual asset; and − the measures adopted by the fund manager to mitigate the risks of money laundering and terrorist financing, especially in respect of subscriptions made by fund investors in virtual assets (where applicable).

2 (c) IT system ▪ its IT infrastructure (for example, its security and access management). (d) Risk management ▪ its risk management procedures, including concentration limits, counterparty risk management procedures, stop-loss arrangements and stress testing; ▪ its liquidity risk management policy; ▪ its risk management policy for other risks associated with VA fund management, for example, hacking or other technology-related risks; and ▪ its disaster recovery plan. (B) About the fund (a) the fund’s targeted investors; (b) the list of instruments the fund intends to trade or invest in and any limitations on the size of its virtual asset holdings issued by way of an initial coin offering (ICO Tokens), pre-ICO Tokens or other illiquid or hard-to-value instruments; (c) the fund’s valuation policy (especially for ICO Tokens, pre-ICO Tokens or other illiquid or hard-to-value instruments); (d) the custody arrangement of the fund assets, including the policy for allocating assets to be kept at different host locations, such as exchanges, custodians, hot storage and cold storage; (e) the use of leverage and derivatives by the fund; (f) the fund’s targeted risk and return per annum; (g) the fund’s key risks (please refer to the “Information for clients” section in Appendix 5 to this circular); (h) the fund’s auditors and audited financial statements, including whether the fund received a qualified audit opinion in the past, and whether the audited statements are up-to-date; and (i) the exchanges on which the fund are traded. (C) About the fund’s counterparties (a) their legal and regulatory status (ie, whether they are regulated by any authorities to, amongst other things, undertake custody business or trade in virtual assets);

3 (b) their experience and track record in dealing with virtual assets; (c) the robustness of their IT systems (including cybersecurity risk management measures) and contingency plans; and (d) their financial soundness and insurance coverage, for example, to cover losses of customer assets.

4 Appendix 5 Information for clients investing in VA-related products – a non￾exhaustive list of risk disclosure statements For virtual asset futures contracts, in addition to disclosing the general risks of trading in futures contracts, risk disclosure statements should also cover the risks specific to virtual asset futures contracts, such as: (a) the risks of the underlying virtual assets (eg, insufficient liquidity, high price volatility and potential market manipulation) may be magnified in trading virtual asset futures contracts by the speculative nature of the underlying virtual assets and the leverage inherent in futures contracts; and (b) the difficulty of valuing the underlying virtual assets poses significant challenges for investors in reliably valuing virtual asset futures contracts. For all VA-related products, in addition to disclosing the risks specific to the product, the risk disclosure statements should cover, amongst other things, and where applicable: (a) the continuing evolution of virtual assets and how this may be affected by global regulatory developments; (b) legal uncertainty on whether virtual assets can be regarded as “property” under the law; (c) difficulties in verifying the ownership of virtual assets; (d) price volatility; (e) potential price manipulation on trading, lending or other dealing platforms; (f) a lack of secondary markets for certain virtual assets; (g) most trading, lending or other dealing platforms and custodians of virtual assets are presently unregulated; (h) counterparty risk when effecting transactions with issuers, private buyers and sellers or through trading, lending or other dealing platforms; (i) risk of the loss of virtual assets, especially if held in “hot wallets”; (j) hacking and technology-related risks; and (k) new risks which may arise from investing in new types of virtual assets or market participants’ engagement in more complex transaction strategies.

Licensing or registration conditions and terms and conditions for licensed corporations or registered institutions providing virtual asset dealing services and virtual asset advisory services October 2023 Appendix 6

2 Contents Part I – Virtual asset dealing services Licensing or registration conditions for licensed corporations or registered institutions acting as introducing agents for virtual asset trading platform operators 3 Licensing or registration conditions for licensed corporations or registered institutions providing virtual asset dealing services under an omnibus account arrangement 5 Terms and conditions for licensed corporations or registered institutions providing virtual asset dealing services under an omnibus account arrangement 6 I. Interpretation 6 II. Codes and guidelines 7 III. Financial soundness 7 IV. Operations 7 V. Prevention of market manipulative and abusive activities 9 VI. Dealing with clients 10 VII. Custody of client assets 18 VIII. Record keeping 22 IX. Auditors 26 X. Conflicts of interest 26 XI. Ongoing reporting obligations 26 Schedule 1 – Existing regulatory requirements applicable to licensed corporations or registered institutions providing virtual asset dealing services under an omnibus account arrangement 27 Part II – Virtual asset advisory services Licensing or registration conditions for licensed corporations or registered institutions providing virtual asset advisory services 29 Terms and conditions for licensed corporations or registered institutions providing virtual asset advisory services 30 I. Interpretation 30 II. Codes and guidelines 31 III. Virtual asset-knowledge test and suitability 31

3 Part I – Virtual asset dealing services Licensing or registration conditions for licensed corporations or registered institutions acting as introducing agents for virtual asset trading platform operators (a) With respect to introducing clients to virtual asset trading platform operators, the licensee or registered institution shall only engage in the introduction of persons to establish accounts with an SFC-licensed virtual asset trading platform (SFC-licensed platform) to effect dealing in or make offers to deal in virtual assets directly. The licensee or registered institution shall not communicate any offers to effect dealings in virtual assets to the SFC-licensed platform. Prior to introducing clients to establish accounts with an SFC-licensed trading platform, the licensee or registered institution should enter into a written client agreement with clients which should set out a clear description of the nature of the services to be provided to or available to the client, including the role and obligation of the licensee or registered institution and that it would not provide any dealing, financial accommodation, settlement or custody services. The term “SFC-licensed platform” means a virtual asset trading platform operator which is licensed by the SFC pursuant to section 116 of the Securities and Futures Ordinance and/or section 53ZRK of the Anti-Money Laundering and Counter￾Terrorist Financing Ordinance (AMLO). The term “virtual asset” is defined in section 53ZRA of the AMLO. (b) (i) [For licensee or registered institution which provides services to retail investors and/ or professional investors] With respect to introducing clients to virtual asset trading platform operators, the licensee or registered institution shall only introduce persons which are its clients in respect of its business in Type 1 regulated activity (dealing in securities). The term “dealing in securities” is specified in Part 2 of Schedule 5 to the Securities and Futures Ordinance. (ii) [For licensee or registered institution which only provides services to professional investors] With respect to introducing clients to virtual asset trading platform operators, the licensee or registered institution shall only introduce persons which are professional investors and are its clients in respect of its business in Type 1 regulated activity (dealing in securities). The term “professional investor” is defined in section 1 of Part 1 of Schedule 1 to the Securities and Futures Ordinance (SFO) together with the Securities and Futures (Professional Investor) Rules. The term “dealing in securities” is specified in Part 2 of Schedule 5 to the SFO. (c) With respect to introducing clients to virtual asset trading platform operators, the licensee or registered institution shall not hold client assets. • The term “hold” is as defined under the Securities and Futures Ordinance; and • The term “client assets” means: (i) “client virtual assets”, which means any virtual assets received or held by the licensee or registered institution, which are so received or held on behalf of a client or in which a client has a legal or equitable interest, and includes any rights thereto. The term “virtual asset” is defined in section

4 53ZRA of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance; and (ii) “client money”, which means any money received or held by the licensee or registered institution, which is so received or held on behalf of a client or in which a client has a legal or equitable interest, and includes any accretions thereto whether as capital or income.

5 Licensing or registration conditions for licensed corporations or registered institutions providing virtual asset dealing services under an omnibus account arrangement (a) With respect to providing virtual asset dealing services, the licensee or registered institution shall only provide such services through operating an omnibus account established and maintained with an SFC-licensed platform. The term “SFC-licensed platform” refers to a virtual asset trading platform operator which is licensed by the SFC pursuant to section 116 of the Securities and Futures Ordinance and/or section 53ZRK of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO). The term “virtual asset” is defined in section 53ZRA of the AMLO. (b) (i) [For licensee or registered institution which provides services to retail investors and/ or professional investors] With respect to providing virtual asset dealing services, the licensee or registered institution shall only provide such services to persons which are, and remain at all times, its clients in respect of its business in Type 1 regulated activity (dealing in securities). The term “dealing in securities” is specified in Part 2 of Schedule 5 to the Securities and Futures Ordinance. The term “virtual asset” is defined in section 53ZRA of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance. (ii) [For licensee or registered institution which only provides services to professional investors] With respect to providing virtual asset dealing services, the licensee or registered institution shall only provide such services to professional investors which are, and remain at all times, its clients in respect of its business in Type 1 regulated activity (dealing in securities). The term “professional investor” is defined in section 1 of Part 1 of Schedule 1 to the Securities and Futures Ordinance (SFO) together with the Securities and Futures (Professional Investor) Rules. The term “dealing in securities” is specified in Part 2 of Schedule 5 to the SFO. The term “virtual asset” is defined in section 53ZRA of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance. (c) With respect to providing virtual asset dealing services, the licensee or registered institution shall comply with the attached “Terms and conditions for licensed corporations or registered institutions providing virtual asset dealing services under an omnibus account arrangement” (as amended from time to time). The term “virtual asset” is defined in section 53ZRA of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance.

6 Terms and conditions for licensed corporations or registered institutions providing virtual asset dealing services under an omnibus account arrangement I. Interpretation A reference in these Terms and conditions for licensed corporations or registered institutions providing virtual asset dealing services under an omnibus account arrangement (Terms and conditions) to: ▪ “AMLO” means the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615); ▪ “authorized financial institution” means an authorized institution as defined in section 2(1) of the Banking Ordinance (Cap. 155); ▪ “client” means a person to whom the licensed corporation or registered institution provides services in Relevant VA Dealing Activities (see below); ▪ “client asset” means client virtual assets and client money; ▪ “client money” means any money received or held by or on behalf of the licensed corporation or registered institution, which is so received or held on behalf of a client or in which a client has a legal or equitable interest, and includes any accretions thereto whether as capital or income; ▪ “client virtual asset” means any virtual asset received or held by or on behalf of the licensed corporation or registered institution, which is so received or held on behalf of a client or in which a client has a legal or equitable interest, and includes any rights thereto; ▪ “group of companies” is defined in section 1 of Part 1 of Schedule 1 to the SFO; ▪ “licensed corporation” means a corporation which is licensed by the SFC and upon which these Terms and conditions are imposed by way of a licensing condition pursuant to section 116 of the SFO; ▪ “professional investor” is defined in section 1 of Part 1 of Schedule 1 to the SFO; ▪ “registered institution” means an authorized financial institution which is registered with the SFC and upon which these Terms and conditions are imposed by way of a registration condition pursuant to section 119 of the SFO; ▪ “Relevant VA Dealing Activities” means any virtual asset dealing activities carried out by the licensed corporation or registered institution on behalf of its clients through operating an omnibus account established and maintained with an SFC￾licensed platform; ▪ “retail client” or “retail investor” means any person other than a professional investor; ▪ “SFC-licensed platform” means a virtual asset trading platform operator which is

7 licensed by the SFC pursuant to section 116 of the SFO and/or section 53ZRK of the AMLO; ▪ “SFO” means the Securities and Futures Ordinance (Cap. 571); and ▪ “virtual asset” means any “virtual asset” as defined in section 53ZRA of the AMLO. II. Codes and guidelines 2.1 In conducting Relevant VA Dealing Activities, to the extent not already covered elsewhere in these Terms and conditions, a licensed corporation or registered institution is expected to observe the requirements of the codes and guidelines (as supplemented by circulars, frequently asked questions (FAQs) and other related guidance issued by the SFC from time to time) listed in Schedule 1 hereto as if: (i) any reference to a financial product (for example, securities) or investment product included virtual assets; (ii) any reference to a client included a person to whom a licensed corporation or registered institution provides services in Relevant VA Dealing Activities; (iii) any reference to client assets included client virtual assets; and (iv) any reference to regulated activities included Relevant VA Dealing Activities. III. Financial soundness 3.1 In addition to the requirements under the Securities and Futures (Financial Resources) Rules (Cap. 571N), a licensed corporation should maintain in Hong Kong at all times excess liquid capital equivalent to at least 12 months of its actual operating expenses1 calculated on a rolling basis. IV. Operations 4.1 A licensed corporation or registered institution should only establish and maintain an omnibus account (designated as a trust or client account) with an SFC-licensed platform. Furthermore, if the licensed corporation or registered institution provides services in Relevant VA Dealing Activities to retail clients, the licensed corporation or registered institution should ensure that: (a) the Relevant VA Dealing Activities are conducted through an omnibus account established and maintained with an SFC-licensed platform which is not subject to the licensing condition that it can only serve professional investors; and (b) the retail clients of the licensed corporation or registered institution can only trade in those virtual assets that are made available for trading by retail investors by the SFC-licensed platform mentioned in subparagraph (a) above. 1 This refers to the total amount of overheads reported under Form 7 of the financial returns, excluding the amounts representing depreciation and provision for bad and doubtful debts.

8 For the avoidance of doubt, the licensed corporation or registered institution may establish and maintain omnibus accounts with multiple SFC-licensed platforms. 4.2 A licensed corporation or registered institution should only execute transactions for a client on the platform of the SFC-licensed platform. 4.3 A licensed corporation or registered institution should execute a trade for a client through the omnibus account only if there are sufficient fiat currencies or virtual assets in the client’s account to cover that trade. 4.4 A licensed corporation or registered institution should not provide any financial accommodation2 for its clients to acquire virtual assets and should ensure, to the extent possible, that no corporation within the same group of companies as the licensed corporation or registered institution does so. 4.5 A licensed corporation or registered institution should not make any arrangements with its clients on using the client virtual assets received or held by the licensed corporation or registered institution with the effect of generating returns for the clients or any other parties. 4.6 Where a client is entitled to voting rights arising out of its ownership of a virtual asset, upon notification by the SFC-licensed platform, the licensed corporation or registered institution should inform the client how those voting rights will be handled by the SFC￾licensed platform and the licensed corporation or registered institution. 4.7 For orders in virtual assets (including virtual assets classified as complex products3 ) which are placed by a client directly on the trading platform of a licensed corporation or registered institution or directly to staff of the licensed corporation or registered institution for onward passing to the SFC-licensed platform for execution, the licensed corporation or registered institution is not required to ensure that the transaction is suitable for the client if there has been no solicitation or recommendation made by the licensed corporation or registered institution. 4.8 Where a licensed corporation or registered institution is authorized by a client in writing to operate the client’s account for trading securities on a discretionary basis as an ancillary service and the client has further authorized the licensed corporation or registered institution to operate the client’s account to trade in virtual assets on a discretionary basis, the licensed corporation or registered institution should only invest less than 10% of the gross asset value of the client’s account in virtual assets. 4.9 Where a licensed corporation or registered institution makes a solicitation or recommendation or provides advisory services to retail clients on virtual assets, the licensed corporation or registered institution should take all reasonable steps to ensure that the virtual assets solicited or recommended: (i) is of high liquidity. In assessing the liquidity of a specific virtual asset for trading by retail clients, the licensed corporation or registered institution should, at a minimum, ensure that the virtual asset is an eligible large-cap virtual asset, ie, the 2 This term is defined in section 1 of Part 1 of Schedule 1 to the SFO. 3 “Complex product” refers to an investment whose terms, features and risks are not reasonably likely to be understood by a retail investor because of its complex structure, having regard to the factors set out in paragraph 5.5 of the Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission (Code of Conduct)/paragraph 6.1 of the Guidelines on Online Distribution and Advisory Platforms.

9 specific virtual asset should have been included in a minimum of two acceptable indices issued by at least two different index providers; and Note 1: An acceptable index refers to an index which has a clearly defined objective to measure the performance of the largest virtual assets in the global market, and should fulfil the following criteria: (a) The index should be investible, meaning the constituent virtual assets should be sufficiently liquid; (b) The index should be objectively calculated and rules-based; (c) The index provider should possess the necessary expertise and technical resources to construct, maintain and review the methodology and rules of the index; (d) The methodology and rules of the index should be well documented, consistent and transparent. Note 2: The two index providers should be separate and independent from each other, the issuer of the virtual asset (if applicable) and the licensed corporation or registered institution (for example, they are not within the same group of companies). Further, at least one of the indices should be issued by an index provider which complies with the IOSCO Principles for Financial Benchmarks and has experience in publishing indices for the conventional securities market. (ii) is made available by SFC-licensed platforms for trading by retail investors. 4.10 A licensed corporation or registered institution should adopt a fee structure that is clear, fair and reasonable in the circumstances and characterized by good faith. In relation to Relevant VA Dealing Activities, the licensed corporation or registered institution should clearly set out how different fees may apply based on the type of order (including whether the client is providing or taking liquidity), transaction size and type of virtual assets transacted (if applicable). V. Prevention of market manipulative and abusive activities 5.1 A licensed corporation or registered institution should establish and implement written policies and controls for identifying any red flags which may arouse reasonable suspicions of market manipulative or abusive trading activities, such as anomalies in trading patterns and the potential use of abusive trading strategies. 5.2 Upon becoming aware of any actual or potential market manipulative or abusive activities, a licensed corporation or registered institution should notify the SFC as soon as practicable, take immediate steps to prevent these activities from continuing and provide the SFC with additional assistance in connection with such activities as it might request.

10 VI. Dealing with clients 6.1 Except for institutional and qualified corporate professional investors4 , a licensed corporation or registered institution should assess a client’s knowledge of virtual assets (including knowledge of relevant risks associated with virtual assets) before providing any services to the client5 .

6.2 Where the client does not possess such knowledge, a licensed corporation or registered institution may only provide services in Relevant VA Dealing Activities to the client if the licensed corporation or registered institution has provided adequate training to the client. 6.3 Except for institutional and qualified corporate professional investors, a licensed corporation or registered institution, before providing services in Relevant VA Dealing Activities, should assess a client’s risk tolerance level, accordingly determine the client’s risk profile and assess whether it is suitable for the client to participate in the trading of virtual assets. The licensed corporation or registered institution should exercise due skill, care and diligence to ensure the methodology for risk profiling is properly designed and should determine the client’s risk profile based on an assessment of the information about the client obtained through its know-your-client process. The methodology adopted for categorising clients and an explanation of the risk profiles of clients should be made available to the client6 . 6.4 Except for institutional and qualified corporate professional investors, a licensed corporation or registered institution should set a limit for each client to ensure that the client’s exposure to virtual assets is reasonable, with reference to the client’s financial situation (including the client’s net worth) and personal circumstances7 . The licensed corporation or registered institution should notify the client of the assigned limit and review this limit regularly to ensure that it remains appropriate. 6.5 A licensed corporation or registered institution should ensure that it complies with the applicable laws and regulations in the jurisdictions in which it provides services. In particular, it should establish and implement measures which include: (a) ensuring its marketing activities are only conducted in permitted jurisdictions without violation of the relevant restrictions on offers of investments; and (b) implementing measures to prevent persons from jurisdictions which have banned trading in virtual assets from accessing its services (for example, by checking IP addresses and blocking access). For the avoidance of doubt, the licensed corporation or registered institution should also implement appropriate measures 4 Same definitions as in paragraph 15 of the Code of Conduct. “Qualified corporate professional investors” refers to corporate professional investors which have passed the assessment requirements under paragraph 15.3A and gone through the procedures under paragraph 15.3B of the Code of Conduct. 5 The following are some non-exhaustive criteria for assessing whether a client can be regarded as having knowledge of virtual assets: (i) whether the client has undergone training or attended courses on virtual assets; (ii) whether the client has current or previous work experience related to virtual assets; or (iii) whether the client has prior trading experience in virtual assets. 6 Where risk-scoring questionnaires are used to risk profile clients, the licensed corporation or registered institution should pay particular attention to the design of the questions and the underlying scoring mechanism, which should be properly designed to accurately reflect the personal circumstances of a client. The licensed corporation or registered institution should also have appropriate processes in place to periodically review the risk profiling methodology and mechanism for clients. 7 The licensed corporation or registered institution should take into account the client’s overall holdings in virtual assets (held by the licensed corporation or registered institution or otherwise) on a best efforts basis.

11 to detect and prevent persons who are attempting to circumvent the relevant jurisdictions’ ban on trading virtual assets (for example, by using a virtual private network to mask their IP addresses) from accessing its services. Client identity: origination of instructions and beneficiaries 6.6 A licensed corporation or registered institution should be satisfied on reasonable grounds about8 : (a) the identity, address and contact details of: (i) the person or entity (legal or otherwise) ultimately responsible for originating the instruction in relation to a transaction; (ii) the person or entity (legal or otherwise) that stands to gain the commercial or economic benefit of the transaction, bear its commercial or economic risk or both gain the benefit and bear its risks; and (b) the instruction given by the person or entity referred to in paragraph 6.6(a)(i) above. 6.7 A licensed corporation or registered institution should not do anything to effect a transaction unless it has complied with, and kept records in Hong Kong of the details referred to in, paragraph 6.6 above. 6.8 In relation to a collective investment scheme or discretionary account, the “entity” referred to in paragraph 6.6 above is the collective investment scheme or account, and the manager of that collective investment scheme or account, not those who hold a beneficial interest in that collective investment scheme or account. Client agreement 6.9 In conducting any Relevant VA Dealing Activities, a licensed corporation or registered institution should enter into a written client agreement with each client9 in the same manner as set out in paragraph 6 of the Code of Conduct and include a provision stating that: “In conducting any Relevant VA Dealing Activities, if we [the licensed corporation or registered institution] solicit the sale of or recommend any product including any virtual assets to you [the client], the product must be reasonably suitable for you, having regard to your financial situation, investment experience and investment objectives. No other provision of this agreement or any other document we may ask you to sign and no statement we may ask you to make derogates from this clause.” Disclosure 6.10 Except for institutional and qualified corporate professional investors, a licensed 8 The licensed corporation or registered institution must satisfy itself about and record information that identifies those who are really behind a transaction; those who ultimately originate instructions in relation to a transaction and those who ultimately benefit from, or bear the risk of, that transaction. The SFC is concerned about the substance of what is going on with a transaction and not the technicalities. 9 Except for institutional and qualified corporate professional investors.

12 corporation or registered institution should fully disclose the nature and risks that clients may be exposed to when dealing in virtual assets10 . All information provided to clients should be presented in a clear and fair manner which is not misleading. The disclosed risks should, amongst other things, include: (a) virtual assets are highly risky and investors should exercise caution in relation to these products; (b) a virtual asset may or may not be considered as “property” under the law, and such legal uncertainty may affect the nature and enforceability of a client’s interest in such virtual asset; (c) the offering documents or product information provided by the issuer have not been subject to scrutiny by any regulatory body; (d) the protection offered by the Investor Compensation Fund does not apply to transactions involving virtual assets (irrespective of the nature of the tokens); (e) a virtual asset is not legal tender, ie, it is not backed by the government and authorities; (f) transactions in virtual assets may be irreversible, and, accordingly, losses due to fraudulent or accidental transactions may not be recoverable; (g) the value of a virtual asset may be derived from the continued willingness of market participants to exchange fiat currencies for a virtual asset, which means that the value of a particular virtual asset may be completely and permanently lost should the market for that virtual asset disappear. There is no assurance that a person who accepts a virtual asset as payment today will continue to do so in the future; (h) the extreme volatility and unpredictability of the price of a virtual asset relative to fiat currencies may result in a total loss of the investment over a short period of time; (i) legislative and regulatory changes may adversely affect the use, storage, transfer, exchange and value of virtual assets; (j) some virtual asset transactions may be deemed to be executed only when they are recorded and confirmed by an SFC-licensed platform, which may not necessarily be the time at which the client initiates the transaction; (k) the nature of virtual assets exposes them to an increased risk of fraud or cyberattack; and (l) the nature of virtual assets means that technological difficulties experienced by an SFC-licensed platform may prevent clients from dealing in their virtual assets. 6.11 A licensed corporation or registered institution should also disclose the following information in relation to its Relevant VA Dealing Activities: 10 A one-off disclosure made by the licensed corporation or registered institution prior to entering into a virtual asset transaction is acceptable.

13 (a) its services in relation to Relevant VA Dealing Activities are only available to professional investors (where applicable); (b) transactions for a client will only be executed on the platform of an SFC-licensed platform; (c) name and website of the SFC-licensed platform through which client transactions are executed and settled; (d) list of virtual assets available for trading by its retail clients (where applicable); (e) relevant information of the virtual assets available for trading or inform clients where such information could be accessed, such as the website of the SFC￾licensed platform; (f) the licensed corporation or registered institution will only execute a trade for a client if there are sufficient fiat currencies or virtual assets in the client’s account to cover that trade; and (g) trading hours and other trading and operational matters. Provision of contract notes, statements of account and receipts to clients 6.12 A licensed corporation or registered institution should provide to each client timely and meaningful information about the transactions conducted with the client or on the client’s behalf, the client’s holdings and movements of client virtual assets and fiat currencies, and other activities in the client’s account. Where contract notes, statements of account and receipts are provided by a licensed corporation or registered institution to a client, the licensed corporation or registered institution should ensure that the information included in the contract notes, statements of account and receipts is fit for purpose, comprehensive and accurate in respect of the particular type of virtual asset involved. Contract notes (a) Where a licensed corporation or registered institution enters into a relevant contract with or onbehalf of a client, it must prepare and provide a contract note to the client no later than the end of the second business day after entering into the relevant contract. The term “relevant contract” means a contract, entered into by a licensed corporation or registered institution with or on behalf of a client in the conduct of its businesses which constitute any Relevant VA Dealing Activities, that is a contract for dealing in virtual assets. (b) Where a licensed corporation or registered institution enters into more than one relevant contract with or on behalf of a client on the same day, unless the client has given contrary instructions to the licensed corporation or registered institution, the licensed corporation or registered institution may prepare a single contract note which: (i) records all of those relevant contracts; and

14 (ii) in respect of each of those relevant contracts, includes all of the information which would have been required to be included in the contract note. (c) If such a single contract note is prepared, the licensed corporation or registered institution should provide it to the client no later than the end of the second business day after entering into those relevant contracts. (d) A contract note should include, to the extent applicable, the following information: (i) the name under which the licensed corporation or registered institution carries on business; (ii) the name and account number of the client; (iii) full particulars of the relevant contract including: (1) the quantity, name, description and such other particulars of the virtual asset involved, as are sufficient to enable it to be identified; (2) the nature of the dealing; (3) the date (i) on which the relevant contract is entered into; (ii) of settlement or performance of the relevant contract; and (iii) on which the contract note is prepared; (4) the name of the SFC-licensed platform on which the relevant contract has been executed; (5) the price per unit of the virtual asset traded; (6) the rate or amount of commission payable in connection with the relevant contract; (7) the rate or amount of fees and charges payable in connection with the relevant contract; and (8) the amount of consideration payable under the relevant contract. (e) Where a licensed corporation or registered institution has entered into a relevant contract with or on behalf of a client, it may, at the request of the client, include in the contract note in respect of the relevant contract, the average price per unit for the purchase or sale (as the case may be) of the same description of virtual assets, rather than the price per unit as referred to in subparagraph (d)(iii)(5) above. (f) A licensed corporation or registered institution may, instead of preparing and providing to a client one or more than one contract note under subparagraph (a) above in respect of one or more than one relevant contract entered into on the same day, consolidate the contract note with any statement of account it is required to prepare and provide to the client under sections 8 or 9 (or any consolidation of such statements of account under section 10) of the Securities and Futures (Contract Notes, Statements of Account and Receipts) Rules (Cap.

15 571Q) in respect of the same day. Monthly statements of account (g) Where any of the following circumstances applies, a licensed corporation or registered institution should prepare and provide a monthly statement of account to its client no later than the end of the seventh business day after the end of the monthly accounting period: (i) during a monthly accounting period, the licensed corporation or registered institution is required to prepare and provide to the client a contract note or receipt; (ii) at any time during a monthly accounting period, the client has an account balance which is not nil; or (iii) at any time during a monthly accounting period, any client virtual assets are held for the account of the client. (h) Where a licensed corporation or registered institution is required to prepare a monthly statement of account, it should include the following information: (i) the name under which the licensed corporation or registered institution carries on business; (ii) the name, address and account number of the client to whom the licensed corporation or registered institution is required to provide the statement of account; and (iii) the date on which the statement of account is prepared. (i) A licensed corporation or registered institution should also include, to the extent applicable, the following information in the monthly statement of account: (i) the address of the licensed corporation or registered institution’s principal place of business in Hong Kong; (ii) the outstanding balance of that account as at the beginning and the end of that monthly accounting period and details of all movements in the balance of that account during that period; (iii) details of all relevant contracts entered into by the licensed corporation or registered institution with or on behalf of the client during that monthly accounting period, indicating those initiated by thelicensed corporation or registered institution; (iv) details of all movements during that monthly accounting period of any client virtual assets held for that account; (v) the quantity and, in so far as readily ascertainable, the market price and market value of each client virtual asset held for that account as at the end of that monthly accounting period; and

16 (vi) details of all income credited to and charges levied against that account during that monthly accounting period. Duty to provide statements of account upon request (j) Where a licensed corporation or registered institution receives a request from a client for a statement of account as of the date of the request, it should: (i) prepare a statement of account in respect of the client which includes the information required for all statements of account (see subparagraph (h) above) and, to the extent applicable, the following information relating to the account of the client as of the date of the request: (1) the outstanding balance of that account; and (2) the quantity and, in so far as readily ascertainable, the market price and market value of each client virtualasset, held for that account; and (ii) provide the statement of account to the client as soon as practicable after the date of the request. Receipts (k) On each occasion that a licensed corporation receives any client assets or a registered institution receives any client virtual assets from or on behalf of a client, the licensed corporation or the registered institution should prepare and provide a receipt to the client no later than the end of the second business day after receiving the client money and/or client virtual assets. (l) The requirement under subparagraph (k) is not applicable under the following circumstances: (i) where the client money is deposited directly into the bank account of a licensed corporation by the client or on behalf of the client by any person other than the licensed corporation; or (ii) where a contract note or other trade document provided to the client expressly states that it also serves as a receipt and includes the information specified in subparagraph (m) below. (m) A licensed corporation or registered institution should include the following information in thereceipt: (i) the name under which the licensed corporation or registered institution carries on business; (ii) the date on which the receipt is prepared; (iii) the name and account number of the client; and (iv) in respect of the client money and/or client virtual assets received:

17 (1) the amount of client money and/or client virtual assets received; (2) the account into which the client money and/or client virtual assets has been deposited; and (3) the date on which the client money and/or client virtual assets was received. Miscellaneous (n) Where a licensed corporation or registered institution receives a request from a client for a copy of any contract note, statement of account or receipt that the licensed corporation or registered institution was required to provide to the client, the licensed corporation or registered institution should, as soon as practicable after receiving the request, provide the copy to the client. A licensed corporation or registered institution may impose a reasonable charge for a copy of the document provided by it under this paragraph. (o) If, on an application made by a client, the SFC so directs, a licensed corporation or registered institution should make available for inspection by the client during the ordinary business hours of the licensed corporation or registered institution a copy of any contract notes, statements of account or receipts, except for those dated after the expiration of the period for which the licensed corporation or registered institution is required to retain them. (p) Where a licensed corporation or registered institution is required to prepare any contract notes, statements of account or receipts, the licensed corporation or registered institution should prepare them in the Chinese or English language as preferred by the client to whom they are intended to be provided. (q) Any contract notes, statements of account or receipts (or any copies of any such documents) required to be provided to a client should for all purposes be regarded as duly provided to the client if they are served on: (i) the client; or (ii) any other person (except an officer or employee of the licensed corporation or registered institution which is required to provide the documents to the client) designated by the client for the purposesof this subparagraph by notice in writing to the licensed corporation or registered institution which is required to provide the documents to the client, and it is: (I) delivered to the person by hand; (II) left at (where applicable), or sent by post to the person’s address; (III) sent by facsimile transmission to the person’s last known facsimile number; (IV) sent by electronic mail transmission to the person’s last known electronic mail address; or

18 (V) provided to the person by access through the licensed corporation or registered institution’s website11 . 6.13 Where a client of a licensed corporation or registered institution is a professional investor within the meaning of: (a) any of paragraphs (a) to (i) of the definition of professional investor in section 1 of Part 1 of Schedule 1 to the SFO, and the licensed corporation or registered institution has notified the client in writing that unless the client objects, it will not provide to the client any contract notes, statements of account or receipts (as the case may be) in accordance with paragraph 6.12 above and it has not received any objection from the client; or (b) paragraph (j) of the definition of professional investor in section 1 of Part 1 of Schedule 1 to the SFO and has agreed in writing with the licensed corporation or registered institution not to receive from it any contract notes, statements of account or receipts (as the case may be) in accordance with paragraph 6.12 above; then paragraph 6.12 (except for subparagraphs (j), and (p) to (q)) does not apply to the licensed corporation or registered institution in relation to the client. VII. Custody of client assets Client virtual assets 7.1 A licensed corporation or registered institution should properly handle and safeguard client virtual assets. In particular, the licensed corporation or registered institution should, amongst others, comply with the following when conducting Relevant VA Dealing Activities: (a) Receive client virtual assets through and hold these client virtual assets on trust for its clients in segregated account(s) established and maintained with: (i) an SFC-licensed platform; or (ii) an authorized financial institution (or a subsidiary of a locally incorporated authorized financial institution) which meets the expected standards of virtual asset custody issued by the Hong Kong Monetary Authority (HKMA) from time to time (referred to as “VA Segregated Account”). (b) Subject to paragraphs 4.5 and 7.1(c), the licensed corporation or registered institution should ensure all withdrawal or transfer of client virtual assets are made to the client directly from the VA Segregated Account(s). (c) Subject to paragraph 4.5, the licensed corporation or registered institution should not deposit, transfer, lend, pledge, repledge or otherwise deal with or create any 11 Due regard should be paid to the SFC’s circular dated 29 September 2020 on Provision of Trade Documents to Clients by Access through Intermediaries’ Websites.

19 encumbrance over client virtual assets except for the settlement of transactions, and fees and charges owed by the client to the licensed corporation or registered institution in respect of the Relevant VA Dealing Activities carried out by the licensed corporation or registered institution on behalf of the client or in accordance with the client’s standing authorities (see paragraph 7.7 below) or one-off written directions. (d) No client virtual assets should be paid or permitted to be paid to: (i) any officers or employees of the licensed corporation or registered institution; or (ii) any officers or employees of any corporations with which the licensed corporation or registered institution is in a controlling entity relationship, unless that officer or employee is the client of the licensed corporation or registered institution from whom or on whose behalf such client virtual asset has been received or is being held. (e) Ensure that receipt of client virtual assets from clients and withdrawal of client virtual assets to clients are conducted through a wallet address which belongs to the client. (f) Access to the control of the movement of client virtual assets should be tightly restricted to authorized personnel of the licensed corporation or registered institution to guard against losses arising from theft, fraud or other dishonest acts, professional misconduct or omissions. Client money 7.2 A licensed corporation should properly handle and safeguard client money. In particular, a licensed corporation should, amongst others, comply with the following when conducting Relevant VA Dealing Activities: (a) Establish one or more segregated bank accounts for holding client money received by it. Such segregated bank accounts should be established and maintained with an authorized financial institution in Hong Kong or another bank in another jurisdiction as agreed by the SFC from time to time. (b) Within one business day after a licensed corporation receives any client money: (i) pay it into a segregated bank account maintained with an authorized financial institution in Hong Kong; (ii) pay it into a segregated bank account maintained with another bank in another jurisdiction as agreed by the SFC from time to time if the client money is received outside Hong Kong; (iii) pay it to the client from whom or on whose behalf it has been received; or (iv) pay it in accordance with the client’s standing authority (see paragraph 7.7 below) or one-off written direction.

20 (c) No client money should be paid or permitted to be paid to: (i) any officers or employees of the licensed corporation; or (ii) any officers or employees of any corporations with which the licensed corporation is in a controlling entity relationship, unless that officer or employee is the client of the licensed corporation from whom or on whose behalf such client money has been received or is being held. (d) No client money should be paid out of a segregated bank account other than for: (i) paying the client on whose behalf it is being held; (ii) meeting the client’s settlement obligations in respect of Relevant VA Dealing Activities carried out by the licensed corporation on behalf of the client, being the client on whose behalf it is being held; (iii) paying money that the client, being the client on whose behalf it is being held, owes to the licensed corporation in respect of the conduct of Relevant VA Dealing Activities; or (iv) paying in accordance with the client’s standing authorities (see paragraph 7.7 below) or one-off written directions. 7.3 Subject to paragraph 7.4 below, any amount of interest derived from the holding of client money in a segregated bank account should be dealt with in accordance with paragraph 7.2 above. 7.4 A licensed corporation should ensure that any amount of interest retained in a segregated bank account which the licensed corporation is entitled to retain under an agreement in writing with a client of the licensed corporation, being the client on whose behalf the client money is being held, should be paid out of the account within one business day after: (a) the interest is credited to the account; or (b) the licensed corporation becomes aware that the interest has been credited to the account, whichever is later. 7.5 A licensed corporation which becomes aware that it is holding an amount of money in a segregated bank account that is not client money shall, within one business day of becoming so aware, pay that amount of money out of the segregated bank account. 7.6 A licensed corporation should use its best endeavours to match any unidentified receipts in its bank accounts (including segregated accounts) with all relevant information in order to establish the nature of any receipt and the identity of the person who has made it. (a) Upon ascertaining that a receipt represents client money, the amount should be transferred into a segregated bank account within one business day, even if it has not been able to identify which specific client has made the payment. (b) Where the receipt is not client money, within one business day of becoming so

21 aware, that amount of money should be paid out of the segregated bank account. Standing authority to deal with client assets 7.7 A standing authority is a written instruction that is given to a licensed corporation or the registered institution which: (a) authorizes the licensed corporation or the registered institution to deal with client assets from time to time received from or on behalf of or held on behalf of the client, in one or more specified ways; (b) specifies a period not exceeding 12 months during which it is valid. This does not apply to a standing authority which is given to the licensed corporation or the registered institution by a client of the licensed corporation or the registered institution who is a professional investor; and (c) specifies the manner in which it may be revoked. 7.8 A standing authority which is not revoked prior to its expiry: (a) may be renewed for one or more further periods: (i) not exceeding 12 months, if the client of the licensed corporation or the registered institution who gave it is not a professional investor; or (ii) of any duration, if the client of the licensed corporation or the registered institution who gave it is a professional investor, at any one time, with the written consent of the client of the licensed corporation or the registered institution who gave it; or (b) shall be deemed to have been renewed if: (i) at least 14 days prior to the expiry of the standing authority, the licensed corporation or the registered institution to which it was given gives a written notice to the client of the licensed corporation or the registered institution who gave the standing authority, reminding the client of its impending expiry, and informing the client that unless the client objects, it will be renewed upon expiry upon the same terms and conditions as specified in the standing authority and for: (I) an equivalent period to that specified in the standing authority; (II) any period not exceeding 12 months specified by the licensed corporation or the registered institution, if the client of the licensed corporation or the registered institution is not a professional investor; or (III) a period of any duration specified by the licensed corporation or the registered institution, if the client of the licensed corporation or the registered institution is a professional investor; and

22 (ii) the client does not object to the renewal of the standing authority before its expiry. Where a standing authority is deemed to have been renewed in accordance with subparagraph (b), the licensed corporation or the registered institution shall give a written confirmation of the renewal of the standing authority to the client of the licensed corporation or the registered institution within one week after the date of expiry. Disclosure to clients 7.9 A licensed corporation or registered institution should fully disclose to its clients the custodial arrangements in relation to client assets held on their behalf, including the rights and obligations of each party and how client assets are stored. This should include: (a) for a licensed corporation or registered institution, client virtual assets may not enjoy the same protection as that conferred on “client securities” under the SFO and the Securities and Futures (Client Securities) Rules (Cap. 571H); (b) for a licensed corporation, client money may not enjoy the same protection as that conferred on “client money” under the SFO and the Securities and Futures (Client Money) Rules (Cap. 571I); (c) how the licensed corporation or registered institution will compensate its clients in the event of hacking or any other losses of client virtual assets caused by the default of an SFC-licensed platform or its associated entity; and (d) the treatment of client virtual assets kept at the SFC-licensed platform and their respective rights and entitlements when events such as, but not limited to, voting, hard forks and airdrops occur. Upon becoming aware of such events, a licensed corporation or registered institution should notify its clients as soon as practicable. VIII. Record keeping 8.1 A licensed corporation or registered institution should establish policies and procedures to ensure the integrity, security, availability, reliability and completeness of all information, both in physical and electronically stored form, in relation to Relevant VA Dealing Activities. 8.2 A licensed corporation or registered institution should, in relation to its Relevant VA Dealing Activities: (a) keep, where applicable, such accounting, trading and other records as are sufficient to: (i) explain and reflect the financial position and operation of such businesses; (ii) enable profit and loss accounts and balance sheets which give a true and fair view of its financial affairs to be prepared from time to time;

23 (iii) account for all client virtual assets and client money it receives or holds in relation to its Relevant VA Dealing Services; (iv) enable all movements of such client virtual assets and client money it receives or holds in relation to its Relevant VA Dealing Services to be traced through its accounting systems; (v) show separately and account for all receipts, payments, deliveries and other uses or applications of the client assets effected by it, or on its behalf, and on whose behalf such receipts, payments, deliveries or other uses or applications of the client assets have been effected; (vi) reconcile, on a daily basis, any differences in its balances or positions with other persons, including banks and SFC-licensed platform(s), and show how such differences were resolved; (vii) demonstrate compliance with, and that it has systems of control in place to ensure compliance with, Part VII (Custody of Client Assets) herein; and (viii) enable, in relation to a licensed corporation, it to readily establish whether it has complied with the Securities and Futures (Financial Resources) Rules and other financial resources requirements in Part III (Financial Soundness); (b) keep those records in such a manner as will enable an audit to be conveniently and properly carried out; and (c) make entries in those records in accordance with generally accepted accounting principles. The records required to be kept are specified in paragraph 8.6 below. Form and premises in which records are to be kept 8.3 A licensed corporation or registered institution should keep all the required records: (a) in writing in the Chinese or English language; or (b) in such a manner as to enable them to be readily accessible and readily convertible into written form in the Chinese or English language. 8.4 A licensed corporation or registered institution should adopt all reasonably necessary procedures to guard against the falsification of any of the required records, to facilitate the discovery of any such falsification and to ensure the security, authenticity, reliability, integrity, confidentiality and timely availability of required records. 8.5 A licensed corporation should keep all the required records at the premises used by it which have been approved under section 130(1) of the SFO. A registered institution should keep all required records in accordance with the applicable requirements.

24 Records to be kept 8.6 A licensed corporation or registered institution should retain the following records: (a) Records showing particulars of: (i) all money received by it, whether or not such money belongs to it, or is paid into accounts maintained by it or on its behalf, and disbursed by it; (ii) all income received by it, whether the income relates to charges made by it for the provision of services, commissions, brokerage, remuneration, interest or otherwise; (iii) all expenses, commissions and interest incurred or paid by it; (iv) all orders or instructions concerning client virtual assets that it receives or initiates, including particulars: (1) of the date and time that any order or instruction was received, executed, modified (including particulars of any subsequent modifications) or cancelled; (2) of each transaction entered into by it or on its behalf to implement any such order or instruction; (3) identifying with whom or for whose account it has entered into such transaction; and (4) that enable such transaction to be traced through its accounting, trading and settlement systems; (v) all disposals of client virtual assets initiated by it, showing in the case of each disposal: (1) the name of the client; (2) the date on which the disposal was effected; (3) the name of the SFC-licensed platform which effected the disposal; (4) the charges incurred for effecting the disposal; and (5) the proceeds of the disposal and how such proceeds were dealt with; (vi) its assets and liabilities, including financial commitments and contingent liabilities; (vii) all virtual assets belonging to it, identifying: (1) with whom such virtual assets are deposited; and (2) the date on which they were so deposited;

25 (viii) all virtual assets held by it but not belonging to it, identifying: (1) for whom such virtual assets are held and with whom they are deposited, ie, VA Segregated Account(s) with the relevant SFC￾licensed platform and/ or authorized financial institution (or a subsidiary of a locally incorporated authorized financial institution); and (2) the date on which they were so deposited; (ix) all bank accounts held by it, including segregated accounts maintained; (x) all other accounts held by it; and (xi) all off-balance sheet transactions or positions; (b) Records of all contracts (including written agreements with clients) entered into by it; (c) Records evidencing: (i) any standing authority given to it by a client and any renewal of such authority; and (ii) any one-off written directions given to it by a client; (d) Records of knowing your clients, including the process and outcomes of any risk profiling; (e) Records of suitability assessments conducted; (f) In respect of a client who is a professional investor any notice given by it to the client or agreement by the client with it referred to in paragraph 6.13 above; (g) A copy of each monthly statement of account prepared in accordance with Part VI (Dealing with Clients) above; (h) Records of all client complaints relating to client virtual assets and client money it receives or holds in relation to the Relevant VA Dealing Services and details of follow-up action, including the substance and resolution of each complaint; (i) Records regarding client identity for confirmation of the origination of the instructions and the beneficiaries and details of the instructions as prescribed in paragraph 6.6 above; and (j) To the extent not already covered elsewhere in this paragraph, records evidencing the licensed corporation or registered institution’s compliance with these Terms and conditions. 8.7 A licensed corporation or registered institution should retain the records required under paragraph 8.6 (except for records required to be kept under paragraph 8.6(a)(iv)) for a period of not less than seven years.

26 8.8 A licensed corporation or registered institution should retain the following for a period of not less than two years: (a) a copy of each contract note and receipt prepared in accordance with Part VI (Dealing with Clients) above; (b) a copy of each statement of account prepared upon the client’s request in accordance with paragraph 6.12(j) above; and (c) records required to be kept under paragraph 8.6(a)(iv) above. IX. Auditors 9.1 A licensed corporation should prepare and submit an auditor’s report in respect of a financial year which contains, in addition to other information required under the laws, a statement by the auditor as to whether, in the auditor’s opinion: (a) during the financial year in question, the licensed corporation had systems of control in place which were adequate to ensure compliance with Part VII (Custody of Client Assets) above; (b) during the financial year in question, the licensed corporation complied with Part VII (Custody of Client Assets) and Part VIII (Record Keeping) above; and (c) whether the licensed corporation has contravened the financial soundness requirement under Part III (Financial Soundness) above. X. Conflicts of interest 10.1 A licensed corporation or registered institution should not engage in virtual asset market making activities on an SFC-licensed platform through which it provides to its clients services in Relevant VA Dealing Activities. XI. Ongoing reporting obligations 11.1 A licensed corporation or registered institution should report to the SFC (and the HKMA in the case of a registered institution) as soon as practicable upon the happening of any actual or suspected material non-compliance with these Terms and conditions. 11.2 A licensed corporation or registered institution should provide any information in relation to its Relevant VA Dealing Activities as may be requested by the SFC (and the HKMA in the case of a registered institution) from time to time. The SFC (and the HKMA in the case of a registered institution) may request information on a periodic or ad hoc basis.

27 Schedule 1 – Existing regulatory requirements applicable to a licensed corporation or registered institution providing virtual asset dealing services under an omnibus account arrangement Relevant codes (1) The Code of Conduct, except for the following paragraphs which are not relevant or have been modified and incorporated in these Terms and conditions: ▪ Paragraph 5.1A (Know your client: investor characterization) ▪ Paragraph 5.3 (Know your client: derivative products) ▪ Paragraph 5.4 (Client identity: origination of instructions and beneficiaries) ▪ Paragraph 16 (Analysts) ▪ Paragraph 17 (Sponsors) ▪ Paragraph 19 (Alternative liquidity pools) ▪ Paragraph 20 (Dealing with group affiliates and other connected persons) ▪ Paragraph 21 (Bookbuilding and placing activities in equity capital market and debt capital market transactions) ▪ Schedule 3 (Additional requirements for licensed or registered persons dealing in securities listed or traded on The Stock Exchange of Hong Kong Limited) ▪ Schedule 4 (Additional requirements for licensed or registered persons dealing in futures contracts and/or options contracts traded on Hong Kong Futures Exchange Limited) ▪ Schedule 5 (Additional requirements for licensed persons providing margin lending) ▪ Schedule 6 (Additional requirements for licensed persons engaging in leveraged foreign exchange trading) ▪ Schedule 8 (Additional requirements for licensed or registered persons operating alternative liquidity pools) ▪ Schedule 10 (Risk mitigation requirements and margin requirements in relation to non-centrally cleared OTC derivative transactions)

28 Relevant guidelines (2) Guidelines on Online Distribution and Advisory Platforms (3) Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations and SFC-licensed Virtual Asset Service Providers) and Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Authorized Institutions) (as applicable) (4) Guidelines for Reducing and Mitigating Hacking Risks Associated with Internet Trading (5) Management, Supervision and Internal Control Guidelines for Persons Licensed by or Registered with the Securities and Futures Commission (6) Fit and Proper Guidelines (7) Guidelines on Competence (8) Guidelines on Continuous Professional Training

29 Part II – Virtual asset advisory services Licensing or registration conditions for licensed corporations or registered institutions providing virtual asset advisory services (a) (i) [For licensee or registered institution which provides services to retail investors and/ or professional investors] With respect to providing virtual asset advisory services, the licensee or registered institution shall only provide such services to persons which are, and remain at all times, clients of the licensed corporation or registered institution in respect of its business in Type 4 regulated activity (advising on securities). The term “advising on securities” is specified in Part 2 of Schedule 5 to the Securities and Futures Ordinance. The term “virtual asset” is defined in section 53ZRA of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance. (ii) [For licensee or registered institution which only provides services to professional investors] With respect to providing virtual asset advisory services, the licensee or registered institution shall only provide such services to professional investors which are, and remain at all times, clients of the licensed corporation or registered institution in respect of its business in Type 4 regulated activity (advising on securities). The term “professional investor” is defined in section 1 of Part 1 of Schedule 1 to the Securities and Futures Ordinance (SFO) together with the Securities and Futures (Professional Investor) Rules. The term “advising on securities” is specified in Part 2 of Schedule 5 to the SFO. The term “virtual asset” is defined in section 53ZRA of the Anti-Money Laundering and Counter￾Terrorist Financing Ordinance. (b) With respect to providing virtual asset advisory services, the licensee or registered institution shall comply with the attached “Terms and conditions for licensed corporations or registered institutions providing virtual asset advisory services” (as amended from time to time). The term “virtual asset” is defined in section 53ZRA of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance.

30 Terms and conditions for licensed corporations or registered Institutions providing virtual asset advisory services I. Interpretation A reference in these Terms and conditions for licensed corporations or registered Institutions providing virtual asset advisory services (Terms and conditions) to: ▪ “AMLO” means the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615); ▪ “client” means a person to whom a licensed corporation or registered institution provides virtual asset advisory services; ▪ “Code of Conduct” means the Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission; ▪ “licensed corporation” means a corporation which is granted a licence under section 116 of the SFO; ▪ “professional investor” has the meaning as defined in section 1 of Part 1 of Schedule 1 to the SFO; ▪ “registered institution” means an authorized financial institution which is registered under section 119 of the SFO; ▪ “retail client” or “retail investor” means any person other than a professional investor; ▪ “Relevant VA Advisory Activities” means any virtual asset advisory services provided by the licensed corporation or registered institution to its clients; ▪ “SFO” means the Securities and Futures Ordinance (Cap. 571); ▪ “SFC-licensed platform” means a virtual asset trading platform operator which is licensed by the SFC pursuant to section 116 of the SFO and/or section 53ZRK of the AMLO; and ▪ “virtual asset” means any “virtual asset” as defined in section 53ZRA of the AMLO.

31 II. Codes and guidelines 2.1 In conducting its Relevant VA Advisory Activities, to the extent not already covered elsewhere in these Terms and conditions, a licensed corporation or registered institution is expected to observe the requirements of the codes and guidelines (as supplemented by the circulars and FAQs issued from time to time and, in particular, the suitability requirement under paragraph 5.2 of the Code of Conduct) published by the SFC as if: (i) any reference to a financial product (for example, securities) or investment product included virtual assets; (ii) any reference to a client included a person to whom the licensed corporation or registered institution provides services in Relevant VA Advisory Activities; and (iii) any reference to regulated activities included Relevant VA Advisory Activities. III. Virtual asset-knowledge test and suitability 3.1 Except for institutional and qualified corporate professional investors12, a licensed corporation or registered institution should assess a client’s knowledge of virtual assets (including knowledge of relevant risks associated with virtual assets) before providing any services to the client13 . 3.2 Where a client does not possess such knowledge, a licensed corporation or registered institution may only provide services in Relevant VA Advisory Activities to the client if the licensed corporation or registered institution has provided adequate training to the client. 3.3 Except for institutional and qualified corporate professional investors, a licensed corporation or registered institution, before providing services in Relevant VA Advisory Activities, should assess a client’s risk tolerance level, accordingly determine the client’s risk profile and assess whether it is suitable for the client to participate in the trading of virtual assets. The licensed corporation or registered institution should exercise due skill, care and diligence to ensure the methodology for risk profiling is properly designed and should determine the client’s risk profile based on an assessment of the information about the client obtained through its know-your-client process. The methodology adopted for categorising clients and an explanation of the risk profiles of clients should be made available to the client14 . 3.4 In conducting any Relevant VA Advisory Activities, a licensed corporation or registered institution should enter into a written client agreement with each client15 in the same manner as set out in paragraph 6 of the Code of Conduct and include a provision stating that: 12 See footnote 4 above. 13 See footnote 5 above. 14 Where risk-scoring questionnaires are used to risk profile clients, the licensed corporation or registered institution should pay particular attention to the design of the questions and the underlying scoring mechanism, which should be properly designed to accurately reflect the personal circumstances of a client. The licensed corporation or registered institution should also have appropriate processes in place to periodically review the risk profiling methodology and mechanism for clients. 15 Except for institutional and qualified corporate professional investors.

32 “…… if we [the licensed corporation or registered institution] solicit the sale of or recommend any product including any virtual assets to you [the client], the product must be reasonably suitable for you, having regard to your financial situation, investment experience and investment objectives. No other provision of this agreement or any other document we may ask you to sign and no statement we may ask you to make derogates from this clause.” 3.5 Where a licensed corporation or registered institution provides services in Relevant VA Advisory Activities to retail clients, the licensed corporation or registered institution should take all reasonable steps to ensure that the virtual asset recommended: (i) is of high liquidity. In assessing the liquidity of a specific virtual asset for trading by retail clients, the licensed corporation or registered institution should, at a minimum, ensure that the virtual asset is an eligible large-cap virtual asset, ie, the specific virtual asset should have been included in a minimum of two acceptable indices issued by at least two different index providers; and Note 1: An acceptable index refers to an index which has a clearly defined objective to measure the performance of the largest virtual assets in the global market, and should fulfil the following criteria: (a) The index should be investible, meaning the constituent virtual assets should be sufficiently liquid; (b) The index should be objectively calculated and rules-based; (c) The index provider should possess the necessary expertise and technical resources to construct, maintain and review the methodology and rules of the index; (d) The methodology and rules of the index should be well documented, consistent and transparent. Note 2: The two index providers should be separate and independent from each other, the issuer of the virtual asset (if applicable) and the licensed corporation or registered institution (for example, they are not within the same group of companies). Further, at least one of the indices should be issued by an index provider which complies with the IOSCO Principles for Financial Benchmarks and has experience in publishing indices for the conventional securities market. (ii) is made available by SFC-licensed platforms for trading by retail investors.

Licensing or registration conditions and terms and conditions for licensed corporations or registered institutions providing virtual asset dealing services and virtual asset advisory services January 2022 October 2023 Appendix 6a

2 Contents Part I – Virtual asset dealing services Licensing or registration conditions for licensed corporations or registered institutions acting as introducing agents for virtual asset trading platform operators 43 Licensing or registration conditions for licensed corporations or registered institutions providing virtual asset dealing services under an omnibus account arrangement 5 Terms and conditions for licensed corporations or registered institutions providing virtual asset dealing services under an omnibus account arrangement 6 I. Interpretation 6 II. Codes and guidelines 7 III. Financial soundness 7 IV. Operations 7 V. Prevention of market manipulative and abusive activities 89 VI. Dealing with clients 810 VII. Custody of client assets 1618 VIII. Record keeping 1822 IX. Auditors 2126 X. Anti-money laundering / counter-financing of terrorism 22 XIX. Conflicts of interest 2226 XIIXI. Ongoing reporting obligations 2226 Schedule 1 – Existing regulatory requirements applicable to licensed corporations or registered institutions providing virtual asset dealing services under an omnibus account arrangement 2327 Part II – Virtual asset advisory services Licensing or registration conditions for licensed corporations or registered institutions providing virtual asset advisory services 2529 Terms and conditions for licensed corporations or registered institutions providing virtual asset advisory services 2630 I. Interpretation 2630 II. Codes and guidelines 2731 III. Virtual asset-knowledge test and suitability 2731

3 Part I – Virtual asset dealing services Licensing or registration conditions for licensed corporations or registered institutions acting as introducing agents for virtual asset trading platform operators (a) With respect to introducing clients to virtual asset trading platform operators, the licensee or registered institution shall only engage in the introduction of persons to establish accounts with an SFC-licensed virtual asset trading platform (SFC-licensed platform) to effect dealing in or make offers to deal in virtual assets directly. The licensee or registered institution shall not communicate any offers to effect dealings in virtual assets to the SFC-licensed platform. Prior to introducing clients to establish accounts with an SFC-licensed trading platform, the licensee or registered institution should enter into a written client agreement with clients which should set out a clear description of the nature of the services to be provided to or available to the client, including the role and obligation of the licensee or registered institution and that it would not provide any dealing, financial accommodation, settlement or custody services. The term “SFC-licensed platform” means a virtual asset trading platform operator which is licensed by the SFC pursuant to section 116 of the Securities and Futures Ordinance and/or section 53ZRK of the Anti-Money Laundering and Counter￾Terrorist Financing Ordinance (AMLO). The term “virtual asset” is defined in Part I of the Terms and conditions for virtual asset trading platform operators (as amended from time to time).section 53ZRA of the AMLO. (b) (i) [For licensee or registered institution which provides services to retail investors and/ or professional investors] With respect to introducing clients to virtual asset trading platform operators, the licensee or registered institution shall only introduce persons which are its clients in respect of its business in Type 1 regulated activity (dealing in securities). The term “dealing in securities” is specified in Part 2 of Schedule 5 to the Securities and Futures Ordinance. (ii) [For licensee or registered institution which only provides services to professional investors] With respect to introducing clients to virtual asset trading platform operators, the licensee or registered institution shall only introduce persons which are professional investors and are its clients in respect of its business in Type 1 regulated activity (dealing in securities). The term “professional investor” is defined in section 1 of Part 1 of Schedule 1 to the Securities and Futures Ordinance (“SFO”) together with the Securities and Futures (Professional Investor) Rules. The term “dealing in securities” is specified in Part 2 of Schedule 5 to the SFO. The term “virtual asset” is defined in Part I of the Terms and conditions for virtual asset trading platform operators (as amended from time to time). (c) With respect to introducing clients to virtual asset trading platform operators, the licensee or registered institution shall not hold client assets. • The term “hold” is as defined under the Securities and Futures Ordinance; and • The term “client assets” means: (i) “client virtual assets”, which means any virtual assets received or held by

4 the licensee or registered institution, which are so received or held on behalf of a client or in which a client has a legal or equitable interest, and includes any rights thereto. The term “virtual asset” is defined in Part Isection 53ZRA of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance Terms and conditions for virtual asset trading platform operators (as amended from time to time); and (ii) “client money”, which means any money received or held by the licensee or registered institution, which is so received or held on behalf of a client or in which a client has a legal or equitable interest, and includes any accretions thereto whether as capital or income.

5 Licensing or registration conditions for licensed corporations or registered institutions providing virtual asset dealing services under an omnibus account arrangement (a) With respect to providing virtual asset dealing services, the licensee or registered institution shall only provide such services through operating an omnibus account established and maintained with an SFC-licensed platform. The term “SFC-licensed platform” refers to a virtual asset trading platform operator which is licensed by the SFC pursuant to section 116 of the Securities and Futures Ordinance. and/or section 53ZRK of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO). The term “virtual asset” is defined in Part I of the Terms and conditions for licensed corporations or registered institutions providing virtual asset dealing services under an omnibus account arrangement (as amended from time to time).section 53ZRA of the AMLO. (b) (i) [For licensee or registered institution which provides services to retail investors and/ or professional investors] With respect to providing virtual asset dealing services, the licensee or registered institution shall only provide such services to persons which are, and remain at all times, its clients in respect of its business in Type 1 regulated activity (dealing in securities). The term “dealing in securities” is specified in Part 2 of Schedule 5 to the Securities and Futures Ordinance. The term “virtual asset” is defined in section 53ZRA of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance. (ii) [For licensee or registered institution which only provides services to professional investors] With respect to providing virtual asset dealing services, the licensee or registered institution shall only provide such services to professional investors which are, and remain at all times, its clients in respect of its business in Type 1 regulated activity (dealing in securities). The term “professional investor” is defined in section 1 of Part 1 of Schedule 1 to the Securities and Futures Ordinance (“SFO”) together with the Securities and Futures (Professional Investor) Rules. The term “dealing in securities” is specified in Part 2 of Schedule 5 to the SFO. The term “virtual asset” is defined in Part I of the Terms and conditions for licensed corporations or registered institutions providing virtual asset dealing services under an omnibus account arrangement (as amended from time to time).section 53ZRA of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance. (c) With respect to providing virtual asset dealing services, the licensee or registered institution shall comply with the attached “Terms and conditions for licensed corporations or registered institutions providing virtual asset dealing services under an omnibus account arrangement” (as amended from time to time). The term “virtual asset” is defined in Part I of the Terms and conditions for licensed corporations or registered institutions providing virtual asset dealing services under an omnibus account arrangement (as amended from time to time).section 53ZRA of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance.

6 Terms and conditions for licensed corporations or registered institutions providing virtual asset dealing services under an omnibus account arrangement I. Interpretation A reference in these Terms and conditions for licensed corporations or registered institutions providing virtual asset dealing services under an omnibus account arrangement (Terms and conditions) to: ▪ “AMLO” means the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615); ▪ “authorized financial institution” means an authorized institution as defined in section 2(1) of the Banking Ordinance (Cap. 155); ▪ “client” means a person to whom the licensed corporation or registered institution provides services in Relevant VA Dealing Activities (see below); ▪ “client asset” means client virtual assets and client money; ▪ “client money” means any money received or held by or on behalf of the licensed corporation or registered institution, which is so received or held on behalf of a client or in which a client has a legal or equitable interest, and includes any accretions thereto whether as capital or income; ▪ “client virtual asset” means any virtual asset received or held by or on behalf of the licensed corporation or registered institution, which is so received or held on behalf of a client or in which a client has a legal or equitable interest, and includes any rights thereto; ▪ “group of companies” is defined in section 1 of Part 1 of Schedule 1 to the SFO; ▪ “licensed corporation” means a corporation which is licensed by the SFC and upon which these Terms and conditions are imposed by way of a licensing condition pursuant to section 116 of the SFO; ▪ “professional investor” is defined in section 1 of Part 1 of Schedule 1 to the SFO; ▪ “registered institution” means an authorisedauthorized financial institution which is registered bywith the SFC and upon which these Terms and conditions are imposed by way of a registration condition pursuant to section 119 of the SFO; ▪ “Relevant VA Dealing Activities” means any virtual asset dealing activities carried out by the licensed corporation or registered institution on behalf of its clients through operating an omnibus account established and maintained with an SFC￾licensed platform; ▪ “retail client” or “retail investor” means any person other than a professional investor; ▪ “SFC-licensed platform” means a virtual asset trading platform operator which is

7 licensed by the SFC pursuant to section 116 of the SFO and/or section 53ZRK of the AMLO; ▪ “SFO” means the Securities and Futures Ordinance (Cap. 571); and ▪ “virtual asset” means digital representations of value which may be in the form of digital tokens (such as utility tokens, stablecoins or security or asset-backed tokens) any other virtual commodities, crypto assets or other assets of essentially the same nature, irrespective of whether they amount to “securities” or “futures contracts” as defined under the SFO, but excludes digital representations of fiat currencies issued by central banks. ▪ “virtual asset” means any “virtual asset” as defined in section 53ZRA of the AMLO. II. Codes and guidelines 2.1 In conducting Relevant VA Dealing Activities, to the extent not already covered elsewhere in these Terms and conditions, a licensed corporation or registered institution is expected to observe the requirements of the Codescodes and guidelines (as supplemented by circulars, frequently asked questions (FAQs) and other related guidance issued by the SFC from time to time) listed in Schedule 1 hereto as if: (i) any reference to a financial product (for example, securities) or investment product included virtual assets; (ii) any reference to a client included a person to whom a licensed corporation or registered institution provides services in Relevant VA Dealing Activities; (iii) any reference to client assets included client virtual assets; and (iv) any reference to regulated activities included Relevant VA Dealing Activities. III. Financial soundness 3.1 In addition to the requirements under the Securities and Futures (Financial Resources) Rules (Cap. 571N), a licensed corporation should maintain in Hong Kong at all times excess liquid capital equivalent to at least 12 months of its actual operating expenses1 calculated on a rolling basis. IV. Operations 4.1 A licensed corporation or registered institution should only establish and maintain an omnibus account (designated as a trust or client account) with an SFC-licensed platform. Furthermore, if the licensed corporation or registered institution provides services in Relevant VA Dealing Activities to retail clients, the licensed corporation or registered institution should ensure that: (a) the Relevant VA Dealing Activities are conducted through an omnibus account 1 This refers to the total amount of overheads reported under Form 7 of the financial returns, excluding the amounts representing depreciation and provision for bad and doubtful debts.

8 established and maintained with an SFC-licensed platform which is not subject to the licensing condition that it can only serve professional investors; and (b) the retail clients of the licensed corporation or registered institution can only trade in those virtual assets that are made available for trading by retail investors by the SFC-licensed platform mentioned in subparagraph (a) above. For the avoidance of doubt, the licensed corporation or registered institution may establish and maintain omnibus accounts with multiple SFC-licensed platforms. 4.2 A licensed corporation or registered institution should only execute transactions for a client on the platform of the SFC-licensed platform. 4.3 A licensed corporation or registered institution should ensure that clients can only deposit fiat currencies into and withdraw the same from the licensed corporation or registered institution’s segregated account; and that no withdrawal or transfer of virtual assets by clients is permitted at any time, even after cessation of the account maintained with the licensed corporation or registered institution. 4.44.3 A licensed corporation or registered institution should execute a trade for a client through the omnibus account only if there are sufficient fiat currencies or virtual assets in the client’s account to cover that trade. 4.54.4 A licensed corporation or registered institution should not provide any financial accommodation2 for its clients to acquire virtual assets and should ensure, to the extent possible, that no corporation within the same group of companies as the licensed corporation or registered institution does so. 4.64.5 A licensed corporation or registered institution should not make any arrangements with its clients on using the client virtual assets received or held by the licensed corporation or registered institution with the effect of generating returns for the clients or any other parties. 4.6 Where a client is entitled to voting rights arising out of its ownership of a virtual asset, upon notification by the SFC-licensed platform, the licensed corporation or registered institution should inform the client of such rights and facilitate the exercise of these rightshow those voting rights will be handled by the SFC-licensed platform and the licensed corporation or registered institution. 4.7 For orders in virtual assets (including virtual assets classified as complex products3 ) which are placed by a client directly on the trading platform of a licensed corporation or registered institution or directly to staff of the licensed corporation or registered institution for onward passing to the SFC-licensed platform for execution, the licensed corporation or registered institution is not required to ensure that the transaction is suitable for the client if there has been no solicitation or recommendation made by the licensed corporation or registered institution. 4.8 Where a licensed corporation or registered institution is authorisedauthorized by a 2 This term is defined in section 1 of Part 1 of Schedule 1 to the SFO. 3 “Complex product” refers to an investment whose terms, features and risks are not reasonably likely to be understood by a retail investor because of its complex structure, having regard to the factors set out in paragraph 5.5 of the Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission (Code of Conduct)/paragraph 6.1 of the Guidelines on Online Distribution and Advisory Platforms.

9 client in writing to operate the client’s account for trading securities on a discretionary basis as an ancillary service and the client has further authorisedauthorized the licensed corporation or registered institution to operate the client’s account to trade in virtual assets on a discretionary basis, the licensed corporation or registered institution should only invest less than 10% of the gross asset value of the client’s account in virtual assets. 4.9 Where a licensed corporation or registered institution makes a solicitation or recommendation or provides advisory services to retail clients on virtual assets, the licensed corporation or registered institution should take all reasonable steps to ensure that the virtual assets solicited or recommended: (i) is of high liquidity. In assessing the liquidity of a specific virtual asset for trading by retail clients, the licensed corporation or registered institution should, at a minimum, ensure that the virtual asset is an eligible large-cap virtual asset, ie, the specific virtual asset should have been included in a minimum of two acceptable indices issued by at least two different index providers; and Note 1: An acceptable index refers to an index which has a clearly defined objective to measure the performance of the largest virtual assets in the global market, and should fulfil the following criteria: (a) The index should be investible, meaning the constituent virtual assets should be sufficiently liquid; (b) The index should be objectively calculated and rules-based; (c) The index provider should possess the necessary expertise and technical resources to construct, maintain and review the methodology and rules of the index; (d) The methodology and rules of the index should be well documented, consistent and transparent. Note 2: The two index providers should be separate and independent from each other, the issuer of the virtual asset (if applicable) and the licensed corporation or registered institution (for example, they are not within the same group of companies). Further, at least one of the indices should be issued by an index provider which complies with the IOSCO Principles for Financial Benchmarks and has experience in publishing indices for the conventional securities market. (ii) is made available by SFC-licensed platforms for trading by retail investors. 4.10 A licensed corporation or registered institution should adopt a fee structure that is clear, fair and reasonable in the circumstances and characterized by good faith. In relation to Relevant VA Dealing Activities, athe licensed corporation or registered institution should clearly set out how different fees may apply based on the type of order (including whether the client is providing or taking liquidity), transaction size and type of virtual assets transacted (if applicable).

10 V. Prevention of market manipulative and abusive activities 5.1 A licensed corporation or registered institution should establish and implement written policies and controls for identifying any red flags which may arouse reasonable suspicions of market manipulative or abusive trading activities, such as anomalies in trading patterns and the potential use of abusive trading strategies. 5.2 Upon becoming aware of any actual or potential market manipulative or abusive activities, a licensed corporation or registered institution should notify the SFC as soon as practicable, take immediate steps to prevent these activities from continuing and provide the SFC with additional assistance in connection with such activities as it might request. VI. Dealing with clients 6.1 Except for institutional and qualified corporate professional investors4 , a licensed corporation or registered institution should assess a client’s knowledge of virtual assets (including knowledge of therelevant risks associated with virtual assets) before providing any services to the client5 .

6.2 Where the client does not possess such knowledge, a licensed corporation or registered institution may only provide virtual asset dealing services in Relevant VA Dealing Activities to the client if the licensed corporation or registered institution has provided adequate training to the client and enquired into the personal circumstances of the client. 6.3 Except for institutional and qualified corporate professional investors, a licensed corporation or registered institution, before providing services in Relevant VA Dealing Activities, should assess a client’s risk tolerance level, accordingly determine the client’s risk profile and assess whether it is suitable for the client to participate in the trading of virtual assets. The licensed corporation or registered institution should exercise due skill, care and diligence to ensure the methodology for risk profiling is properly designed and should determine the client’s risk profile based on an assessment of the information about the client obtained through its know-your-client process. The methodology adopted for categorising clients and an explanation of the risk profiles of clients should be made available to the client6 . 6.36.4 Except for institutional and qualified corporate professional investors, a A licensed corporation or registered institution should set a trading limit, position limit or bothlimit for each client to ensure that the client’s exposure to virtual assets is reasonable, with 4 Same definitions as in paragraph 15 of the Code of Conduct for Persons Licensed by or Registered with the SFC (Code of Conduct).. “Qualified corporate professional investors” refers to corporate professional investors which have passed the assessment requirements under paragraph 15.3A and gone through the procedures under paragraph 15.3B of the Code of Conduct. 5 The following are some non-exhaustive criteria for assessing whether a client can be regarded as having knowledge of virtual assets: (i) whether the client has undergone training or attended courses on virtual assets; (ii) whether the client has current or previous work experience related to virtual assets; or (iii) whether the client has prior trading experience in virtual assets. A client will be considered as having knowledge of virtual assets if the client has executed five or more transactions in any virtual asset within the past three years. 6 Where risk-scoring questionnaires are used to risk profile clients, the licensed corporation or registered institution should pay particular attention to the design of the questions and the underlying scoring mechanism, which should be properly designed to accurately reflect the personal circumstances of a client. The licensed corporation or registered institution should also have appropriate processes in place to periodically review the risk profiling methodology and mechanism for clients.

11 reference to the client’s financial situation with a view to ensuring that the client has sufficient(including the client’s net worth to be able to assume the risks and bear the potential losses of trading in virtual assets.) and personal circumstances7 . The licensed corporation or registered institution should notify the client of the assigned limit and review this limit regularly to ensure that it remains appropriate. 6.5 A licensed corporation or registered institution should ensure that it complies with the applicable laws and regulations in the jurisdictions where its clients are located.in which it provides services. In particular, it should establish and implement measures which include: to ensure that it will not provide or market its services to any persons in jurisdictions which have banned trading in virtual assets. (a) ensuring its marketing activities are only conducted in permitted jurisdictions without violation of the relevant restrictions on offers of investments; and (b) implementing measures to prevent persons from jurisdictions which have banned trading in virtual assets from accessing its services (for example, by checking IP addresses and blocking access). For the avoidance of doubt, the licensed corporation or registered institution should also implement appropriate measures to detect and prevent persons who are attempting to circumvent the relevant jurisdictions’ ban on trading virtual assets (for example, by using a virtual private network to mask their IP addresses) from accessing its services. Client identity: origination of instructions and beneficiaries 6.46.6 A licensed corporation or registered institution should be satisfied on reasonable grounds about8 : (a) the identity, address and contact details of: (i) the person or entity (legal or otherwise) ultimately responsiblefor originating the instruction in relation to a transaction; (ii) the person or entity (legal or otherwise) that stands to gain the commercial or economic benefit of the transaction and/or, bear its commercial or economic risk or both gain the benefit and bear its risks; and (b) the instruction given by the person or entity referred to in paragraph 6.56(a)(i) above. 6.56.7 A licensed corporation or registered institution should not do anything to effect a transaction unless it has complied with, and kept records in Hong Kong of the details referred to in, paragraph 6.56 above. 6.8 In relation to a collective investment scheme or discretionary account, the “entity” referred to in paragraph 6.6 above is the collective investment scheme or account, and the manager of that collective investment scheme or account, not those who hold a 7 The licensed corporation or registered institution should take into account the client’s overall holdings in virtual assets (held by the licensed corporation or registered institution or otherwise) on a best efforts basis. 8 The licensed corporation or registered institution must satisfy itself about and record information that identifies those who are really behind a transaction; those who ultimately originate instructions in relation to a transaction and those who ultimately benefit from, or bear the risk of, that transaction. The SFC is concerned about the substance of what is going on with a transaction and not the technicalities.

12 beneficial interest in that collective investment scheme or account. Client agreement 6.66.9 In conducting any Relevant VA Dealing Activities, a licensed corporation or registered institution should enter into a written client agreement with each client9 in the same manner as set out in paragraph 6 of the Code of Conduct and include a provision stating that: “In conducting any Relevant VA Dealing Activities, if we [the licensed corporation or registered institution] solicit the sale of or recommend any product including any virtual assets to you [the client], the product must be reasonably suitable for you, having regard to your financial situation, investment experience and investment objectives. No other provision of this agreement or any other document we may ask you to sign and no statement we may ask you to make derogates from this clause.” Disclosure 6.76.10 Except for institutional and qualified corporate professional investors, a A licensed corporation or registered institution should fully disclose the nature and risks that clients may be exposed to when dealing in virtual assets10 . All information provided to clients should be presented in a clear and fair manner which is not misleading. The disclosed risks should, amongst other things, include: (a) virtual assets are highly risky and investors should exercise caution in relation to these products; (b) a virtual asset may or may not be considered as “property” under the law, and such legal uncertainty may affect the nature and enforceability of a client’s interest in such virtual asset; (c) the offering documents or product information issuedprovided by the issuer have not been subject to scrutiny by any regulatory body; (d) the protection offered by the Investor Compensation Fund does not apply to transactions involving virtual assets (irrespective of the nature of the tokens); (e) a virtual asset is not legal tender, ie, it is not backed by the government and authorities; (f) transactions in virtual assets may be irreversible, and, accordingly, losses due to fraudulent or accidental transactions may not be recoverable; (g) the value of a virtual asset may be derived from the continued willingness of market participants to exchange fiat currencies for a virtual asset, which means that the value of a particular virtual asset may be completely and permanently lost should the market for that virtual asset disappear. There is no assurance that a person who accepts a virtual asset as payment today will continue to do so in the future; 9 Except for institutional and qualified corporate professional investors (see footnote 3 for definitions). 10 A one-off disclosure made by the licensed corporation or registered institution prior to entering into a virtual asset transaction is acceptable.

13 (h) the extreme volatility and unpredictability of the price of a virtual asset relative to fiat currencies may result in significant lossesa total loss of the investment over a short period of time; (i) legislative and regulatory changes may adversely affect the use, storage, transfer, exchange and value of virtual assets; (j) some virtual asset transactions may be deemed to be executed only when they are recorded and confirmed by an SFC-licensed platform, which may not necessarily be the time at which the client initiates the transaction; (k) the nature of virtual assets exposes them to an increased risk of fraud or cyberattack; and (l) the nature of virtual assets means that technological difficulties experienced by an SFC-licensed platform may prevent clients from dealing in their virtual assets. 6.86.11 A licensed corporation or registered institution should also disclose the following information in relation to its Relevant VA Dealing Activities: (a) its services in relation to Relevant VA Dealing Activities are only available to professional investors; (where applicable); (b) transactions for a client will only be executed on the platform of an SFC-licensed platform; (c) clients are only permitted to deposit fiat currencies intoname and withdrawwebsite of the same from the SFC-licensed corporation or registered institution’s segregated account;platform through which client transactions are executed and settledno withdrawal or transfer; (d) list of virtual assets available for trading by its retail clients (where applicable); (c)(e) relevant information of the virtual assets available for trading or inform clients is permitted at any time, even after cessation ofwhere such information could be accessed, such as the account maintained withwebsite of the SFC-licensed platform corporation or registered institution; (d)(f) the licensed corporation or registered institution will only execute a trade for a client if there are sufficient fiat currencies or virtual assets in the client’s account to cover that trade; and (e)(g)trading hours and other trading and operational matters. Provision of contract notes, statements of account and receipts to clients 6.96.12 A licensed corporation or registered institution should provide to each client timely and meaningful information about the transactions conducted with the client or on the client’s behalf, consisting of the client’s holdings and movements of the client virtual assets and fiat currencies, and a monthly statement of allother activities and holdings in the client’s account. Where contract notes, statements of account and

14 receipts are provided by a licensed corporation or registered institution to a client, the licensed corporation or registered institution should ensure that the information included in the contract notes, statements of account and receipts should beis fit for purpose, comprehensive and accurate in respect of the particular type of virtual asset involved. Contract notes (a) Where a licensed corporation or registered institution enters into a relevant contract with or onbehalf of a client, it must prepare and provide a contract note to the client no later than the end of the second business day after entering into the relevant contract. The term “relevant contract” means a contract, entered into in Hong Kong by a licensed corporation or registered institution with or on behalf of a client in the conduct of its businesses which constitute any Relevant VA Dealing Activities, that is a contract for dealing in virtual assets. (b) Where a licensed corporation or registered institution enters into more than one relevant contract with or on behalf of a client on the same day, unless the client has given contrary instructions to the licensed corporation or registered institution, the licensed corporation or registered institution may prepare a single contract note which: (i) records all of those relevant contracts; and (ii) in respect of each of those relevant contracts, includes all of the information which would have been required to be included in the contract note. (c) If such a single contract note is prepared, the licensed corporation or registered institution should provide it to the client no later than the end of the second business day after entering into those relevant contracts. (d) A contract note should include, to the extent applicable, the following information: (i) the name under which the licensed corporation or registered institution carries on business; (ii) the name and account number of the client; (iii) full particulars of the relevant contract including: (1) the quantity, name, description and such other particulars of the virtual asset contract involved, as are sufficient to enable it to be identified; (2) the nature of the dealing; (3) the date (i) on which the relevant contract is entered into; (ii) of settlement or performance of the relevant contract; and (iii) on which the contract note is prepared; (4) the name of the SFC-licensed platform on which the relevant contract has been executed;

15 (5) the price per unit of the virtual asset traded; (5)(6)the rate or amount of commission payable in connection with the relevant contract; the price per unit of the virtual asset traded; (6) the amount of consideration payable under the relevant contract; and (7) the rate or amount of fees and charges payable in connection with the relevant contract; and (7)(8)the amount of consideration payable under the relevant contract. (e) Where a licensed corporation or registered institution has entered into a relevant contract with or on behalf of a client, it may, at the request of the client, include in the contract note in respect of the relevant contract, the average price per unit for the purchase or sale (as the case may be) of the same description of virtual assets, rather than the price per unit as referred to in subparagraph (d)(iii)(5) above;. (f) Where a licensed corporation or registered institution has included in a contract note an average price as referred to in subparagraph © above and the client requests an analysis of such average price within two years after the date on which the relevant contract is entered into, the licensed corporation or registered institution shall provide to the client, no later than the end of the fifth business day after receiving the request, the price per unit as referred to in subparagraph (d)(iii)(6) above; (g)(f) A licensed corporation or registered institution may, instead of preparing and providing to a client one or more than one contract note under subparagraph (a) above in respect of one or more than one relevant contract entered into on the same day, consolidate the contract note with any statement of account it is required to prepare and provide to the client under sections 8 or 9 (or any consolidation of such statements of account under section 10) of the Securities and Futures (Contract Notes, Statements of Account and Receipts) Rules (Cap. 571Q) in respect of the same day. Monthly statements of account (h)(g)Where any of the following circumstances applyapplies, a licensed corporation or registered institution should prepare and provide a monthly statement of account to its client no later than the end of the seventh business day after the end of the monthly accounting period: (i) during a monthly accounting period, the licensed corporation or registered institution is required to prepare and provide to the client a contract note or receipt; (ii) at any time during a monthly accounting period, the client has an account balance which is not nil; or

16 (iii) at any time during a monthly accounting period, any client virtual assets are held for the account of the client. (i)(h) Where a licensed corporation or registered institution is required to prepare a monthly statement of account, it should include the following information: (i) the name under which the licensed corporation or registered institution carries on business; (ii) the name, address and account number of the client to whom the licensed corporation or registered institution is required to provide the statement of account; and (iii) the date on which the statement of account is prepared. (j)(i) A licensed corporation or registered institution should also include, to the extent applicable, the following information in the monthly statement of account: (i) the address of the licensed corporation or registered institution’s principal place of business in Hong Kong; (ii) the outstanding balance of that account as at the beginning and the end of that monthly accounting period and details of all movements in the balance of that account during that period; (iii) details of all relevant contracts entered into by the licensed corporation or registered institution with or on behalf of the client during that monthly accounting period, indicating those initiated by thelicensed corporation or registered institution; (iv) details of all movements during that monthly accounting period of any client virtual assets held for that account; (v) the quantity and, in so far as readily ascertainable, the market price and market value of each client virtual asset held for that account as at the end of that monthly accounting period; and (vi) details of all income credited to and charges levied against that account during that monthly accounting period. Duty to provide statements of account upon request (k)(j) Where a licensed corporation or registered institution receives a request from a client for a statement of account as of the date of the request, it should: (i) prepare a statement of account in respect of the client which includes the information required for all statements of account (see subparagraph (ih) above) and, to the extent applicable, the following information relating to the account of the client as of the date of the request: (1) the outstanding balance of that account; and

17 (2) the quantity and, in so far as readily ascertainable, the market price and market value of each client virtual asset, held for that account.; and (ii) provide the statement of account to the client as soon as practicable after the date of the request. Receipts (l)(k) On each occasion that a licensed corporation receives any client moneyassets or a registered institution receives any client virtual assets from or on behalf of a client, the licensed corporation or the registered institution should prepare and provide a receipt to the client no later than the end of the second business day after receiving the client money and/or client virtual assets. (m)(l) The requirement under subparagraph (lk) is not applicable under the following circumstances: (i) where the client money is deposited directly into the bank account of a licensed corporation by the client or on behalf of the client by any person other than the licensed corporation; or (ii) where a contract note or other trade document provided to the client expressly states that it also serves as a receipt and includes the information specified in subparagraph (nm) below. (n)(m) A licensed corporation or registered institution should include the following information in thereceipt: (i) the name under which the licensed corporation or registered institution carries on business; (ii) the date on which the receipt is prepared; (iii) the name and account number of the client; and (iv) in respect of the client money and/or client virtual assets received: (1) the amount of client money and/or client virtual assets received; (2) the account into which the client money and/or client virtual assets has been deposited; and (3) the date on which the client money and/or client virtual assets was received. Miscellaneous (o)(n)Where a licensed corporation or registered institution receives a request from a client for a copy of any contract note, statement of account or receipt that the licensed corporation or registered institution was required to provide to the client, the licensed corporation or registered institution should, as soon as practicable

18 after receiving the request, provide the copy to the client. A licensed corporation or registered institution may impose a reasonable charge for a copy of the document provided by it under this paragraph. (p)(o)If, on an application made by a client, the SFC so directs, a licensed corporation or registered institution should make available for inspection by the client during the ordinary hours of business hours of the licensed corporation or registered institution a copy of any contract notes, statements of account or receipts, except for those dated after the expiration of the period for which the licensed corporation or registered institution is required to retain them. (q)(p)Where a licensed corporation or registered institution is required to prepare any contract notes, statements of account or receipts, the licensed corporation or registered institution should prepare them in the Chinese or English language as preferred by the client to whom they are intended to be provided. (r)(q) Any contract notes, statements of account or receipts (or any copies of any such documents) required to be provided to a client should for all purposes be regarded as duly provided to the client if they are served on: (i) the client; or (ii) any other person (except an officer or employee of the licensed corporation or registered institution which is required to provide the documents to the client) designated by the client for the purposesof this paragraphsubparagraph by notice in writing to the licensed corporation or registered institution which is required to provide the documents to the client., and it is: (I) delivered to the person by hand; (II) left at (where applicable), or sent by post to the person’s address; (III) sent by facsimile transmission to the person’s last known facsimile number; (IV) sent by electronic mail transmission to the person’s last known electronic mail address; or (V) provided to the person by access through the licensed corporation or registered institution should ensure that it has obtained consent from its clients and put in place adequate operational safeguards if any contract notes, statements of account or receipts required to be provided to a client are provided by accessing itsinstitution’s website11 . 11 Due regard should be paid to the SFC’s circular dated 29 September 2020 on Provision of Trade Documents to Clients by Access through Intermediaries’ Websites.

19 6.106.13 Where a client of a licensed corporation or registered institution is a professional investor within the meaning of: (a) any of paragraphs (a) to (i) of the definition of professional investor in section 1 of Part 1 of Schedule 1 to the SFO, and the licensed corporation or registered institution has notified the client in writing that unless the client objects, it will not provide to the client any contract notes, statements of account or receipts (as the case may be) in accordance with paragraph 6.1012 above and it has not received any objection from the client; or (b) paragraph (j) of the definition of professional investor in section 1 of Part 1 of Schedule 1 to the SFO and has agreed in writing with the licensed corporation or registered institution not to receive from it any contract notes, statements of account or receipts (as the case may be) in accordance with paragraph 6.1012 above; then paragraph 6.1012 (except for subparagraphs (kj), and (op) to (sq)) does not apply to the licensed corporation or registered institution in relation to the client. VII. Custody of client assets Client virtual assets 7.1 A licensed corporation or registered institution should holdproperly handle and safeguard client virtual assets. In particular, the licensed corporation or registered institution should, amongst others, comply with the following when conducting Relevant VA Dealing Activities: (a) Receive client virtual assets through and hold these client virtual assets on trust for its clients in a segregated account(s) established and maintained with : (i) an SFC-licensed platform and ; or (ii) an authorized financial institution (or a subsidiary of a locally incorporated authorized financial institution) which meets the expected standards of virtual asset custody issued by the Hong Kong Monetary Authority (HKMA) from time to time (referred to as “VA Segregated Account”). (a)(b)Subject to paragraphs 4.5 and 7.1(c), the licensed corporation or registered institution should ensure the following:all withdrawal or transfer of client virtual assets are made to the client directly from the VA Segregated Account(s). (b)(c) Subject to paragraph 4.35, the licensed corporation or registered institution should not deposit, transfer, lend, pledge, repledge or otherwise deal with or create any encumbrance over client virtual assets except for the settlement of transactions, and fees and charges owed by the client to the licensed corporation or registered institution in respect of the Relevant VA Dealing Activities carried out by the licensed corporation or registered institution on behalf of the client or in accordance with the client’s written instructions (including standing authorities (see paragraph 7.7 below) or one-off written directions); and.

20 (d) No client virtual assets should be paid or permitted to be paid to: (i) any officers or employees of the licensed corporation or registered institution; or (ii) any officers or employees of any corporations with which the licensed corporation or registered institution is in a controlling entity relationship, unless that officer or employee is the client of the licensed corporation or registered institution from whom or on whose behalf such client virtual asset has been received or is being held. (e) Ensure that receipt of client virtual assets from clients and withdrawal of client virtual assets to clients are conducted through a wallet address which belongs to the client. (c)(f) Access to the control of the movement of client virtual assets should be tightly restricted to authorisedauthorized personnel of the licensed corporation or registered institution to guard against losses arising from theft, fraud or other dishonest acts, professional misconduct or omissions. Client money 7.2 A licensed corporation should properly handle and safeguard client money. In particular, a licensed corporation should, amongst others, comply with the following when conducting Relevant VA Dealing Activities: (a) Establishing Establish one or more segregated bank accounts for holding client money received by it. Such segregated bank accounts should be established and maintained with an institution as specified in subparagraph (b) or (c) below, into which money received from or on behalf of a client should be paid within one business day of receipt. (b) Client money received by the licensed corporation in Hong Kong should be paid into a segregated account maintained with an authorised financial institution in Hong Kong. (c) Client money received by the licensed corporation in any other jurisdiction should be paid into a segregated account maintained with an authorisedauthorized financial institution in Hong Kong or another bank in another jurisdiction as agreed by the SFC from time to time. (b) Within one business day after a licensed corporation receives any client money: (i) pay it into a segregated bank account maintained with an authorized financial institution in Hong Kong; (ii) pay it into a segregated bank account maintained with another bank in another jurisdiction as agreed by the SFC from time to time if the client money is received outside Hong Kong;

21 (iii) pay it to the client from whom or on whose behalf it has been received; or (iv) pay it in accordance with the client’s standing authority (see paragraph 7.7 below) or one-off written direction. (d) I No client money should be paid or permitted to be paid to: (i) any officers or employees of the licensed corporation; or (ii) any officers or employees of any corporations with which the licensed corporation is in a controlling entity relationship, unless that officer or employee is the client of the licensed corporation from whom or on whose behalf such client money has been received or is being held. (e) (d) No client money should be paid out of a segregated bank account other than for: (i) paying the client on whose behalf it is being held; (ii) meeting the client’s settlement obligations in respect of Relevant VA Dealing Activities carried out by the licensed corporation on behalf of the client, being the client on whose behalf it is being held; (iii) paying money that the client, being the client on whose behalf it is being held, owes to the licensed corporation in respect of the conduct of Relevant VA Dealing Activities; or (iv) paying in accordance with the client’s written instructions, including standing authorities (see paragraph 7.7 below) or one-off written directions. 7.3 Subject to paragraph 7.4 below, any amount of interest derived from the holding of client money in a segregated bank account should be dealt with in accordance with paragraph 7.2 above. 7.4 A licensed corporation should ensure that any amount of interest retained in a segregated bank account which the licensed corporation is entitled to retain under an agreement in writing with a client of the licensed corporation, being the client on whose behalf the client money is being held, should be paid out of the account within one business day after: (a) the interest is credited to the account; or (b) the licensed corporation becomes aware that the interest has been credited to the account, whichever is later. 7.5 A licensed corporation which becomes aware that it is holding an amount of money in a segregated bank account that is not client money shall, within one business day of becoming so aware, pay that amount of money out of the segregated bank account. 7.57.6 A licensed corporation should use its best endeavours to match any unidentified receipts in its bank accounts (including segregated accounts) with all relevant information in order to establish the nature of any paymentreceipt and the identity of the person who has made it. (a) Upon ascertaining that a receipt represents client money, the amount should be

22 transferred into a segregated bank account within one business day, even if it has not been able to identify which specific client has made the payment. (b) Where the receipt is not client money, within one business day of becoming so aware, that amount of money should be paid out of the segregated bank account. Standing authority to deal with client assets 7.7 A standing authority is a written instruction that is given to a licensed corporation or the registered institution which: (a) authorizes the licensed corporation or the registered institution to deal with client assets from time to time received from or on behalf of or held on behalf of the client, in one or more specified ways; (b) specifies a period not exceeding 12 months during which it is valid. This does not apply to a standing authority which is given to the licensed corporation or the registered institution by a client of the licensed corporation or the registered institution who is a professional investor; and (c) specifies the manner in which it may be revoked. 7.8 A standing authority which is not revoked prior to its expiry: (a) may be renewed for one or more further periods: (i) not exceeding 12 months, if the client of the licensed corporation or the registered institution who gave it is not a professional investor; or (ii) of any duration, if the client of the licensed corporation or the registered institution who gave it is a professional investor, at any one time, with the written consent of the client of the licensed corporation or the registered institution who gave it; or (b) shall be deemed to have been renewed if: (i) at least 14 days prior to the expiry of the standing authority, the licensed corporation or the registered institution to which it was given gives a written notice to the client of the licensed corporation or the registered institution who gave the standing authority, reminding the client of its impending expiry, and informing the client that unless the client objects, it will be renewed upon expiry upon the same terms and conditions as specified in the standing authority and for: (I) an equivalent period to that specified in the standing authority; (II) any period not exceeding 12 months specified by the licensed corporation or the registered institution, if the client of the licensed corporation or the registered institution is not a professional investor; or

23 (III) a period of any duration specified by the licensed corporation or the registered institution, if the client of the licensed corporation or the registered institution is a professional investor; and (ii) the client does not object to the renewal of the standing authority before its expiry. Where a standing authority is deemed to have been renewed in accordance with subparagraph (b), the licensed corporation or the registered institution shall give a written confirmation of the renewal of the standing authority to the client of the licensed corporation or the registered institution within one week after the date of expiry. Disclosure to clients 7.67.9 A licensed corporation or registered institution should fully disclose to its clients the custodial arrangements in relation to client assets held on their behalf, including the rights and obligations of each party and how client assets are stored. This should include: (a) for a licensed corporation or registered institution, client virtual assets may not enjoy the same protection as that conferred on “client securities” under the SFO and the Securities and Futures (Client Securities) Rules (Cap. 571H); (b) for a licensed corporation, client money may not enjoy the same protection as that conferred on “client money” under the SFO and the Securities and Futures (Client Money) Rules (Cap. 571I); (c) how the licensed corporation or registered institution will compensate its clients in the event of hacking or any other losses of client virtual assets caused by the default of an SFC-licensed platform or its associated entity; and (d) the treatment of client virtual assets kept at the SFC-licensed platform and their respective rights and entitlements when events such as, but not limited to, voting, hard forks and airdrops occur. Upon becoming aware of such events, a licensed corporation or registered institution should notify its clients as soon as practicable. VIII. Record keeping 8.1 A licensed corporation or registered institution should establish policies and procedures to ensure the integrity, security, availability, reliability and completeness of all information, both in physical and electronically stored form, in relation to Relevant VA Dealing Activities. 8.2 A licensed corporation or registered institution should, in relation to its Relevant VA Dealing Activities: (a) keep, where applicable, such accounting, trading and other records as are sufficient to:

24 (i) explain and reflect the financial position and operation of such businesses; (ii) enable profit and loss accounts and balance sheets which give a true and fair view of its financial affairs to be prepared from time to time; (iii) account for all client virtual assets and client money it receives or holds in relation to its Relevant VA Dealing Services; (iv) enable all movements of such client virtual assets and client money it receives or holds in relation to its Relevant VA Dealing Services to be traced through its accounting systems; (v) show separately and account for all receipts, payments, deliveries and other uses or applications of the client assets effected by it, or on its behalf, and on whose behalf such receipts, payments, deliveries or other uses or applications of the client assets have been effected; (v)(vi)reconcile, on a daily basis, any differences in its balances or positions with other persons, including banks and SFC-licensed platform(s), and show how such differences were resolved; (vi)(vii) demonstrate compliance with, and that it has systems of control in place to ensure compliance with, Part VII (Custody of Client Assets) herein; and (vii)(viii) enable, in relation to a licensed corporation, it to readily establish whether it has complied with the Securities and Futures (Financial Resources) Rules and other financial resources requirements in Part III (Financial Soundness); (b) keep those records in such a manner as will enable an audit to be conveniently and properly carried out; and (c) make entries in those records in accordance with generally accepted accounting principles. The records required to be kept are specified in paragraph 8.6 below. Form and premises in which records are to be kept 8.3 A licensed corporation or registered institution should keep all the required records: (a) in writing in the Chinese or English language; or (b) in such a manner as to enable them to be readily accessible and readily convertible into written form in the Chinese or English language. 8.4 A licensed corporation or registered institution should adopt all reasonably necessary procedures to guard against the falsification of any of the required records and, to facilitate the discovery of any such falsification and to ensure the security, authenticity, reliability, integrity, confidentiality and timely availability of required records.

25 8.5 A licensed corporation should keep all the required records at the premises used by it which have been approved under section 130(1) of the SFO. A registered institution should keep all required records in accordance with the applicable requirements. Records to be kept 8.6 A licensed corporation or registered institution should retain the following records: (a) Records showing particulars of: (i) all money received by it, whether or not such money belongs to it, or is paid into accounts maintained by it or on its behalf, and disbursed by it; (ii) all income received by it, whether the income relates to charges made by it for the provision of services, commissions, brokerage, remuneration, interest or otherwise; (iii) all expenses, commissions and interest incurred or paid by it; (iv) all orders or instructions concerning client virtual assets that it receives or initiates, including particulars: (1) of the date and time that any order or instruction was received, executed, modified (including particulars of any subsequent modifications) or cancelled; (2) of each transaction entered into by it or on its behalf to implement any such order or instruction; (3) identifying with whom or for whose account it has entered into such transaction; and (4) that enable such transaction to be traced through its accounting, trading and settlement systems; (v) all disposals of client virtual assets initiated by it, showing in the case of each disposal: (1) the name of the client; (2) the date on which the disposal was effected; (3) the name of the SFC-licensed platform which effected the disposal; (4) the charges incurred for effecting the disposal; and (5) the proceeds of the disposal and how such proceeds were dealt with; (vi) its assets and liabilities, including financial commitments and contingent liabilities; (vii) all virtual assets belonging to it, identifying:

26 (1) with whom such virtual assets are deposited; and (2) the date on which they were so deposited; (viii) all virtual assets held by it but not belonging to it, identifying: (1) for whom such virtual assets are held and with whom they are deposited, ie, VA Segregated Account(s) with the relevant SFC￾licensed platform; and/ or authorized financial institution (or a subsidiary of a locally incorporated authorized financial institution); and (2) the date on which they were so deposited; (ix) all bank accounts held by it, including segregated accounts maintained; (x) all other accounts held by it; and (xi) all off-balance sheet transactions or positions; (b) Records of all contracts (including written agreements with clients) entered into by it; (c) Records evidencing: (i) any standing authority given to it by a client and any renewal of such authority; and (ii) any one-off written directions given to it by a client; (d) Records of knowing your clients, including the process and outcomes of any risk profiling; (e) Records of suitability assessments conducted; (f) In respect of a client who is a professional investor any notice given by it to the client or agreement by the client with it referred to in paragraph 6.1113 above; (eg) A copy of each monthly statement of account prepared in accordance with Part VI (Dealing with Clients) above; (fh) Records of all client complaints relating to client virtual assets and client money it receives or holds in relation to the Relevant VA Dealing Services and details of follow-up action, including the substance and resolution of each complaint; (gi) Records regarding client identity for confirmation of the origination of the instructions and the beneficiaries and details of the instructions as prescribed in paragraph 6.56 above; and (hj) To the extent not already covered elsewhere in this paragraph, records evidencing the licensed corporation or registered institution’s compliance with these Terms and conditions.

27 8.7 A licensed corporation or registered institution should retain the records required under paragraph 8.6 (except for records required to be kept under paragraph 8.6(a)(iv)) for a period of not less than seven years. 8.8 A licensed corporation or registered institution should retain the following for a period of not less than two years: (a) a copy of each contract note and receipt prepared in accordance with Part VI (Dealing with Clients) above; (b) a copy of each statement of account prepared upon athe client’s request in accordance with paragraph 6.10(k12(j) above; and (c) records required to be kept under paragraph 8.6(a)(iv) above. IX. Auditors 9.1 A licensed corporation should prepare and submit an auditor’s report in respect of a financial year which contains, in addition to other information required under the laws, a statement by the auditor as to whether, in the auditor’s opinion: (a) during the financial year in question, the licensed corporation had systems of control in place which were adequate to ensure compliance with Part VII (Custody of Client Assets) above; (b) during the financial year in question, the licensed corporation complied with Part VII (Custody of Client Assets) and Part VIII (Record Keeping) above; and (c) whether the licensed corporation has contravened the financial soundness requirement under Part III (Financial Soundness) above. X. Anti-money laundering / counter-financing of terrorism 10.1 A licensed corporation or registered institution should ensure that its anti-money laundering and counter-financing of terrorism (AML/CFT) systems can adequately manage the money laundering and terrorist financing (ML/TF) risks relating to its Relevant VA Dealing Activities and take specific measures which include, but are not limited to the following: (a) to identify and assess the ML/TF risks which may arise in relation to virtual asset dealing services, business practices and technologies prior to their launch; (b) to establish and maintain adequate and effective systems and processes, including suspicious transaction indicators relating to its Relevant VA Dealing Activities to monitor a client’s transactions and conduct appropriate enquiries and evaluations of potentially suspicious transactions. In particular, to regularly review the factors which determine the extent and depth of monitoring (including suspicious transaction indicators and any monetary or other thresholds used for monitoring) for continued relevance to its current monitoring programme; and

28 (c) to regularly review the effectiveness of its AML/CFT systems and introduce enhancement measures where appropriate, taking into account any relevant guidance issued by the SFC or the Hong Kong Monetary Authority (HKMA), where applicable, and updates from the Financial Action Task Force Recommendations applicable to virtual asset-related activities (for instance, the Interpretive Note to Recommendation 15 and Updated Guidance for a Risk-based Approach to Virtual Assets and Virtual Asset Service Providers). XI.X. Conflicts of interest 10.1 A licensed corporation or registered institution should not engage in virtual asset market making activities on an SFC-licensed platform through which it provides to its clients services in Relevant VA Dealing Activities. XII.XI. Ongoing reporting obligations 11.1 A licensed corporation or registered institution should report to the SFC (and the HKMA in the case of a registered institution) as soon as practicable upon the happening of any actual or suspected material non-compliance with these Terms and conditions. 11.2 A licensed corporation or registered institution should provide any information in relation to its Relevant VA Dealing Activities as may be requested by the SFC (and the HKMA in the case of a registered institution) from time to time. The SFC (and the HKMA in the case of a registered institution) may request information on a periodic or ad hoc basis.

29 Schedule 1 – Existing regulatory requirements applicable to a licensed corporation or registered institution providing virtual asset dealing services under an omnibus account arrangement Relevant codes (1) The Code of Conduct, except for the following paragraphs which are not relevant or have been modified and incorporated in these Terms and conditions: ▪ Paragraph 5.1A (Know your client: investor characterization) ▪ Paragraph 5.3 (Know your client: derivative products) ▪ Paragraph 5.4 (Client identity: origination of instructions and beneficiaries) ▪ Paragraph 16 (Analysts) ▪ Paragraph 17 (Sponsors) ▪ Paragraph 19 (Alternative liquidity pools) ▪ Paragraph 20 (Dealing with group affiliates and other connected persons) ▪ Paragraph 21 (Bookbuilding and placing activities in equity capital market and debt capital market transactions) ▪ Schedule 3 (Additional requirements for licensed or registered persons dealing in securities listed or traded on The Stock Exchange of Hong Kong Limited) ▪ Schedule 4 (Additional requirements for licensed or registered persons dealing in futures contracts and/or options contracts traded on Hong Kong Futures Exchange Limited) ▪ Schedule 5 (Additional requirements for licensed persons providing margin lending) ▪ Schedule 6 (Additional requirements for licensed persons engaging in leveraged foreign exchange trading) ▪ Schedule 8 (Additional requirements for licensed or registered persons operating alternative liquidity pools) ▪ Schedule 10 (Risk mitigation requirements and margin requirements in relation to non-centrally cleared OTC derivative transactions)

30 Relevant guidelines (2) Guidelines on Online Distribution and Advisory Platforms (3) Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations and SFC-licensed Virtual Asset Service Providers) and Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Authorized Institutions) (as applicable) (4) Guidelines for Reducing and Mitigating Hacking Risks Associated with Internet Trading (5) Management, Supervision and Internal Control Guidelines for Persons Licensed by or Registered with the Securities and Futures Commission (6) Fit and Proper Guidelines (7) Guidelines on Competence (8) Guidelines on Continuous Professional Training

31 Part II – Virtual asset advisory services Licensing or registration conditions for licensed corporations or registered institutions providing virtual asset advisory services (a) (i) [For licensee or registered institution which provides services to retail investors and/ or professional investors] With respect to providing virtual asset advisory services, the licensee or registered institution shall only provide such services to persons which are, and remain at all times, clients of the licensed corporation or registered institution in respect of its business in Type 4 regulated activity (advising on securities). The term “advising on securities” is specified in Part 2 of Schedule 5 to the Securities and Futures Ordinance. The term “virtual asset” is defined in section 53ZRA of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance. (ii) [For licensee or registered institution which only provides services to professional investors] With respect to providing virtual asset advisory services, the licensee or registered institution shall only provide such services to professional investors which are, and remain at all times, clients of the licensed corporation or registered institution in respect of its business in Type 4 regulated activity (advising on securities). The term “professional investor” is defined in section 1 of Part 1 of Schedule 1 to the Securities and Futures Ordinance (“(SFO”)) together with the Securities and Futures (Professional Investor) Rules. The term “advising on securities” is specified in Part 2 of Schedule 5 to the SFO. The term “virtual asset” is defined in Part Isection 53ZRA of the TermsAnti-Money Laundering and conditions for licensed corporations or registered institutions providing virtual asset advisory services (as amended from time to time).Counter-Terrorist Financing Ordinance. (b) With respect to providing virtual asset advisory services, the licensee or registered institution shall comply with the attached “Terms and conditions for licensed corporations or registered institutions providing virtual asset advisory services” (as amended from time to time). The term “virtual asset” is defined in Part Isection 53ZRA of the TermsAnti￾Money Laundering and conditions for licensed corporations or registered institutions providing virtual asset advisory services (as amended from time to time).Counter￾Terrorist Financing Ordinance.

32 Terms and conditions for licensed corporations or registered Institutions providing virtual asset advisory services I. Interpretation A reference in these Terms and conditions for licensed corporations or registered Institutions providing virtual asset advisory services (Terms and conditions) to: ▪ “AMLO” means the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615); ▪ “client” means a person to whom a licensed corporation or registered institution provides virtual asset advisory services; ▪ “Code of Conduct” means the Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission; ▪ “licensed corporation” means a corporation which is granted a licence under section 116 of the SFO; ▪ ”“professional investor” has the meaning as defined in section 1 of Part 1 of Schedule 1 to the SFO; ▪ “registered institution” means an authorisedauthorized financial institution which is registered under section 119 of the SFO; ▪ “retail client” or “retail investor” means any person other than a professional investor; ▪ “Relevant VA Advisory Activities” means any virtual asset advisory services provided by the licensed corporation or registered institution to its clients; ▪ “SFO” means the Securities and Futures Ordinance (Cap. 571); ▪ “Code of Conduct” means the Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission; and ▪ “virtual asset” means digital representations of value which may be in the form of digital tokens (such as utility tokens, stablecoins or security or asset-backed tokens) any other virtual commodities, crypto assets or other assets of essentially the same nature, irrespective of whether they amount to “securities” or “futures contracts” as defined under the SFO, but excludes digital representations of fiat currencies issued by central banks. ▪ “SFC-licensed platform” means a virtual asset trading platform operator which is licensed by the SFC pursuant to section 116 of the SFO and/or section 53ZRK of the AMLO; and ▪ “virtual asset” means any “virtual asset” as defined in section 53ZRA of the AMLO.

33 II. Codes and guidelines 2.1 In conducting its Relevant VA Advisory Activities, to the extent not already covered elsewhere in these Terms and conditions, a licensed corporation or registered institution is expected to observe the requirements of the codes and guidelines (as supplemented by the circulars and FAQs issued from time to time and, in particular, the suitability requirement under paragraph 5.2 of the Code of Conduct) published by the SFC as if: (i) any reference to a financial product (for example, securities) or investment product included virtual assets; (ii) any reference to a client included a person to whom the licensed corporation or registered institution provides services in Relevant VA Advisory Activities; and (iii) any reference to regulated activities included Relevant VA Advisory Activities. III. Virtual asset-knowledge test and suitability 3.1 Except for institutional and qualified corporate professional investors12, a licensed corporation or registered institution should assess a client’s knowledge of virtual assets (including knowledge of therelevant risks associated with virtual assets) before providing any services to the client13 . 3.2 Where a client does not possess such knowledge, a licensed corporation or registered institution may only provide virtual asset advisory services in Relevant VA Advisory Activities to the client if the licensed corporation or registered institution has provided adequate training to the client. 3.3 A licensed corporation or registered institution should also ensure that the client has sufficient net worth to be able to assume the risks and bear the potential losses of trading in virtual assets. Except for institutional and qualified corporate professional investors, a licensed corporation or registered institution, before providing services in Relevant VA Advisory Activities, should assess a client’s risk tolerance level, accordingly determine the client’s risk profile and assess whether it is suitable for the client to participate in the trading of virtual assets. The licensed corporation or registered institution should exercise due skill, care and diligence to ensure the methodology for risk profiling is properly designed and should determine the client’s risk profile based on an assessment of the information about the client obtained through its know-your-client process. The methodology adopted for categorising clients and an explanation of the risk profiles of clients should be made available to the client14 . 3.4 In conducting any Relevant VA Advisory Activities, a licensed corporation or registered institution should enter into a written client agreement with each client15 in the same 12 See footnote 34 above. 13 See footnote 45 above. 14 Where risk-scoring questionnaires are used to risk profile clients, the licensed corporation or registered institution should pay particular attention to the design of the questions and the underlying scoring mechanism, which should be properly designed to accurately reflect the personal circumstances of a client. The licensed corporation or registered institution should also have appropriate processes in place to periodically review the risk profiling methodology and mechanism for clients. 15 Except for institutional and qualified corporate professional investors (see footnote 3 for definitions)..

34 manner as set out in paragraph 6 of the Code of Conduct and include a provision stating that: “…… if we [the licensed corporation or registered institution] solicit the sale of or recommend any product including any virtual assets to you [the client], the product must be reasonably suitable for you, having regard to your financial situation, investment experience and investment objectives. No other provision of this agreement or any other document we may ask you to sign and no statement we may ask you to make derogates from this clause.” 3.5 Where a licensed corporation or registered institution provides services in Relevant VA Advisory Activities to retail clients, the licensed corporation or registered institution should take all reasonable steps to ensure that the virtual asset recommended: (i) is of high liquidity. In assessing the liquidity of a specific virtual asset for trading by retail clients, the licensed corporation or registered institution should, at a minimum, ensure that the virtual asset is an eligible large-cap virtual asset, ie, the specific virtual asset should have been included in a minimum of two acceptable indices issued by at least two different index providers; and Note 1: An acceptable index refers to an index which has a clearly defined objective to measure the performance of the largest virtual assets in the global market, and should fulfil the following criteria: (a) The index should be investible, meaning the constituent virtual assets should be sufficiently liquid; (b) The index should be objectively calculated and rules-based; (c) The index provider should possess the necessary expertise and technical resources to construct, maintain and review the methodology and rules of the index; (d) The methodology and rules of the index should be well documented, consistent and transparent. Note 2: The two index providers should be separate and independent from each other, the issuer of the virtual asset (if applicable) and the licensed corporation or registered institution (for example, they are not within the same group of companies). Further, at least one of the indices should be issued by an index provider which complies with the IOSCO Principles for Financial Benchmarks and has experience in publishing indices for the conventional securities market. (ii) is made available by SFC-licensed platforms for trading by retail investors.

Terms and conditions for licensed corporations or registered institutions which manage portfolios that invest in virtual assets October 2023 Appendix 7

2 Contents I. General 3 II. Codes and guidelines 5 III. Financial resources 5 IV. Custody of fund assets 5 V. Operations 9 VI. Dealing with the fund and fund investors 11 VII. Reporting to the SFC/ HKMA 11 Schedule 1 – Existing regulatory requirements applicable to Virtual Asset Fund Managers 13 Schedule 2 – Requirements for Virtual Asset Fund Managers conducting discretionary accounts management 15 Schedule 3 – Risk management control techniques and procedures 19 Schedule 4 – Risk disclosure statements 21

3 I. GENERAL Interpretation A reference in these terms and conditions (Terms and Conditions) to: • “AMLO” means the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615); • "fund" or "client" generally means a collective investment scheme1 managed by a Virtual Asset Fund Manager that invests in Virtual Assets and meets the de minimis threshold, except where a Virtual Asset Fund Manager is a delegate of another fund manager for the management of a fund or a portfolio within a fund, in which case a reference to "client" means the delegating fund manager, and a reference to "fund" means the portfolio managed by the delegated Virtual Asset Fund Manager; • "fund investors" means investors as a whole of a collective investment scheme managed by a Virtual Asset Fund Manager; • “professional investor” has the meaning as defined in section 1 of Part 1 of Schedule 1 to the Securities and Futures Ordinance (Cap. 571) (SFO); • “retail client” means any person other than a professional investor; • “Relevant VA Asset Management Activities” means any Virtual Asset related asset management activities carried out by a Virtual Asset Fund Manager for its fund or client; • “Virtual Assets” means any “virtual asset” as defined in section 53ZRA of the AMLO; • “Virtual Asset Fund Manager” means a licensed corporation or registered institution that manages a fund (or portion of a fund) that invests in Virtual Assets and meets the de minimis threshold; • “de minimis threshold” refers to the situation where either: (a) the stated investment objective of a fund is to invest in Virtual Assets or (b) the intention of a fund is to invest 10% or more of its gross asset value (GAV) in Virtual Assets. For the avoidance of doubt, a fund will not be regarded as having met the de minimis threshold in the following situation: (a) its mandate is to mainly invest in securities (including tokenised securities), futures contracts or both and there is no intention to invest 10% or more of its GAV in Virtual Assets; and (b) its investment in Virtual Assets exceeds 10% of its GAV due to the increase in prices of the Virtual Assets held in that fund, but all reasonably practicable steps are being taken to reduce the fund’s investment in Virtual Assets in a timely manner so as to reduce such investment proportion to below 10% of its GAV. 1 These Terms and Conditions are designed for collective investment schemes in corporate form. If the collective investment schemes managed by the licensed corporation or registered institution adopt a different structure, for example, a unit trust structure, these Terms and Conditions will be modified accordingly.

4 However, if the situation referred to in (b) is anticipated to persist, the SFC (as well as the HKMA in the case of a registered institution) should be duly alerted by the licensed corporation or registered institution concerned so that the SFC (in consultation with the HKMA, where applicable) could consider imposing these Terms and Conditions on that licensed corporation or registered institution. Application Please note that: (a) certain Terms and Conditions (ie, paragraphs 4.1 to 4.12, 5.2, 5.6 to 5.7 and 6.1) are only applicable to a Virtual Asset Fund Manager that is responsible for the overall operation of a fund or has been delegated responsibility for that function; and (b) the additional requirements that are applicable to Virtual Asset Fund Managers conducting discretionary accounts management are set out in Schedule 2 of these Terms and Conditions.

5 II. CODES AND GUIDELINES 2.1 In conducting Relevant VA Asset Management Activities, to the extent not already covered elsewhere in these Terms and Conditions, a Virtual Asset Fund Manager is expected to observe the requirements of the codes and guidelines (as supplemented by circulars, frequently asked questions and other related guidance issued by the SFC from time to time) listed in Schedule 1 hereto as if: (a) any reference to a financial product (for example, securities) or investment product included virtual assets; (b) any reference to a client/ fund included a person/ fund to whom a Virtual Asset Fund Manager provides services in Relevant VA Asset Management Activities; (c) any reference to client assets included fund assets; and (d) any reference to regulated activities included Relevant VA Asset Management Activities. III. FINANCIAL RESOURCES 3.1 If the Virtual Asset Fund Manager, which is a licensed corporation, holds Virtual Assets on behalf of the funds it manages, the Virtual Asset Fund Manager shall at all times maintain liquid capital which is not less than an amount equal to the higher of (a) HK$ 3 million and (b) its variable required liquid capital. The terms “liquid capital” and "variable required liquid capital" shall have the same meaning as defined in section 2 of the Securities and Futures (Financial Resources) Rules (Cap. 571N). IV. CUSTODY OF FUND ASSETS Safety of fund assets 4.1 A Virtual Asset Fund Manager should ensure that any fund assets entrusted to it are accounted for properly and promptly and adequately safeguarded. In this connection: (a) A Virtual Asset Fund Manager should select and arrange for the appointment of, and entrust the fund assets to, a custodian that is functionally independent from it; (b) A Virtual Asset Fund Manager should ensure that fund assets are segregated from the assets of the Virtual Asset Fund Manager, and, unless held in an omnibus client account, assets of other clients; (c) Where fund assets are held in an omnibus client account, the Virtual Asset Fund Manager should ensure that adequate safeguards are put in place such that assets belonging to each fund are appropriately recorded with frequent and appropriate reconciliations being performed; and (d) A Virtual Asset Fund Manager should implement and maintain adequate processes and controls when:

6 (i) Creating new accounts with trading platforms and custodians; (ii) Whitelisting new internet protocol addresses (IP addresses) at trading platforms and custodians; (iii) Whitelisting new wallet addresses at trading platforms and custodians; and (iv) Effecting transfer of assets between trading platforms, custodians and wallets held by the Virtual Asset Fund Manager. 4.2 Where a Virtual Asset Fund Manager (except for a Virtual Asset Fund Manager that is a registered institution) receives fiat currency on behalf of the funds it manages (client money), it should: (a) establish one or more segregated bank accounts for holding the client money received by it. Such bank accounts should be established and maintained with an authorized financial institution in Hong Kong or another bank in a jurisdiction as agreed by the SFC from time to time; (b) ensure that such client monies are (i) transferred into a segregated bank account; or (ii) paid to the fund, within one business day after the receipt of such currencies; (c) ensure that client money is retained in the segregated bank account until it is: (i) paid to the fund managed by the Virtual Asset Fund Manager, being the client on whose behalf it is being held; (ii) required to pay money that the fund managed by the Virtual Asset Fund Manager, being the fund on whose behalf it is being held, owes to the Virtual Asset Fund Manager; or (iii) required to meet the fund’s obligations to meet settlement or margin requirements. A Virtual Asset Fund Manager may not pay, or permit to be paid, any client money of the Virtual Asset Fund Manager to any of its officers or employees or any officer or employee of any corporation with which the Virtual Asset Fund Manager is in a controlling entity relationship2 , unless that officer or employee is the fund investor of the fund on whose behalf such client money is being held; and (d) pay out of the segregated bank account any amount held in the segregated bank account that is not client money within one business day of becoming so aware. 4.3 A Virtual Asset Fund Manager should select the most appropriate custodial arrangement for holding fund’s Virtual Assets. In assessing which custodial arrangement (or combination of custodial arrangements) to adopt, the Virtual Asset Fund Manager should assess the advantages and disadvantages of holding Virtual Assets under each custodial arrangement (for example, independent custodian or self-custody, host locations, use of hot or cold wallets) with reference to, among other things,: 2 As defined under Part 1 of Schedule 1 to the SFO.

7 (a) the ease with which Virtual Assets are accessible, ie, the time required to transfer the Virtual Assets to the trading venue; and (b) the security of the custodial facility, ie, whether there are adequate safeguards in place to protect the facility from external threats, including cyberattacks or the ability of the custodian to compensate for any loss of Virtual Assets. A Virtual Asset Fund Manager should also assess the features and characteristics of the different custodial arrangements. For example: (a) the hardware and software infrastructure; (b) the Virtual Assets which are supported; (c) the security controls over key generation, storage, management and transaction signing; (d) the documented process of handling software upgrades to the storage devices used by the custodians and the Virtual Asset Fund Manager; and (e) the process of handling blockchain forks. A Virtual Asset Fund Manager should document the reasons for selecting its custodial arrangements, including self-custody of Virtual Assets. Self-custody 4.4 Where self-custody is adopted, the Virtual Asset Fund Manager should ensure that it has effective policies, procedures, and internal controls in place to protect the fund from financial loss arising from theft, fraud, and other dishonest acts, professional misconduct or omissions. For example, the persons fulfilling the custodial function are independent from the persons fulfilling the fund’s management functions. 4.5 A Virtual Asset Fund Manager should ensure that the assets held in self-custody are identified as owned beneficially by the fund and not by the Virtual Asset Fund Manager through proper record-keeping and arrangements to ensure that these assets can be effectively segregated from the Virtual Asset Fund Manager’s own assets upon the Virtual Asset Fund Manager’s insolvency. For example, the Virtual Asset Fund Manager may make a declaration of trust over the fund’s crypto wallet (including access keys) and all assets held in the wallet. 4.6 A Virtual Asset Fund Manager should acquire and maintain adequate insurance cover over these assets. Selection and appointment of an independent custodian 4.7 A Virtual Asset Fund Manager should exercise due skill, care and diligence in the selection, appointment, and ongoing monitoring, of the custodian and take all reasonable steps to ensure that the custodian is capable of performing its functions. On an ongoing basis, a Virtual Asset Fund Manager should satisfy itself as to the continued suitability and financial

8 standing of any appointed custodian, for example, a Virtual Asset Fund Manager should request for and review the audited financial statements of the appointed custodian. Moreover, a Virtual Asset Fund Manager should consider appointing more than one custodian to avoid undue concentration of risks. Note: In considering whether a custodian is capable of properly performing its functions, the Virtual Asset Fund Manager should consider the following as part of the selection process for custodians3 and document the reasons for its selection: (a) the experience and track record of the custodian in providing custodial services for Virtual Assets, for example, the number of years for which the custodian has provided custodial services for Virtual Assets and the types of Virtual Assets which have been under its custody; (b) the regulatory status of the custodian, in particular, whether the custodian is subject to any regulatory oversight over its Virtual Asset custodial business; (c) the corporate governance structure and background of the senior management of the custodian; (d) whether the custodian has appropriate segregation arrangements in place such that the fund assets are, throughout the custody chain, segregated from: (i) the assets of the custodian/ sub-custodian; and (ii) the assets of other funds and other clients of the custodian (unless the fund assets are held in an omnibus client account); (e) the financial resources and insurance cover of the custodian (ie, the custodian's ability to compensate its customers in the event of any loss of customers’ assets); (f) the custodian's management of actual and potential conflicts of interest; (g) the custodian's operational capabilities and arrangements, for example, the “wallet” arrangements and cybersecurity risk management measures; (h) the physical setup and processes of the custodian, especially in dealing with transfer of assets, blockchain forks and software upgrades of devices; and (i) where the appointment of sub-custodians is allowed, the custodian would use due skill, care and diligence in the selection, appointment and monitoring of its sub￾custodians. To the extent possible, a Virtual Asset Fund Manager should select a custodian that is subject to regulatory oversight over its Virtual Asset custodial business. 3 Where the custodian also operates as a Virtual Asset trading platform, a Virtual Asset Fund Manager may also consider other factors, such as the liquidity provided by the trading platform, during the selection process.

9 Custody agreement 4.8 A Virtual Asset Fund Manager should ensure that a formal custody agreement is entered into with the custodian that is to be entrusted with a fund's assets. 4.9 A Virtual Asset Fund Manager should formulate custodial arrangements with due skill, care and diligence and clarify the duties and responsibilities of the various parties to the custodial arrangements. In particular, the Virtual Asset Fund Manager should ensure that the custody agreement contains provisions to specify the scope of the responsibility and liability of the custodian. 4.10 A Virtual Asset Fund Manager should monitor custodial arrangements and the custodian's compliance with the terms of the custody agreement on an ongoing basis. Disclosure of custodial arrangements 4.11 A Virtual Asset Fund Manager should ensure that: (a) the custodial arrangements in respect of assets of the fund, which should include the intended distribution of the amount of assets kept with each custodian and under self-custody of the Virtual Asset Fund Manager if the Virtual Asset Fund Manager intends to keep more than 10% of the fund’s assets (in terms of GAV) with a particular custodian or under self-custody; and (b) any material risks associated with the arrangements are properly disclosed to the fund investors and that fund investors are updated about any significant changes. 4.12 Where the Virtual Asset Fund Manager intends to hold fund assets in self-custody, the Virtual Asset Fund Manager should also specifically disclose the existence and risks of such an arrangement, the additional safeguards that have been put in place and the details of insurance coverage over these assets (where applicable). V. OPERATIONS Risk management 5.1 A Virtual Asset Fund Manager should take into account, where applicable, the risk management control techniques and procedures set out in Schedule 3 in monitoring such risks. Fund portfolio valuation 5.2 The Virtual Asset Fund Manager should exercise due care to ensure that valuation policies, principles, methodologies and models selected are reasonably appropriate in light of the circumstances and in the best interests of the fund and fund investors. Record keeping 5.3 A Virtual Asset Fund Manager should establish and implement effective policies and

10 procedures to ensure the integrity, security, availability, reliability and completeness of all information, both in physical and electronically stored form, relevant to the Virtual Asset Fund Manager’s business operations. 5.4 A Virtual Asset Fund Manager should keep its accounts and records properly. Proper record keeping includes: (a) maintaining an audit trail of all transactions (such as orders placed, trades executed and allocated, trades settlement, deposits and withdrawals of fund assets) effected by the Virtual Asset Fund Manager, all information relating to fund accounts produced by third parties and all relevant internal reports, including trade confirmations, statements of account and records of investment processes adopted. In addition, in respect of each fund for whom the Virtual Asset Fund Manager holds assets, the Virtual Asset Fund Manager should maintain sufficient records to show particulars of the fund’s assets and liabilities, including any financial commitments and contingent liabilities; (b) maintaining sufficient records to demonstrate that the Virtual Asset Fund Manager has complied with these Terms and Conditions; (c) keeping records in such a manner as will enable an audit to be conveniently and properly carried out; and (d) making entries in the records in accordance with generally accepted accounting principles. 5.5 A Virtual Asset Fund Manager should retain- (a) subject to paragraph (b), the records or documents as mentioned under paragraph 5.4 for a period of not less than seven years; and (b) in the case of records or documents showing particulars of any orders concerning Virtual Assets that are initiated by the Virtual Asset Fund Manager, for a period of not less than two years. A Virtual Asset Fund Manager that is a licensed corporation should retain records or documents related to its business as mentioned under paragraph 5.4 in premises which have been approved by the SFC for keeping records or documents required under the SFO or the AMLO4 . Auditors and audited accounts 5.6 A Virtual Asset Fund Manager should ensure that an independent auditor is appointed to perform an audit of the financial statements of the fund (whether by appointing the independent auditor or procuring the relevant fund to appoint the independent auditor) in order to make available, at a minimum, an annual report for each of the funds it manages. When selecting the auditor, the Virtual Asset Fund Manager should take into account, among other things, the experience and capability of the auditor in auditing the financial statements of Virtual Asset funds. A Virtual Asset Fund Manager should understand the steps taken by the auditor in proving the existence and ownership of Virtual Assets and 4 Virtual Asset Fund Managers, which are registered institutions, should keep all required records in accordance with the applicable requirements.

11 ascertaining the reasonableness of the valuation of the Virtual Assets and provide such information to the fund investors upon request. 5.7 A Virtual Asset Fund Manager should arrange for the counterparties of any funds it manages to provide the necessary information to the fund’s auditor for conducting the audit. VI. DEALING WITH THE FUND AND FUND INVESTORS Provision of Information 6.1 A Virtual Asset Fund Manager should make adequate disclosure of information (as well as any material changes to the information) on the fund5 which is necessary for fund investors to be able to make an informed decision about their investment in the fund. This includes the list of trading platforms and custodians which the fund uses. Except for institutional professional investors and qualified corporate professional investors6 , the Virtual Asset Fund Manager should also disclose the key risks associated with the fund’s investment in Virtual Assets. Some examples of these risks are specified under Schedule 4. Offer of the Virtual Asset fund 6.2 A Virtual Asset Fund Manager should comply with the relevant offer of investments requirements when distributing the Virtual Asset fund, including: (a) the prospectus requirements for offering of shares and debentures under the C(WUMP)O7 ; and (b) the restrictions on offers of investments under Part IV of the SFO. VII. REPORTING TO THE SFC/ HKMA 7.1 A Virtual Asset Fund Manager should report to the SFC (as well as the HKMA where the Virtual Asset Fund Manager is a registered institution) as soon as practicable upon the happening of any actual or suspected material non-compliance with these Terms and Conditions or any other applicable legal and regulatory requirements. 7.2 A Virtual Asset Fund Manager should notify the SFC (as well as the HKMA where the Virtual Asset Fund Manager is a registered institution) of any significant change in its business activities, at least 7 business days before the change takes place. 7.3 A Virtual Asset Fund Manager should also provide any other information as may be requested by the SFC (and/ or the HKMA where the Virtual Asset Fund Manager is a 5 A Virtual Asset Fund Manager should also make the same disclosure to the distributors it has appointed for distribution of its Virtual Asset fund. 6 “Institutional professional investors” is defined under paragraph 15.2 of the Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission (Code of Conduct) as persons falling under paragraphs (a) to (i) of the definition of “professional investor” in section 1 of Part 1 of Schedule 1 to the SFO. “Qualified corporate professional investors” refers to corporate professional investors which have passed the assessment requirements under paragraph 15.3A and have gone through the procedures under paragraph 15.3B of the Code of Conduct. 7 Parts II and XII of the Companies (Winding Up and Miscellaneous Provisions) Ordinance (C(WUMP)O).

12 registered institution) from time to time. The SFC and/ or the HKMA may request for information to be provided on a periodic or ad hoc basis. Note: For example, such information may include: (a) the fund’s investment in each product or market; (b) valuation policies, procedures, principles and methodologies of the fund’s assets; and (c) details of custodial arrangements. 7.4 The Virtual Asset Fund Manager should respond to requests and enquiries from the SFC (and/ or the HKMA where the Virtual Asset Fund Manager is a registered institution) promptly in an open and co-operative manner. 7.5 A Virtual Asset Fund Manager should ensure that all information which it provides and which is provided on its behalf to the SFC (and/ or the HKMA where the Virtual Asset Fund Manager is a registered institution) is in all material respects complete, accurate and not misleading. If it becomes aware that any information provided does not meet this requirement, the Virtual Asset Fund Manager should inform the SFC (and/ or the HKMA where the Virtual Asset Fund Manager is a registered institution) promptly.

13 Schedule 1 – Existing regulatory requirements applicable to Virtual Asset Fund Managers Relevant codes (1) The Fund Manager Code of Conduct, except for the following paragraphs which are not relevant or have been modified and incorporated in these Terms and Conditions: ▪ Paragraph 4.1.1 to 4.4.2 (Custody) ▪ Paragraph 5.1 (Record Keeping) ▪ Paragraph 5.2.2 (Auditors and Audited Accounts) ▪ Paragraphs 9.1.1 to 9.1.3 (Reporting Obligations to the SFC) (2) The Code of Conduct, except for the following paragraphs which are not relevant or have been modified and incorporated in these Terms and Conditions: ▪ Paragraph 16 (Analysts) ▪ Paragraph 17 (Sponsors) ▪ Paragraph 19 (Alternative liquidity pools) ▪ Paragraph 20 (Dealing with group affiliates and other connected persons) ▪ Paragraph 21 (Bookbuilding and placing activities in equity capital market and debt capital market transactions) ▪ Schedule 3 (Additional requirements for licensed or registered persons dealing in securities listed or traded on The Stock Exchange of Hong Kong Limited) ▪ Schedule 4 (Additional requirements for licensed or registered persons dealing in futures contracts and/ or options contracts traded on Hong Kong Futures Exchange Limited) ▪ Schedule 5 (Additional requirements for licensed persons providing margin lending) ▪ Schedule 6 (Additional requirements for licensed persons engaging in leveraged foreign exchange trading) ▪ Schedule 8 (Additional requirements for licensed or registered persons operating alternative liquidity pools) ▪ Schedule 10 (Risk mitigation requirements and margin requirements in relation to non-centrally cleared OTC derivative transactions)

14 Relevant guidelines (3) Guidelines on Online Distribution and Advisory Platforms (4) Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations and SFC-licensed Virtual Asset Service Providers) and Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Authorized Institutions) (as applicable) (5) Guidelines for Reducing and Mitigating Hacking Risks Associated with Internet Trading (6) Management, Supervision and Internal Control Guidelines for Persons Licensed by or Registered with the Securities and Futures Commission (7) Fit and Proper Guidelines (8) Guidelines on Competence (9) Guidelines on Continuous Professional Training

15 Schedule 2 – Requirements for Virtual Asset Fund Managers conducting discretionary accounts management Introduction Where applicable, Virtual Asset Fund Managers that are involved in the management of discretionary accounts which are operated in the following manner should observe these Terms and Conditions as well as any additional requirements set out in this Schedule: (a) where a Virtual Asset Fund Manager provides discretionary accounts management services to a client, in the form of an investment mandate or a pre-defined model investment portfolio; and Note: The investment mandate may set out, among others, the types, risks and allocation of investments after taking into account the client’s circumstances, such as investment objectives and/ or strategies. In the case of a pre-defined model portfolio, it may specify the proportion of the asset classes and markets and the risk profile of the selected portfolio. (b) the Virtual Asset Fund Manager receives a management fee and/ or performance fee as remuneration for managing the discretionary account for its client. For the avoidance of doubt, this Schedule only applies to a Virtual Asset Fund Manager that manages a discretionary account which invests in Virtual Assets and meets the de minimis threshold. Where a Virtual Asset Fund Manager is involved in the management of both collective investment schemes and discretionary accounts, this Schedule only applies to the extent that that person is involved in the management of discretionary accounts. Note: In relation to certain principles and requirements (as specifically set out under these Terms and Conditions) that are only applicable to a Virtual Asset Fund Manager that is responsible for the overall operation of a fund or has been delegated responsibility for that function, a Virtual Asset discretionary account manager should also observe these principles and requirements, to the extent relevant to the functions and powers of the Virtual Asset discretionary account manager. Interpretation Except for those requirements mentioned in the section below, these Terms and Conditions are applicable to Virtual Asset discretionary account managers, terminologies that are specific to collective investments schemes/ funds in these Terms and Conditions should be read as modified below: (a) any reference to “fund” or “client” means "discretionary account”; (b) any reference to "fund investors” means “discretionary account clients”; and

16 (c) any reference to “Virtual Asset Fund Manager” means "Virtual Asset Discretionary Account Manager”. Additional requirements applicable to Virtual Asset Discretionary Account Managers The requirements set out in the following paragraphs are also generally applicable to a Virtual Asset Discretionary Account Manager: Target Clients

1. Except for institutional professional investors and qualified corporate professional investors, a Virtual Asset Discretionary Account Manager should assess whether clients have knowledge of investing in Virtual Assets or related products prior to providing discretionary account management services to them. If the clients do not possess such knowledge or experience, a Virtual Asset Discretionary Account Manager may only proceed to provide such services if it has provided adequate training to the client on the nature and risks of Virtual Assets.
2. When providing discretionary account management services to retail clients, a Virtual Asset Discretionary Account Manager should only trade in Virtual Assets that are: (a) of high liquidity on behalf of the retail clients. In assessing the liquidity of a specific virtual asset for trading by retail clients, the Virtual Asset Discretionary Account Manager should, at a minimum, ensure that the virtual asset is an eligible large-cap virtual asset, ie, the specific virtual asset should have been included in a minimum of two acceptable indices issued by at least two different index providers. Note 1: An acceptable index refers to an index which has a clearly defined objective to measure the performance of the largest virtual assets in the global market, and should fulfil the following criteria: (i) The index should be investible, meaning the constituent virtual assets should be sufficiently liquid; (ii) The index should be objectively calculated and rules-based; (iii) The index provider should possess the necessary expertise and technical resources to construct, maintain and review the methodology and rules of the index; (iv) The methodology and rules of the index should be well documented, consistent and transparent. Note 2: The two index providers should be separate and independent from each other, the issuer of the virtual asset (if applicable) and the Virtual Asset Discretionary Account Manager (for example, they are not within the same group of companies). Further, at least one of the indices should be issued by an index provider which complies with the IOSCO Principles

17 for Financial Benchmarks and has experience in publishing indices for the conventional securities market. (b) made available by SFC-licensed virtual asset trading platforms for trading by retail investors. Suitability 3. A Virtual Asset Discretionary Account Manager should ensure that the mandate or predefined model investment portfolio established for or chosen by a client is suitable for that client (except for institutional professional investors and qualified corporate professional investors) based on information about the client’s personal circumstances of which it is or should be aware through the exercise of due diligence. Such suitability assessment could be conducted on a holistic basis when the mandate or portfolio is agreed (for example, in establishing a predefined model investment portfolio with a particular overall risk profile, the Virtual Asset Discretionary Account Manager could have the discretion to invest in particular products with a lower or higher risk profile so long as the overall risk profile of the portfolio is maintained). The Virtual Asset Discretionary Account Manager should document its assessment and provide a copy of the rationale to the client in writing. To avoid concentrated exposure to Virtual Assets, the Virtual Asset Discretionary Account Manager should also ensure that the aggregate amount to be invested by a client in the discretionary account is reasonable, considering the client’s net worth. 4. A Virtual Asset Discretionary Account Manager should review the mandate or predefined model investment portfolio on a regular basis (for example, at least on an annual basis and whenever there have been significant market movements), having regard to the client’s latest circumstances at the time of review and, where appropriate, recommend revisions to the mandate or predefined model investment portfolio and agree them with the client. The Virtual Asset Discretionary Account Manager should also document the rationale for recommending the revised mandate or predefined model investment portfolio and provide a copy of the rationale to the client in writing. 5. A Virtual Asset Discretionary Account Manager should ensure that the transactions carried out on behalf of the clients are suitable and in accordance with the mandate or predefined model investment portfolio. Client agreements 6. A Virtual Asset Discretionary Account Manager should ensure that a written agreement (Discretionary Client Agreement) is entered into with a client (except for institutional professional investors and qualified corporate professional investors) before any services are provided to, or transactions are made on behalf of, that client. A Discretionary Client Agreement should set out, amongst other things: (a) the following clause: “If we [the intermediary] solicit the sale of or recommend any Virtual Assets to you [the client], the Virtual Assets must be reasonably suitable for you having regard to your financial situation, investment experience and investment objectives. No other provision of this agreement or any other document we may ask you to sign and no statement we may ask you to make derogates from this clause.”; and

18 (b) the risk disclosure statements (please see Schedule 4 for some examples of these risks)

19 Schedule 3 – Risk management control techniques and procedures A. Risk management

1. A Virtual Asset Fund Manager should establish and maintain effective risk management policies and reporting mechanisms which take into account the following risk management control techniques and procedures where applicable. B. Counterparty risk
2. A Virtual Asset Fund Manager should establish and maintain an effective credit assessment system to evaluate the creditworthiness of the funds’ counterparties. For example, when assessing the creditworthiness of a Virtual Asset trading platform, a Virtual Asset Fund Manager should consider the following: (a) the experience and track record of the Virtual Asset trading platform; (b) the legal and regulatory status of the Virtual Asset trading platform’s operator, including its compliance history. For example, whether any disciplinary actions have been taken by any regulatory authorities against the operator; (c) the corporate governance structure and the background of the founders and senior management of the Virtual Asset trading platform; (d) the operational capabilities of the Virtual Asset trading platform; (e) the liquidity of Virtual Assets traded on the Virtual Asset trading platform (f) the custodial arrangements of the Virtual Asset trading platform where the trading platform takes custody of Virtual Assets; (g) the mechanisms (for example, surveillance) implemented by the Virtual Asset trading platform to guard against fraud and market misconduct with respect to the products traded on the trading platform; (h) the cybersecurity risk management measures of the Virtual Asset trading platform, including its business continuity plan; (i) the risk management tools adopted by the Virtual Asset trading platform to manage its counterparty risk arising from its payment, clearing, and settlement processes; and (j) the financial resources and insurance cover of the Virtual Asset trading platform. For example, the Virtual Asset trading platform’s ability to compensate its clients should there be any loss of their assets due to hacking or other events and the auditor’s opinion on the going concern of the Virtual Asset trading platform.
3. A Virtual Asset Fund Manager should set appropriate limits in relation to the fund’s exposure to the different counterparties of the fund, including Virtual Asset trading platforms and custodians. For example, a Virtual Asset Fund Manager should consider

20 using more than one custodian to hold the portfolio’s assets to avoid undue concentration of risk. C. Cybersecurity risk 4. A Virtual Asset Fund Manager should implement adequate and appropriate security controls to protect the systems used in its operations. The security controls should include, but not be limited to, the following: (a) effective techniques to protect the confidentiality and integrity of information stored in the system and passed between internal and external networks; and (b) appropriate operating controls to prevent and detect unauthorized access, security breach and security attack.

21 Schedule 4 – Risk disclosure statements The Virtual Asset Fund Manager should properly disclose the risks associated with investment in the Virtual Asset fund under its management and Virtual Assets invested in the fund to potential fund investors and distributors appointed by it to distribute its Virtual Asset fund. Some examples of the associated risks are listed below. (a) Price volatility (b) Potential price manipulation on trading platforms (c) Lack of secondary markets for certain Virtual Assets (d) Difficulties in verifying ownership of Virtual Assets (e) Most trading platforms and custodians of Virtual Assets are presently unregulated (f) Counterparty risk when effecting transactions with issuers, private buyers/ sellers or through trading platforms (g) Risks arising from custodial arrangements, including self-custody of assets by the fund manager and use of hot wallets8 (h) Continuing evolution of Virtual Assets and global regulatory developments (i) Cybersecurity and technology related risks (j) Legal uncertainty on whether Virtual Assets can be regarded as “property” under the law 8 A “hot wallet” refers to the wallet used for holding Virtual Assets in an online environment which provides an interface with the internet, which is more susceptible to cyber-attacks.

1 Terms and conditions for licensed corporations or registered institutions which manage portfolios that invest in virtual assets October 2019 2023 Appendix 7a

2 Contents Explanatory Notes 3 I. GENERAL 4 II. GENERAL PRINCIPLES 6 General Principles 6 III. ORGANISATION AND STRUCTURE 7 Organisation and Management Structure 7 IV. VIRTUAL ASSET FUND MANAGEMENT 10 Virtual Asset Fund Management 10 Custody 15 Operations 19 V. DEALING WITH THE FUND AND FUND INVESTORS 23 Dealing with the Fund and Fund Investors 23 Marketing Activities 25 Fees and Expenses 25 VI. REPORTING TO THE SFC 26 Appendix 1 – Requirements for Virtual Asset Fund Managers conducting discretionary accounts management 28 Appendix 2 – Risk management control techniques and procedures 34 Appendix 3 – Risk disclosure statements 37

3 Contents I. General 3 II. Codes and guidelines 5 III. Financial resources 5 IV. Custody of fund assets 5 V. Operations 9 VI. Dealing with the fund and fund investors 11 VII. Reporting to the SFC/ HKMA 11 Schedule 1 – Existing regulatory requirements applicable to Virtual Asset Fund Managers 13 Schedule 2 – Requirements for Virtual Asset Fund Managers conducting discretionary accounts management 15 Schedule 3 – Risk management control techniques and procedures 19 Schedule 4 – Risk disclosure statements 21

4 Explanatory Notes These terms and conditions set out the principles and requirements (where applicable) with which corporations licensed by the Securities and Futures Commission (SFC) should comply when managing portfolios (or portions of portfolios)1 that invest in Virtual Assets (as defined in Section I below) and meet the de minimis threshold (see Section I below). These terms and conditions (Terms and Conditions) shall be imposed on Virtual Asset Fund Managers (as defined in Section I below) by way of a licensing condition. Contravention of a licensing condition is likely to be considered as misconduct under the Securities and Futures Ordinance (Cap. 571) (SFO) which will reflect adversely on the fitness and properness of a Virtual Asset Fund Manager to remain licensed and may result in disciplinary action by the SFC. A pragmatic approach however will be adopted, taking into account all relevant circumstances, including the size of the Virtual Asset Fund Manager, and any compensatory measures implemented by its senior management. 1 The licensed corporation may be managing portfolios for a collective investment scheme (for example, fund) or a discretionary account.

5 I. GENERAL Interpretation A reference in these terms and conditions (Terms and Conditions) to: • “AMLO” means the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615); • "fund" or "client" generally means a collective investment scheme2 managed by a Virtual Asset Fund Manager that invests in Virtual Assets and meets the de minimis threshold, except where a Virtual Asset Fund Manager is a delegate of another fund manager for the management of a fund or a portfolio within a fund, in which case a reference to "client" means the delegating fund manager, and a reference to "fund" means the portfolio managed by the delegated Virtual Asset Fund Manager; • "fund investors" means investors as a whole of a collective investment scheme managed by a Virtual Asset Fund Manager; • “Virtual Assets” means digital representations of value which may be in the form of digital tokens (such as digital currencies, utility tokens or security or asset-backed tokens), any other virtual commodities, crypto assets or other assets of essentially the same nature, irrespective of whether they amount to “securities” or “futures contracts” as defined under the SFO; • “professional investor” has the meaning as defined in section 1 of Part 1 of Schedule 1 to the Securities and Futures Ordinance (Cap. 571) (SFO); • “retail client” means any person other than a professional investor; • “Relevant VA Asset Management Activities” means any Virtual Asset related asset management activities carried out by a Virtual Asset Fund Manager for its fund or client; • “Virtual Assets” means any “virtual asset” as defined in section 53ZRA of the AMLO; • “Virtual Asset Fund Manager” means a licensed corporation or registered institution that manages a fund (or portion of a fund) that invests in Virtual Assets and meets the de minimis threshold; • “de minimis threshold” refers to the situation where either: (a) the stated investment objective of a fund is to invest in Virtual Assets or (b) the intention of a fund is to invest 10% or more of its gross asset value (GAV) in Virtual Assets;. For the avoidance of doubt, a fund will not be regarded as having met the de minimis threshold in the following situation: 2 These Terms and Conditions are designed for collective investment schemes in corporate form. If the collective investment schemes managed by the licensed corporation or registered institution adopt a different structure, for example, a unit trust structure, these Terms and Conditions will be modified accordingly.

6 (a) its mandate is to mainly invest in securities, (including tokenised securities), futures contracts or both and there is no intention to invest 10% or more of its GAV in Virtual Assets; and (b) its investment in Virtual Assets exceeds 10% of its GAV due to the increase in prices of the Virtual Assets held in that fund, but all reasonably practicable steps are being taken to reduce the fund’s investment in Virtual Assets in a timely manner so as to reduce such investment proportion to below 10% of its GAV. However, if the situation referred to in (b) is anticipated to persist, the SFC (as well as the HKMA in the case of a registered institution) should be duly alerted by the licensed corporation or registered institution concerned so that the SFC (in consultation with the HKMA, where applicable) could consider imposing these Terms and Conditions on that licensed corporation or registered institution. Application Please note that: (a) certain Terms and Conditions (i.e.ie, paragraphs 3.16, 3.17 (except for 3.17(b) and 3.17(c)), 3.18, 3.19, 3.20, 3.21, 4.1 to 4.12, 5.2, 45.6 to 4.11, 5.4, 5.8 to 5.12, 5.13, 5.16 to 5.17,7 and 6.21) are only applicable to a Virtual Asset Fund Manager that is responsible for the overall operation of a fund or has been delegated responsibility for that function; and (b) the particular requirements that are not applicable to, andthe additional requirements that are applicable to, Virtual Asset Fund Managers conducting discretionary accounts management are set out in Appendix 1Schedule 2 of these Terms and Conditions.

7 II. GENERAL PRINCIPLES

1. General Principles A Virtual Asset Fund Manager should comply with the spirit of these principles when managing a Virtual Asset fund. GP1. Honesty and Fairness In conducting its business activities, a Virtual Asset Fund Manager should act honestly, fairly, and in the best interests of its funds and fund investors and the integrity of the market. GP2. Diligence In conducting its business activities, a Virtual Asset Fund Manager should act with due skill, care and diligence, in the best interests of its funds and fund investors and the integrity of the market. GP3. Capabilities A Virtual Asset Fund Manager should have and employ effectively the resources and procedures which are needed for the proper performance of its business activities. GP4. Conflicts of Interest A Virtual Asset Fund Manager should try to avoid conflicts of interest. Where conflicts of interests cannot be avoided, and provided that funds’ and fund investors’ interests can be sufficiently protected, the conflict should be managed and minimized by appropriate safeguards and measures, which should be properly disclosed to fund and fund investors. GP5. Fund Assets A Virtual Asset Fund Manager should ensure that fund assets are promptly and properly accounted for and adequately safeguarded. GP6. Disclosure Disclosure should be clear, concise and effective, containing information necessary for fund investors to be able to make an informed judgement and be kept up-to-date. Where ongoing disclosure is required, information should be disseminated in a timely and efficient manner. GP7. Compliance A Virtual Asset Fund Manager should comply with the instrument of incorporation, offering documents and other relevant documents of the Virtual Asset fund. A Virtual Asset Fund Manager should also comply with all legal and regulatory requirements (including its licensing conditions) applicable to the conduct of its business activities as well as its own internal policies and procedures so as to promote the best

8 interests of its clients, funds and fund investors and the integrity of the market. GP8. Responsibility of Senior Management The senior management of a Virtual Asset Fund Manager should bear primary responsibility for ensuring the maintenance of appropriate standards of conduct and adherence to proper procedures by the Virtual Asset Fund Manager. III. ORGANISATION AND STRUCTURE 2. Organisation and Management Structure Organisation and Resources 2.1 A Virtual Asset Fund Manager should maintain: (a) an effective management and organizational structure which ensures that the operations of the business are conducted in a sound, efficient and effective manner; (b) financial resources in accordance with all applicable legal and regulatory requirements; II. CODES AND GUIDELINES 2.1 In conducting Relevant VA Asset Management Activities, to the extent not already covered elsewhere in these Terms and Conditions, a Virtual Asset Fund Manager is expected to observe the requirements of the codes and guidelines (as supplemented by circulars, frequently asked questions and other related guidance issued by the SFC from time to time) listed in Schedule 1 hereto as if: (a) any reference to a financial product (for example, securities) or investment product included virtual assets; (b) any reference to a client/ fund included a person/ fund to whom a Virtual Asset Fund Manager provides services in Relevant VA Asset Management Activities; (c) any reference to client assets included fund assets; and (d) any reference to regulated activities included Relevant VA Asset Management Activities. III. FINANCIAL RESOURCES 3.1 If the Virtual Asset Fund Manager, which is a licensed corporation, holds Virtual Assets on behalf of the funds it manages, the Virtual Asset Fund Manager shall at all times maintain liquid capital which is not less than an amount equal to the higher of (a) HK$ 3 million and (b) its variable required liquid capital. The terms “liquid capital” and "variable required liquid capital" shall have the same meaning as defined in section 2 of the Securities and Futures (Financial Resources) Rules (Cap. 571N);).

9 (c) sufficient human and technical resources and experience for the proper performance of its duties. This would be expected to vary depending on the amount of assets under management by the Virtual Asset Fund Manager, and the type and nature of the Virtual Assets and markets in which the funds managed by the Virtual Asset Fund Manager invest. The functions within the Virtual Asset Fund Manager, including fund management, operations, compliance, risk management, valuation and audit, should only be performed by qualified and experienced persons, who should receive appropriate updates and training on an ongoing basis; (d) satisfactory internal controls and written compliance procedures which address all applicable legal and regulatory requirements (including its licensing conditions) and implement appropriate monitoring systems; (e) satisfactory risk management governance structure and procedures commensurate with the nature, size, complexity and risk profile of the Virtual Asset Fund Manager and the investment strategy adopted by each of the funds under its management; and (f) adequate insurance cover commensurate with its business. Segregation of Duties 2.2 A Virtual Asset Fund Manager should ensure that key duties and functions are appropriately segregated, particularly those duties and functions which when performed by the same individual may result in undetected errors, may be susceptible to abuses or may expose the Virtual Asset Fund Manager, its funds or fund investors to inappropriate risks. Conflicts of Interest 2.3 A Virtual Asset Fund Manager should maintain and operate effective organisational and administrative arrangements with a view to taking all reasonable steps designed to identify, prevent, manage and monitor any actual or potential conflicts of interest. Where an actual or potential conflict arises, the conflict should be managed and minimised by appropriate safeguards and measures to ensure fair treatment of fund investors, and any material interest or conflict should be properly disclosed to fund investors. Responsibilities of Management "Senior management" means the Managing Director of a Virtual Asset Fund Manager or its Board of Directors, Chief Executive Officer or other senior operating management personnel in a position of authority over the Virtual Asset Fund Manager's business decisions. 2.4 The senior management of a Virtual Asset Fund Manager should: (a) be principally responsible for compliance by the Virtual Asset Fund Manager with all applicable legal and regulatory requirements (including its licensing conditions), as well as the nurturing of a good compliance culture within the Virtual Asset Fund Manager;

10 (b) maintain clear reporting lines with supervisory and reporting responsibilities assigned to qualified and experienced persons; (c) ensure that all persons performing functions on behalf of the Virtual Asset Fund Manager are provided adequate and up-to-date information about the Virtual Asset Fund Manager's policies and procedures applicable to them; and (d) ensure that the performance of the Virtual Asset Fund Manager in managing funds is reviewed at least annually. Risk Management 2.5 The Virtual Asset Fund Manager should establish and maintain effective policies and procedures as well as a designated risk management function to identify and quantify the risks, whether financial or otherwise, to which the Virtual Asset Fund Manager and the funds are exposed. The Virtual Asset Fund Manager should take appropriate and timely action to contain and otherwise adequately manage such risks. 2.6 A Virtual Asset Fund Manager should review the risk management policies and procedures with appropriate frequency and enhance such policies and procedures whenever necessary. Compliance 2.7 A Virtual Asset Fund Manager should: (a) maintain an effective compliance function, including a compliance officer, within the Virtual Asset Fund Manager to ensure that the Virtual Asset Fund Manager complies with its own internal policies and procedures, and with all applicable legal and regulatory requirements (including its licensing conditions); and (b) ensure that the compliance function possesses the technical competence and experience necessary for the performance of its functions. 2.8 The compliance function and the compliance officer should be independent of other functions and report directly to the Virtual Asset Fund Manager's senior management, unless this is not reasonably practicable given the size of the Virtual Asset Fund Manager. In these exceptional cases, the Virtual Asset Fund Manager's senior management should assume the role of compliance officer. Compliance activities may be delegated to an appropriately qualified professional, although the responsibility and obligations may not be delegated. 2.9 There should be sufficiently detailed compliance procedures to enable the personnel of the Virtual Asset Fund Manager to comply with all applicable legal and regulatory requirements (including its licensing conditions) at all times. Any deviation from the procedures should be approved by the compliance officer or other persons designated by senior management. Such approval and the reasons thereof should be properly documented.

11 Anti-Money Laundering and Counter-Terrorist Financing 2.10 A Virtual Asset Fund Manager should take all reasonable measures to ensure that proper safeguards exist to mitigate the risks of money laundering and terrorist financing, especially in respect of subscriptions made by the fund investors using Virtual Assets. In particular, a Virtual Asset Fund Manager should comply with the provisions of the Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations) as if it were conducting regulated activity, even if the funds (or parts of the funds) under its management invest in Virtual Assets which do not amount to “securities” or “futures contracts”. Audit 2.11 Where practicable, a Virtual Asset Fund Manager should maintain an independent and objective audit function to report on the adequacy, effectiveness and efficiency of the Virtual Asset Fund Manager's management, operations and internal controls. The audit function should, among other things, report to senior management on all matters highlighted in the audit report, which should be resolved satisfactorily and in a timely manner. Where the size of the Virtual Asset Fund Manager does not justify a separate internal audit function, the relevant roles and responsibilities should be performed or reviewed by external auditors. Delegation 2.12 A Virtual Asset Fund Manager should exercise due skill, care and diligence in the selection and appointment of third-party delegates. Where functions are delegated to third parties, there should be ongoing monitoring of the competence of delegates, to ensure that the principles and requirements set out under these Terms and Conditions are followed. Withdrawal from Business 2.13 A Virtual Asset Fund Manager who withdraws from the business should ensure that any affected clients, funds and fund investors are promptly notified and that proper arrangements remain in place for the safekeeping of fund assets. IV. VIRTUAL ASSET FUND MANAGEMENT 3. Virtual Asset Fund Management Investment within Mandate 3.1 A Virtual Asset Fund Manager should ensure that transactions carried out on behalf of each fund are in accordance with the fund's stated investment strategy, objectives, investment restrictions and guidelines, whether in terms of asset class, geographical spread or risk profile, as set out in the respective constitutive and/or relevant documents of the funds managed by the Virtual Asset Fund Manager. In this connection, a Virtual Asset Fund Manager should have in place effective and properly￾implemented procedures and controls.

12 Best Execution 3.2 A Virtual Asset Fund Manager should ensure that fund orders are executed on the best available terms, taking into account the relevant market prices at the trading venues the fund has access to at the time for transactions of the kind and size concerned, while mitigating any concentration risk. Prohibition on Market Misconduct 3.3 A Virtual Asset Fund Manager should establish and implement effective policies and procedures to prohibit and prevent market misconduct. Order Allocation 3.4 A Virtual Asset Fund Manager should: (a) ensure that all orders executed for the funds that it manages are allocated fairly; (b) make a record of the intended basis of allocation before a transaction is effected; and (c) ensure that an executed transaction is allocated promptly in accordance with the stated intention, except where the revised allocation does not disadvantage any funds and the reasons for the re-allocation are clearly documented. Fund Portfolio Turnover 3.5 A Virtual Asset Fund Manager should take into account the fund's stated objectives and not trade excessively on behalf of a fund. Underwriting 3.6 Unless specifically permitted in the fund mandate, a Virtual Asset Fund Manager should not participate in underwriting activities on behalf of a fund. Where underwriting is undertaken on behalf of a fund, all commissions and fees received under such contract should be credited to the fund account. Participation in Initial Offerings 3.7 Where a Virtual Asset Fund Manager participates in an initial offering3 of Virtual Assets on behalf of funds managed by it, it should ensure that: (a) the allocation of Virtual Assets received in the offering provides for a fair and equitable allocation amongst the funds it manages; (b) preferential allocations are prohibited; and (c) records of (i) the intended basis of allocation before a transaction is effected; (ii) 3 Commonly known as “Initial Coin Offerings”.

13 the actual allocation after the transaction is effected; and (iii) the reasons for the differences between the intended and actual allocations, are made. Transactions with Connected Persons 3.8 A Virtual Asset Fund Manager should not carry out any transaction on behalf of a fund with a party which is a connected person unless such transaction is carried out on arm's length terms, consistent with best execution standards, and at a commission rate no higher than customary institutional rates. 3.9 A Virtual Asset Fund Manager should not, on behalf of a fund, deposit money (or Virtual Assets) with or borrow money (or Virtual Assets) from a connected person unless: (a) in the case of a deposit, interest is received at a rate not lower than the prevailing commercial rate for a deposit of that size and term; and (b) in the case of a loan, interest charged and fees levied in connection with the loan are no higher than the prevailing commercial rate for a similar loan. Cross Trades 3.10 A Virtual Asset Fund Manager should only undertake sale and purchase transactions between fund accounts4 (cross trades) where: (a) the sale and purchase decisions are in the best interests of both funds and their fund investors and fall within the investment objective, restrictions and policies of both funds; (b) the trades are executed on arm's length terms at current market prices; (c) the reasons for such trades are documented prior to execution; and (d) such activities are disclosed to fund investors of both funds. 3.11 Cross trades between house accounts and fund accounts should only be permitted with the prior written consent of the fund investors, to whom any actual or potential conflicts of interest should be disclosed. Cross trades between staff personal accounts and fund accounts should be prohibited. House Accounts "House account" means an account owned by a Virtual Asset Fund Manager or any of its connected persons over which it can exercise control and influence. 3.12 When dealing for a house account, a Virtual Asset Fund Manager should: (a) give priority to satisfying an order to be executed for a fund. Where a fund’s 4 For the avoidance of doubt, a reference to "fund account" in this paragraph also includes a reference to a discretionary account managed by the Virtual Asset Fund Manager.

14 order has been aggregated with an order for the house account, the fund's order must take priority in any subsequent allocation if all orders cannot be filled. Aggregation of house orders with fund orders should only be made if it is in the best interests of the fund and fund investors concerned; and (b) except with the prior written consent of the compliance officer or other persons designated by senior management, not deal ahead of any transaction to be carried out on behalf of a fund. The compliance officer or other persons designated by senior management should properly document the reasons for any consent given. Note: For the avoidance of doubt, a reference to "dealing" in this sub-section includes any acquisition or disposal of fund assets. Operational Control 3.13 A Virtual Asset Fund Manager should establish and maintain effective policies and operational procedures and controls in relation to the Virtual Asset Fund Manager’s day-to￾day business operations and comply with these policies, operational procedures and controls. Such policies, operational procedures and controls, include but are not limited to, controls over trading and safeguard of fund assets, IT system and infrastructure. Risk Management 3.14 For risk management at the fund level, a Virtual Asset Fund Manager should establish and implement adequate risk management procedures in order to identify, measure, manage and monitor appropriately all risks: (a) relevant to each investment strategy; and (b) to which each fund is or may be exposed, such as market, liquidity and counterparty risks, and other risks, including operational risks, especially cybersecurity risks, which may be material for each fund it manages taking into account the nature, scale and complexity of its business and the investment strategy of each of the funds it manages. A Virtual Asset Fund Manager should also provide timely and adequate information to its senior management to enable it to take appropriate and timely action to contain and otherwise adequately manage such risks. Note: Where appropriate, measures to manage risks of a fund may include: (a) identifying and managing potential risks of a fund throughout the fund life cycle; (b) ensuring that the risk profile of the fund is consistent with the nature, size, portfolio structure and investment strategies, restrictions and objectives of the fund as provided and represented to fund investors in the constitutive, offering and/or

15 relevant documents; and (c) ensuring ongoing and proper identification, measurement, management and monitoring of risks associated with each investment of the fund and their overall effects on the fund's portfolio (including via the use of suitable stress testing procedures). 3.15 A Virtual Asset Fund Manager should take into account, where applicable, the risk management control techniques and procedures set out in Appendix 2 in monitoring such risks. Leverage 3.16 A Virtual Asset Fund Manager should disclose to fund investors: (a) the expected maximum level of leverage which it may employ on behalf of the fund; and (b) the basis of calculation of leverage which should be reasonable and prudent. Liquidity Management 3.17 A Virtual Asset Fund Manager should: (a) establish and implement appropriate and effective liquidity management policies and procedures to monitor the liquidity risk of the fund, taking into account the investment strategy, liquidity profile, underlying assets and obligations, and redemption policy of the fund; (b) integrate liquidity management in investment decisions; (c) regularly assess the liquidity of the assets of a fund; (d) regularly assess the liquidity profile of the fund's liabilities; (e) regularly conduct assessments of liquidity in different scenarios, including stressed situations, to assess and monitor the liquidity risk of the funds accordingly; and (f) disclose the liquidity risks involved in investing in the fund, the liquidity management policies, and an explanation of any tool or exceptional measure that could affect redemption rights in the fund's offering document or otherwise make such information freely available to fund investors. Note: The extent of application of these liquidity management principles will depend on the nature, liquidity profile and asset-liability management of the fund. A Virtual Asset Fund Manager should consider which principles are relevant to the fund it manages. 3.18 A Virtual Asset Fund Manager should consider the appropriateness of the liquidity management tools and exceptional measures used for the funds under its

16 management, taking into account the nature of assets held by the fund and its investor base. Note: Protecting the interests of fund investors should be the primary consideration in the use of liquidity risk management tools. A Virtual Asset Fund Manager should also ensure that the investment strategy and portfolio profile of a fund are consistently maintained as much as possible when using these tools. Where a Virtual Asset Fund Manager has granted preferential treatment (for example, side letters) to certain investors, it should disclose such fact and the material terms in relation to redemption in the side letters to all relevant potential and existing fund investors. 3.19 A Virtual Asset Fund Manager should conduct periodic reviews of the effectiveness of its liquidity management policies and procedures and such policies and procedures should be updated as appropriate. Termination 3.20 A Virtual Asset Fund Manager's decision to terminate a fund should take due account of the best interests of investors in the fund. A Virtual Asset Fund Manager should ensure that the termination process of a fund is carried out, and fund investors are treated, fairly. 3.21 A Virtual Asset Fund Manager should make adequate disclosure of all relevant material information in relation to the termination of the fund to all fund investors in an appropriate and timely manner. Note: Such information should include without limitation termination decisions, implementation plans and material change of circumstances arising during the termination process. IV. CUSTODY OF FUND ASSETS Safety of fund assets 4.1 A Virtual Asset Fund Manager should ensure that any fund assets entrusted to it are accounted for properly and promptly and adequately safeguarded. In this connection: (a) A Virtual Asset Fund Manager should select and arrange for the appointment of, and entrust the fund assets to, a custodian that is functionally independent from it; (b) A Virtual Asset Fund Manager should ensure that fund assets are segregated from the assets of the Virtual Asset Fund Manager, and, unless held in an omnibus client account, assets of other clients; (c) Where fund assets are held in an omnibus client account, the Virtual Asset Fund Manager should ensure that adequate safeguards are put in place such that assets

17 belonging to each fund are appropriately recorded with frequent and appropriate reconciliations being performed; and (d) A Virtual Asset Fund Manager should implement and maintain adequate processes and controls when: (i) Creating new accounts with trading platforms and custodians; (ii) Whitelisting new internet protocol addresses (IP addresses) at trading platforms and custodians; (iii) Whitelisting new wallet addresses at trading platforms and custodians; and (iv) Effecting transfer of assets between trading platforms, custodians and wallets held by the Virtual Asset Fund Manager. 4.2 4.1A Where a Virtual Asset Fund Manager (except for a Virtual Asset Fund Manager that is a registered institution) receives fiat currency on behalf of the funds it manages (client money), it should: (a) establish one or more segregated bank accounts for holding the client money received by it. Such bank accounts should be established and maintained with an authorized financial institution in Hong Kong or another bank in a jurisdiction as agreed by the SFC from time to time; (b) ensure that such client monies are (i) transferred into a segregated bank account; or (ii) paid to the fund, within one business day after the receipt of such currencies; (c) ensure that client money is retained in the segregated bank account until it is: (i) paid to the fund managed by the Virtual Asset Fund Manager, being the client on whose behalf it is being held; or (ii) required to pay money that the fund managed by the Virtual Asset Fund Manager, being the fund on whose behalf it is being held, owes to the Virtual Asset Fund Manager; or (iii) required to meet the fund’s obligations to meet settlement or margin requirements. A Virtual Asset Fund Manager may not pay, or permit to be paid, any client money of the Virtual Asset Fund Manager to any of its officers or employees or any officer or employee of any corporation with which the Virtual Asset Fund Manager is in a controlling entity relationship5 , unless that officer or employee is the fund investor of the fund on whose behalf such client money is being held; and (d) pay out of the segregated bank account any amount held in the segregated bank account that is not client money within one business day of becoming so aware. 5 As defined under Part 1 of Schedule 1 to the SFO.

18 4.3 A Virtual Asset Fund Manager should select the most appropriate custodial arrangement for holding fund’s Virtual Assets. In assessing which custodial arrangement (or combination of custodial arrangements) to adopt, the Virtual Asset Fund Manager should assess the advantages and disadvantages of holding Virtual Assets under each custodial arrangement (for example, independent custodian or self-custody, host locations, use of hot or cold wallets) with reference to, among other things,: (a) the ease with which Virtual Assets are accessible, ie, the time required to transfer the Virtual Assets to the trading venue; and (b) the security of the custodial facility, ie, whether there are adequate safeguards in place to protect the facility from external threats, including cyberattacks or the ability of the custodian to compensate for any loss of Virtual Assets. A Virtual Asset Fund Manager should also assess the features and characteristics of the different custodial arrangements. For example: (a) the hardware and software infrastructure; (b) the Virtual Assets which are supported; (c) the security controls over key generation, storage, management and transaction signing; (d) the documented process of handling software upgrades to the storage devices used by the custodians and the Virtual Asset Fund Manager; and (e) the process of handling blockchain forks. A Virtual Asset Fund Manager should document the reasons for selecting its custodial arrangements, including self-custody of Virtual Assets. Self-custody 4.4 Where self-custody is adopted, the Virtual Asset Fund Manager should ensure that it has effective policies, procedures, and internal controls in place to protect the Virtual Assetsfund from financial loss arising from theft, fraud, and other dishonest acts, professional misconduct or omissions. For example, the persons fulfilling the custodial function are independent from the persons fulfilling the fund’s management functions. 4.5 A Virtual Asset Fund Manager should ensure that the assets held in self-custody are identified as owned beneficially by the fund and not by the Virtual Asset Fund Manager through proper record-keeping and arrangements to ensure that these assets can be effectively segregated from the Virtual Asset Fund Manager’s own assets upon the Virtual Asset Fund Manager’s insolvency. For example, the Virtual Asset Fund Manager may make a declaration of trust over the fund’s crypto wallet (including access keys) and all assets held in the wallet. 4.6 A Virtual Asset Fund Manager should use reasonable endeavours to acquire and maintain adequate insurance cover over these assets.

19 Selection and appointment of an independent custodian 4.7 A Virtual Asset Fund Manager should exercise due skill, care and diligence in the selection, appointment, and ongoing monitoring, of the custodian and take all reasonable steps to ensure that the custodian is capable of performing its functions. On an ongoing basis, a Virtual Asset Fund Manager should satisfy itself as to the continued suitability and financial standing of any appointed custodian, for example, a Virtual Asset Fund Manager should request for and review the audited financial statements of the appointed custodian. Moreover, a Virtual Asset Fund Manager should consider appointing more than one custodian to avoid undue concentration of risks. Note: In considering whether a custodian is capable of properly performing its functions, the Virtual Asset Fund Manager should consider the following as part of the selection process for custodians6 and document the reasons for its selection: (a) the experience and track record of the custodian in providing custodial services for Virtual Assets, for example, the number of years for which the custodian has provided custodial services for Virtual Assets and the types of Virtual Assets which have been under its custody; (b) the regulatory status of the custodian, in particular, whether the custodian is subject to any regulatory oversight over its Virtual Asset custodial business; (c) the corporate governance structure and background of the senior management of the custodian; (d) whether the custodian has appropriate segregation arrangements in place such that the fund assets are, throughout the custody chain, segregated from: (i) the assets of the custodian/ sub-custodian; and (ii) the assets of other funds and other clients of the custodian (unless the fund assets are held in an omnibus client account); (e) the financial resources and insurance cover of the custodian (ie, the custodian's ability to compensate its customers in the event of any loss of customers’ assets); (f) the custodian's management of actual and potential conflicts of interest; (g) the custodian's operational capabilities and arrangements, for example, the “wallet” arrangements and cybersecurity risk management measures; (h) the physical setup and processes of the custodian, especially in dealing with transfer of assets, blockchain forks and software upgrades of devices; and 6 Where the custodian also operates as a Virtual Asset trading platform, a Virtual Asset Fund Manager may also consider other factors, such as the liquidity provided by the trading platform, during the selection process.

20 (i) where the appointment of sub-custodians is allowed, the custodian would use due skill, care and diligence in the selection, appointment and monitoring of its sub￾custodians. To the extent possible, a Virtual Asset Fund Manager should select a custodian that is subject to regulatory oversight over its Virtual Asset custodial business. Custody agreement 4.8 A Virtual Asset Fund Manager should ensure that a formal custody agreement is entered into with the custodian that is to be entrusted with a fund's assets. 4.9 A Virtual Asset Fund Manager should formulate custodial arrangements with due skill, care and diligence and clarify the duties and responsibilities of the various parties to the custodial arrangements. In particular, the Virtual Asset Fund Manager should ensure that the custody agreement contains provisions to specify the scope of the responsibility and liability of the custodian. 4.10 A Virtual Asset Fund Manager should monitor custodial arrangements and the custodian's compliance with the terms of the custody agreement on an ongoing basis. Disclosure of custodial arrangements 4.11 A Virtual Asset Fund Manager should ensure that: (a) the custodial arrangements in respect of assets of the fund, which should include the intended distribution of the amount of assets kept with each custodian and under self-custody of the Virtual Asset Fund Manager if the Virtual Asset Fund Manager intends to keep more than 10% of the fund’s assets (in terms of GAV) with a particular custodian or under self-custody; and (b) any material risks associated with the arrangements are properly disclosed to the fund investors and that fund investors are updated about any significant changes. 4.12 Where the Virtual Asset Fund Manager intends to hold fund assets in self-custody, the Virtual Asset Fund Manager should also specifically disclose the existence and risks of such an arrangement, the additional safeguards that have been put in place and the details of insurance coverage over these assets (where applicable). V. OPERATIONS Risk management 5.1 A Virtual Asset Fund Manager should take into account, where applicable, the risk management control techniques and procedures set out in Schedule 3 in monitoring such risks.

21 Fund portfolio valuation 5.2 The Virtual Asset Fund Manager should exercise due care to ensure that valuation policies, principles, methodologies and models selected are reasonably appropriate in light of the circumstances and in the best interests of the fund and fund investors. Record keeping 5.1 5.3 A Virtual Asset Fund Manager should establish and implement effective policies and procedures to ensure the integrity, security, availability, reliability and completeness of all information, both in physical and electronically stored form, relevant to the Virtual Asset Fund Manager’s business operations. 5.25.4A Virtual Asset Fund Manager should keep its accounts and records properly. Proper record keeping includes: (a) maintaining an audit trail of all transactions (such as orders placed, trades executed and allocated, trades settlement, deposits and withdrawals of fund assets) effected by the Virtual Asset Fund Manager, all information relating to fund accounts produced by third parties and all relevant internal reports, including trade confirmations, statements of account and records of investment processes adopted. In addition, in respect of each fund for whom the Virtual Asset Fund Manager holds assets, the Virtual Asset Fund Manager should maintain sufficient records to show particulars of the fund’s assets and liabilities, including any financial commitments and contingent liabilities; (b) maintaining sufficient records to demonstrate that the Virtual Asset Fund Manager has complied with these Terms and Conditions; (c) keeping records in such a manner as will enable an audit to be conveniently and properly carried out; and (d) making entries in the records in accordance with generally accepted accounting principles. 5.3 5.5 A Virtual Asset Fund Manager should retain subject to paragraph (b), the records or documents related to its business as mentioned under paragraph 5.2 in premises which have been approved by the SFC for keeping records or documents required under the SFO or Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615). The Virtual Asset Fund Manager should retain- (a) subject to paragraph (b), such records or documents4 for a period of not less than seven years; and (b) in the case of records or documents showing particulars of any orders concerning Virtual Assets that are initiated by the Virtual Asset Fund Manager, for a period of not less than two years. A Virtual Asset Fund Manager that is a licensed corporation should retain records or documents related to its business as mentioned under paragraph 5.4 in premises which

22 have been approved by the SFC for keeping records or documents required under the SFO or the AMLO7 . Auditors and audited accounts 5.4 5.6 A Virtual Asset Fund Manager should ensure that an independent auditor is appointed to perform an audit of the financial statements of the fund (whether by appointing the independent auditor or procuring the relevant fund to appoint the independent auditor) in order to make available, at a minimum, an annual report for each of the funds it manages. When selecting the auditor, the Virtual Asset Fund Manager should take into account, among other things, the experience and capability of the auditor in auditing the financial statements of Virtual Asset funds. A Virtual Asset Fund Manager should understand the steps taken by the auditor in proving the existence and ownership of Virtual Assets and ascertaining the reasonableness of the valuation of the Virtual Assets and provide such information to the fund investors upon request. 5.5 The annual report for each of the funds should also be made available to fund investors of the relevant funds upon request. 5.6 The accounting information given in the annual report for each of the funds should be prepared in accordance with generally accepted accounting principles and with the accounting rules set out in the constitutive documents of the fund. 5.7 A Virtual Asset Fund Manager should arrange for the counterparties of any funds it manages to provide the necessary information to the fund’s auditor for conducting the audit. Fund Portfolio Valuation 5.7 5.8 A Virtual Asset Fund Manager should ensure that, in respect of the fund it manages, appropriate policies and procedures are established so that a proper and independent valuation of the fund assets can be performed and valuation methodologies are consistently applied to the valuation of similar types of fund assets. If independent valuation of fund assets could not be performed (i.e. the valuation is not performed by a person who is functionally independent from the person making investment decisions for the funds or an entity which is independent from the Virtual Asset Fund Manager), the Virtual Asset Fund Manager should implement proper procedures and controls to ensure that the valuation methodologies are properly and consistently applied. 5.9 The valuation policies and procedures should also describe the process for handling situations where the value of an asset determined in accordance with methodologies of the Virtual Asset Fund Manager's valuation policies and procedures may not be appropriate. Note: 7 Virtual Asset Fund Managers, which are registered institutions, should keep all required records in accordance with the applicable requirements.

23 The valuation policies and procedures should include, and describe clearly, the process for handling exceptions, including: (a) requiring the Virtual Asset Fund Manager to document the reason for any price override or deviation; (b) ensuring an appropriate review of the price override or deviation by a functionally independent party; and (c) describing the alternative method used for determining the appropriate price. 5.10 All fund assets managed by a Virtual Asset Fund Manager should be valued on a regular basis. The frequency of such valuations should be appropriate to the fund assets and the dealing frequency of the fund. A Virtual Asset Fund Manager should also disclose the frequency of valuation and dealing and basis of valuation (including the valuation policies, principles, methodologies and models) to fund investors. 5.11 Where a Virtual Asset Fund Manager arranges the appointment of a third party to perform valuation services, the Virtual Asset Fund Manager should exercise due skill, care and diligence in the selection of the third party and ensure that the third party has the necessary expertise and experience in valuing Virtual Assets. A Virtual Asset Fund Manager should also review the third party's performance periodically to ensure that the requirements in paragraphs 5.8 to 5.10 above are complied with. Note: For the avoidance of doubt, the Virtual Asset Fund Manager remains responsible for the valuation of a fund's assets notwithstanding the appointment of a third party to perform valuation services. 5.12 The Virtual Asset Fund Manager should exercise due care to ensure that valuation policies, principles, methodologies and models selected are reasonably appropriate in light of the circumstances and in the best interests of the fund and fund investors. The valuation policies, procedures and process should be periodically reviewed (at least annually) by a competent party who is independent from the person making investment decisions for the funds, such as a qualified independent third party or a person performing an independent audit function to ensure their continued appropriateness and effective implementation. The review by such party should include testing the valuation procedures by which fund assets are valued. In selecting a competent independent party, the Virtual Asset Fund Manager should exercise due skill, care and diligence. Side Pockets 5.13 Before any side pocket is introduced in a fund (i.e. where certain illiquid or hard-to￾value investments of a fund as determined by the Virtual Asset Fund Manager are segregated from other fund assets), a Virtual Asset Fund Manager should disclose to the fund investors: (a) the limit to total assets to be put in the side pocket;

24 (b) the overall fee structure and charging mechanism (in respect of, among others, any management and performance fees); (c) that the redemption lock-up period for a side pocket would be different from that of the ordinary shares of the fund; (d) how the Virtual Asset Fund Manager defines and categorises investment products which are to be put into the side pocket and the policies and rationale for transferring investments into and out of side pockets; and (e) where the assets in side pockets are allowed to be transferred to another investment vehicle, the circumstances under which transfers are allowed and the pricing mechanism for such transfers. The Virtual Asset Fund Manager should also disclose to the fund investors the actual amount of fees charged in relation to side-pocketed assets from time to time. 5.14 A Virtual Asset Fund Manager should, in setting up and managing side pockets in respect of fund assets under its management, ensure that: (a) it has the risk management competency in managing side pockets; (b) it has a valuation policy covering side-pocketed assets which complies with the requirements in paragraphs 5.8 to 5.10 above; and (c) it has operational checks and controls for transferring investments into and out of side pockets. 5.15 Where a Virtual Asset Fund Manager decides to side pocket any fund asset, it should arrange clear disclosure to fund investors of: (a) the creation of the side pocket; (b) the asset which has been side-pocketed; and (c) how the asset has been valued at the time of being side-pocketed and the ongoing valuation of the asset. Net Asset Value Calculation and Pricing 5.16 A Virtual Asset Fund Manager should ensure that the net asset value calculation of different share classes is carried out in accordance with the terms set out in the constitutive documents of the fund and the valuation policies and procedures established by the Virtual Asset Fund Manager. 5.17 A Virtual Asset Fund Manager should ensure the valuation policies and procedures in respect of each fund it manages should seek to prevent, detect and correct pricing errors. Upon the identification of material pricing errors, actions should be taken to avoid further errors.

25 Reconciliations 5.18 A Virtual Asset Fund Manager should arrange to carry out reconciliations of the Virtual Asset Fund Manager's internal records against those issued by third parties, for example, banks, custodians, counterparties and executing brokers, to identify and rectify any errors, omissions or misplacement of assets. Reconciliations should be performed regularly (and, in any event, at least monthly) having regard to the nature of the fund assets. V.VI. DEALING WITH THE FUND AND FUND INVESTORS Provision of Information 6.1 A Virtual Asset Fund Manager should: (a) provide the fund and fund investors (where applicable) with adequate information about the Virtual Asset Fund Manager, including its business address, relevant conditions or restrictions under which its business is conducted; and (b) disclose the financial condition of its business, by providing a copy of its latest audited financial statements and disclosing any material change which adversely affects the Virtual Asset Fund Manager’s financial condition after the date of these statements, to a fund upon request. 6.26.1 A Virtual Asset Fund Manager should make adequate disclosure of information (as well as any material changes to the information) on the fund8 which is necessary for fund investors to be able to make an informed decision about their investment in the fund. This includes the list of trading platforms and custodians which the fund uses and. Except for institutional professional investors and qualified corporate professional investors9 , the Virtual Asset Fund Manager should also disclose the key risks associated with the fund’s investment in Virtual Assets. Some examples of these risks are specified under Appendix 3. A Virtual Asset Fund Manager should also make the same disclosure to the distributors it has appointed for distribution of its Virtual Asset fundSchedule 4. Offer of the Virtual Asset fund 6.2 A Virtual Asset Fund Manager should comply with the relevant offer of investments requirements when distributing the Virtual Asset fund, including: (a) the prospectus requirements for offering of shares and debentures under the C(WUMP)O10; and 8 A Virtual Asset Fund Manager should also make the same disclosure to the distributors it has appointed for distribution of its Virtual Asset fund. 9 “Institutional professional investors” is defined under paragraph 15.2 of the Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission (Code of Conduct) as persons falling under paragraphs (a) to (i) of the definition of “professional investor” in section 1 of Part 1 of Schedule 1 to the SFO. “Qualified corporate professional investors” refers to corporate professional investors which have passed the assessment requirements under paragraph 15.3A and have gone through the procedures under paragraph 15.3B of the Code of Conduct. 10 Parts II and XII of the Companies (Winding Up and Miscellaneous Provisions) Ordinance (C(WUMP)O).

26 (b) the restrictions on offers of investments under Part IV of the SFO. Confidentiality 6.3 A Virtual Asset Fund Manager should maintain proper procedures to ensure confidentiality of information kept by it in respect of the fund or fund investors. Complaints 6.4 A Virtual Asset Fund Manager should maintain: (a) procedures to ensure that: (i) complaints from a fund or fund investors relating to the management of any fund managed by it are handled in a timely and appropriate manner; (ii) steps are taken to investigate and respond promptly to a complaint by: • a person designated by senior management other than an individual directly concerned with the subject of the complaint; or • the compliance officer; and (iii) if a complaint is not remedied promptly, the fund or fund investor is advised of any further steps which may be available to the fund or fund investor under the regulatory system; and (b) a register of complaints to give effect to (a) above. This should be reviewed by senior management on a regular basis. 4. Marketing Activities Target Investors of the Virtual Asset Fund 7.1 A Virtual Asset Fund Manager should only allow professional investors11 to invest in the Virtual Asset fund12 . Where the Virtual Asset fund is distributed through distributors, a Virtual Asset Fund Manager should establish and implement measures to ensure that the fund is only distributed to professional investors. Representations by the Virtual Asset Fund Manager 7.2 A Virtual Asset Fund Manager should ensure that any representation made or information supplied by it to a fund, any fund investor or distributor appointed by it to distribute its Virtual Asset fund is accurate and not misleading. Issue of Marketing Materials 11 As defined under section 1 of Part 1 of Schedule 1 to the SFO. 12 For the avoidance of doubt, this does not apply to those collective investment schemes authorized by the SFC under section 104 of the SFO.

27 7.3 A Virtual Asset Fund Manager should ensure that all advertisements and marketing materials: (a) are accurate, and not biased, misleading or deceptive; (b) are clear, fair and present a balanced picture of the fund with adequate risk disclosures; (c) contain information that is timely and consistent with the fund's offering document; and (d) contain only performance claims that can be verified. 5. Fees and Expenses Disclosure of Charges 8.1 A Virtual Asset Fund Manager should disclose to a fund and fund investors (where applicable) the basis and amount of its fees and charges. Fair and Reasonable Charges 8.2 All charges, fees and mark-ups affecting a fund and fund investors should be fair and reasonable in the circumstances, and be characterised by good faith. In connection with mark-ups levied on transactions on behalf of a fund, where the Virtual Asset Fund Manager is: (a) acting as agent, such mark-ups are prohibited; and (b) acting as principal, the circumstances should be disclosed to the clients and transactions be reported in periodic statements or transaction advice. Soft Commission and Rebates 8.3 A Virtual Asset Fund Manager may receive goods or services (i.e. soft dollars) from a broker or trading platform in consideration for directing transactions conducted on behalf of the fund to the broker or trading platform only if: (a) the goods or services are of demonstrable benefit to the fund ; (b) transaction execution is consistent with best execution standards; (c) the fund has consented in writing to the receipt of the goods and services; and periodic disclosure is made of the Virtual Asset Fund Manager’s practices for receiving the goods and services, including a description of the goods and services received. Note:

28 Goods and services must not include travel, accommodation, entertainment, general administrative goods or services, general office equipment or premises, membership fees, employee salaries, or direct money payments. Disclosure and consent may be made or given in the client agreement or an addendum thereto. Whichever form of document is used, it must include a specific statement describing the Virtual Asset Fund Manager’s soft dollar practices. In addition, at least annually the clients and fund investors must be given a statement describing the Virtual Asset Fund Manager’s soft dollar practices, including a description of the goods and services received. 8.4 A Virtual Asset Fund Manager that intends to receive and retain cash rebates in relation to client transactions may retain those rebates only if: (a) the fund has consented in writing to the retention of rebates; (b) transaction execution is consistent with best execution standards; and (c) periodic disclosure of the rebates and their approximate value is made to the clients and fund investors. VI.VII. REPORTING TO THE SFC/ HKMA 6.17.1 A Virtual Asset Fund Manager should report to the SFC (as well as the HKMA where the Virtual Asset Fund Manager is a registered institution) as soon as practicable upon the happening of any actual or suspected material non-compliance with these Terms and Conditions or any other applicable legal and regulatory requirements. 6.27.2 A Virtual Asset Fund Manager should notify the SFC (as well as the HKMA where the Virtual Asset Fund Manager is a registered institution) of any significant change in its business activities, at least 7 business days before the change takes place. 6.37.3 A Virtual Asset Fund Manager should also provide any other information as may be requested by the SFC (and/ or the HKMA where the Virtual Asset Fund Manager is a registered institution) from time to time. The SFC and/ or the HKMA may request for information to be provided on a periodic or ad hoc basis. Note: For example, such information may include: (a) the fund’s investment in each product or market; (b) valuation policies, procedures, principles and methodologies of the fund’s assets; and (c) details of custodial arrangements. 6.47.4 The Virtual Asset Fund Manager should respond to requests and enquiries from the SFC (and/ or the HKMA where the Virtual Asset Fund Manager is a registered institution) promptly in an open and co-operative manner.

29 6.57.5 A Virtual Asset Fund Manager should ensure that all information which it provides and which is provided on its behalf to the SFC (and/ or the HKMA where the Virtual Asset Fund Manager is a registered institution) is in all material respects complete, accurate and not misleading. If it becomes aware that any information provided does not meet this requirement, the Virtual Asset Fund Manager should inform the SFC promptly.(and/ or the HKMA where the Virtual Asset Fund Manager is a registered institution) promptly.

30 Appendix 1 Schedule 1 – Existing regulatory requirements applicable to Virtual Asset Fund Managers Relevant codes (1) The Fund Manager Code of Conduct, except for the following paragraphs which are not relevant or have been modified and incorporated in these Terms and Conditions: ▪ Paragraph 4.1.1 to 4.4.2 (Custody) ▪ Paragraph 5.1 (Record Keeping) ▪ Paragraph 5.2.2 (Auditors and Audited Accounts) ▪ Paragraphs 9.1.1 to 9.1.3 (Reporting Obligations to the SFC) (2) The Code of Conduct, except for the following paragraphs which are not relevant or have been modified and incorporated in these Terms and Conditions: ▪ Paragraph 16 (Analysts) ▪ Paragraph 17 (Sponsors) ▪ Paragraph 19 (Alternative liquidity pools) ▪ Paragraph 20 (Dealing with group affiliates and other connected persons) ▪ Paragraph 21 (Bookbuilding and placing activities in equity capital market and debt capital market transactions) ▪ Schedule 3 (Additional requirements for licensed or registered persons dealing in securities listed or traded on The Stock Exchange of Hong Kong Limited) ▪ Schedule 4 (Additional requirements for licensed or registered persons dealing in futures contracts and/ or options contracts traded on Hong Kong Futures Exchange Limited) ▪ Schedule 5 (Additional requirements for licensed persons providing margin lending) ▪ Schedule 6 (Additional requirements for licensed persons engaging in leveraged foreign exchange trading) ▪ Schedule 8 (Additional requirements for licensed or registered persons operating alternative liquidity pools) ▪ Schedule 10 (Risk mitigation requirements and margin requirements in relation to non-centrally cleared OTC derivative transactions)

31 Relevant guidelines (3) Guidelines on Online Distribution and Advisory Platforms (4) Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations and SFC-licensed Virtual Asset Service Providers) and Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Authorized Institutions) (as applicable) (5) Guidelines for Reducing and Mitigating Hacking Risks Associated with Internet Trading (6) Management, Supervision and Internal Control Guidelines for Persons Licensed by or Registered with the Securities and Futures Commission (7) Fit and Proper Guidelines (8) Guidelines on Competence (9) Guidelines on Continuous Professional Training

32 Schedule 2 – Requirements for Virtual Asset Fund Managers conducting discretionary accounts management Introduction Where applicable, Virtual Asset Fund Managers that are involved in the management of discretionary accounts which are operated in the following manner should observe these Terms and Conditions as well as any additional requirements set out in this AppendixSchedule: (a) where a Virtual Asset Fund Manager provides discretionary accounts management services to a client, in the form of an investment mandate or a pre-defined model investment portfolio; and Note: The investment mandate may set out, among others, the types, risks and allocation of investments after taking into account the client’s circumstances, such as investment objectives and/ or strategies. In the case of a pre-defined model portfolio, it may specify the proportion of the asset classes and markets and the risk profile of the selected portfolio. (b) the Virtual Asset Fund Manager receives a management fee and/ or performance fee as remuneration for managing the discretionary account for its client. For the avoidance of doubt, this AppendixSchedule only applies to a Virtual Asset Fund Manager that manages a discretionary account which invests in Virtual Assets and meets the de minimis threshold, irrespective of whether or not these Virtual Assets amount to “securities” or “futures contracts” as defined under the SFO. Where a Virtual Asset Fund Manager is involved in the management of both collective investment schemes and discretionary accounts, this AppendixSchedule only applies to the extent that that person is involved in the management of discretionary accounts. Note: In relation to certain principles and requirements (as specifically set out under these Terms and Conditions) that are only applicable to a Virtual Asset Fund Manager that is responsible for the overall operation of a fund or has been delegated responsibility for that function, a Virtual Asset discretionary account manager should also observe these principles and requirements, to the extent relevant to the functions and powers of the Virtual Asset discretionary account manager. Interpretation Except for those requirements mentioned in the section below, these Terms and Conditions are applicable to Virtual Asset discretionary account managers, terminologies that are specific to collective investments schemes/ funds in these Terms and Conditions should be read as modified below: (a) any reference to “fund” or “client” means "discretionary account”; (b) any reference to "fund investors” means “discretionary account clients”; and

33 (c) any reference to “Virtual Asset Fund Manager” means "Virtual Asset Discretionary Account Manager;. (d) any reference to “constitutive documents” or "offering documents” means "Discretionary Client Agreement”; and (e) any reference to “redemption” means "capital withdrawal”. Particular requirements in these Terms and Conditions which are not applicable to Virtual Asset Discretionary Account Managers The following requirements do not apply to a Virtual Asset Discretionary Account Manager: (a) Liquidity management The requirements in relation to the use of specific tools or exceptional measures which could affect redemption rights and corresponding explanation in the offering documents are not applicable to a Virtual Asset Discretionary Account Manager (Paragraphs 3.17(f) and 3.18 of these Terms and Conditions) Note: The extent of application of other liquidity management principles will depend on the capital withdrawal policy set out in the Discretionary Client Agreement. (b) Termination The requirements in relation to the termination process are not applicable to a Virtual Asset Discretionary Account Manager. (Paragraphs 3.20 and 3.21 of these Terms and Conditions) Note: A Virtual Asset Discretionary Account Manager should observe the relevant termination provisions set out in the Discretionary Client Agreement. (c) Side pockets The requirements in relation to side pocket arrangements are not applicable to a Virtual Asset Discretionary Account Manager. (Paragraphs 5.13 to 5.15 of these Terms and Conditions) (d) Auditors and audited accounts The requirement in relation to the audit of the financial statements of the funds and the accounting information in the annual report for each of the funds are not applicable to a Virtual Asset Discretionary Account Manager. (Paragraphs 5.4 to 5.7 of these Terms and Conditions) (e) Valuation frequency The requirements in relation to the valuation frequency and related disclosure are not applicable to a Virtual Asset Discretionary Account Manager. (Paragraph 5.10 of these Terms and Conditions)

34 Note: Where applicable, a Virtual Asset Discretionary Account Manager should observe the relevant requirements set out in paragraphs 5.8 to 5.12 (save for the appropriateness to the dealing frequency and related disclosure set out in paragraph 5.10 of these Terms and Conditions) and the relevant valuation provisions set out in the Discretionary Client Agreement. (f) Net Asset Value Calculation and Pricing The requirements in relation to net asset value calculation of different share classes are not applicable to a Virtual Asset Discretionary Account Manager. (Paragraphs 5.16 and 5.17 of these Terms and Conditions) Note: Where applicable, a Virtual Asset Discretionary Account Manager should observe the requirements in relation to overall net asset value calculation of the Discretionary Account. Additional requirements applicable to Virtual Asset Discretionary Account Managers The requirements set out in the following paragraphs are also generally applicable to a Virtual Asset Discretionary Account Manager: Target Clients

1. A Virtual Asset Discretionary Account Manager should only provide its services to professional investors13 . 2.1. Except for institutional professional investors and qualified corporate professional investors, Aa Virtual Asset Discretionary Account Manager should assess whether clients have knowledge of investing in Virtual Assets or related products prior to providing discretionary account management services to them. Alternatively, a Virtual Asset Discretionary Account Manager may take into account whether the clients have prior investment experience in private equity or venture capital or have provided capital for a start-up business in the past. If the clients do not possess such knowledge or experience, a Virtual Asset Discretionary Account Manager may only proceed to provide such services if, by so doing, it would be acting inhas provided adequate training to the best interestsclient on the nature and risks of the clientsVirtual Assets.
2. When providing discretionary account management services to retail clients, a Virtual Asset Discretionary Account Manager should only trade in Virtual Assets that are: (a) of high liquidity on behalf of the retail clients. In assessing the liquidity of a specific virtual asset for trading by retail clients, the Virtual Asset Discretionary Account Manager should, at a minimum, ensure that the virtual asset is an eligible large-cap virtual asset, ie, the specific virtual asset should have been included in a minimum of two acceptable indices issued by at least two different index providers. 13 As defined under section 1 of Part 1 of Schedule 1 to the SFO

35 Note 1: An acceptable index refers to an index which has a clearly defined objective to measure the performance of the largest virtual assets in the global market, and should fulfil the following criteria: (i) The index should be investible, meaning the constituent virtual assets should be sufficiently liquid; (ii) The index should be objectively calculated and rules-based; (iii) The index provider should possess the necessary expertise and technical resources to construct, maintain and review the methodology and rules of the index; (iv) The methodology and rules of the index should be well documented, consistent and transparent. Note 2: The two index providers should be separate and independent from each other, the issuer of the virtual asset (if applicable) and the Virtual Asset Discretionary Account Manager (for example, they are not within the same group of companies). Further, at least one of the indices should be issued by an index provider which complies with the IOSCO Principles for Financial Benchmarks and has experience in publishing indices for the conventional securities market. (b) made available by SFC-licensed virtual asset trading platforms for trading by retail investors. Suitability 3. A Virtual Asset Discretionary Account Manager should ensure that the mandate or predefined model investment portfolio established for or chosen by a client is suitable for that client (except for institutional professional investors and qualified corporate professional investors) based on information about the client’s personal circumstances of which it is or should be aware through the exercise of due diligence. Such suitability assessment could be conducted on a holistic basis when the mandate or portfolio is agreed (for example, in establishing a predefined model investment portfolio with a particular overall risk profile, the Virtual Asset Discretionary Account Manager could have the discretion to invest in particular products with a lower or higher risk profile so long as the overall risk profile of the portfolio is maintained). The Virtual Asset Discretionary Account Manager should document its assessment and provide a copy of the rationale to the client in writing. To avoid concentrated exposure to Virtual Assets, the Virtual Asset Discretionary Account Manager should also ensure that the aggregate amount to be invested by a client in the discretionary account is reasonable, as determined by the Virtual Asset Discretionary Account Manager, considering the client’s net worth. 4. A Virtual Asset Discretionary Account Manager should review the mandate or predefined model investment portfolio on a regular basis (for example, at least on an annual basis and whenever there have been significant market movements), having regard to the client’s latest circumstances at the time of review and, where appropriate, recommend revisions to the mandate or predefined model investment portfolio and agree them with the client. The Virtual Asset Discretionary Account Manager should also document the rationale for

36 recommending the revised mandate or predefined model investment portfolio and provide a copy of the rationale to the client in writing. 5. A Virtual Asset Discretionary Account Manager should ensure that the transactions carried out on behalf of the clients are suitable and in accordance with the mandate or predefined model investment portfolio. Client Agreementsagreements 6. A Virtual Asset Discretionary Account Manager should ensure that a written agreement (Discretionary Client Agreement) is entered into with a client (except for institutional professional investors and qualified corporate professional investors) before any services are provided to, or transactions are made on behalf of, that client. A Discretionary Client Agreement should set out the precise terms and conditions under which discretion will be exercised and contain at least such information set out in the section "Minimum Content of Discretionary Client Agreement” of this Appendix and be provided in a language understood by the client. These minimum requirements do not apply to Institutional Professional Investors14 ., amongst other things: Performance Review and Valuation Reports 7. Except as agreed otherwise in writing by the client, a Virtual Asset Discretionary Account Manager should: (a) review the performance of each Discretionary Account against any previously agreed benchmark, either in writing to the client or by way of meeting, at least twice a year; and (b) provide valuation reports to the client no later than the end of the tenth business day after the end of the monthly accounting period or at such shorter intervals as provided in the Discretionary Client Agreement. The report should, as a minimum, include the following: (i) the date on which the report is made; (ii) the valuation of the client’s portfolio, including: • the details of the quantity, purchase cost, latest price and value of each description of Virtual Asset held for that account as at the end of that period; • the money balance (in fiat currency) held for that account as at the end of that period; and • the amount of accounts payable and receivable in respect of that account as at the end of that period; and 14 The term “Institutional Professional Investors” refers to persons falling under paragraphs (a) to (i) of the definition of “professional investor’ in section 1 of Part 1 of Schedule 1 to the SFO.

37 (iii) the details of all income credited to and charges levied against that account during the monthly accounting period. Minimum Content of Discretionary Client Agreement A Discretionary Client Agreement should contain at least provisions to the following effect: (a) the full name and address of the client as verified by a retained copy of the identity card, relevant sections of the passport, business registration certificate, corporation documents, or any other official document which uniquely identifies the client; (b) the full name and address of the Virtual Asset Discretionary Account Manager's business including the Virtual Asset Discretionary Account Manager's licensing status with the SFC and the CE number (being the unique identifier assigned by the SFC); (c) appointment of the firm as the Virtual Asset Discretionary Account Manager and the details of the services provided; (d) statement of the client’s investment policy and objectives. In the case where the client has selected a pre-defined model portfolio, the Discretionary Client Agreement should also specify the proportion of the asset classes, markets, and corresponding risk profile of the selected pre-defined model portfolios; (e)(a)the following clause: “If we [the intermediary] solicit the sale of or recommend any Virtual Assets to you [the client], the Virtual Assets must be reasonably suitable for you having regard to your financial situation, investment experience and investment objectives. No other provision of this agreement or any other document we may ask you to sign and no statement we may ask you to make derogates from this clause.”; and (f) the amount of all fees to be paid by the client, whether to the Virtual Asset Discretionary Account Manager or to a connected person with respect to the account, and a description of fees to be paid by the client to third parties, where applicable; (g) any consent from the client where the Virtual Asset Discretionary Account Manager intends to receive soft commission or retain cash rebates; (h) details of custodial arrangements if the Virtual Asset Discretionary Account Manager provides custodial arrangement itself; (i) details of periodic reporting to be made to client; (j)(b) the risk disclosure statements (please see Appendix 3Schedule 4 for some examples of these risks); and). (k) undertakings by the Virtual Asset Discretionary Account Manager and the client to notify the other in the event of any material change to the above information provided in the Discretionary Client Agreement.

38 Appendix 2 Schedule 3 – Risk management control techniques and procedures A. Risk management

1. A Virtual Asset Fund Manager should establish and maintain effective risk management policies and reporting mechanisms which take into account the following risk management control techniques and procedures where applicable.
2. The fund’s risk policies and measurements and reporting mechanisms should be subject to regular review, particularly when there are significant changes to the fund or relevant market conditions, legislation, rules or regulations that might impact the fund’s risk exposure.
3. The risk management policy of the Virtual Asset Fund Manager should provide, for each fund, a system of limits concerning the measures used to monitor and to control the relevant risks. For example, a Virtual Asset Fund Manager should set position limits in respect of each product or market the fund invests in, such as a cap on the portfolio’s investment in illiquid or hard to value Virtual Assets issued and exposure to counterparties. B. Market risk
4. A Virtual Asset Fund Manager should establish and maintain effective risk management measures to quantify the impact of changing market conditions on the fund. These measures should cover all risk elements associated with the fund. Matters to be covered in such risk measures should include: (a) unspecified adverse market movements - using an appropriate value-at-risk or other methodology to estimate potential losses; and (b) stress testing - determining the effect of abnormal and significant changes in market conditions on the fund using various quantitative and qualitative variable assumptions. C. Liquidity risk
5. A Virtual Asset Fund Manager should establish and regularly monitor measures of liquidity mismatches between the funds’ underlying investments and their redemption obligations (or obligations to honour withdrawal requests made by Discretionary Account Clients) using quantitative metrics or qualitative factors.
6. A Virtual Asset Fund Manager should establish and implement appropriate procedures to alert staff member(s) responsible for liquidity management to potential default problems and to provide them with adequate time to take appropriate action to minimise the impact of fund counterparty liquidity problems.
7. In assessing the liquidity of the assets of a fund, a Virtual Asset Fund Manager should consider the following, where applicable:

39 (a) obligations to creditors, counterparties and third parties; (b) the time required to liquidate assets; (c) the price at which liquidation could be effected; (d) the financial settlement lag time; and (e) the dependence of these considerations on other market risks and factors. D.B. Counterparty risk 8.2. A Virtual Asset Fund Manager should establish and maintain an effective credit assessment system to evaluate the creditworthiness of the funds’ counterparties. For example, when assessing the creditworthiness of a Virtual Asset trading platform, a Virtual Asset Fund Manager should consider the following: (a) the experience and track record of the Virtual Asset trading platform; (b) the legal and regulatory status of the Virtual Asset trading platform’s operator, including its compliance history. For example, whether any disciplinary actions have been taken by any regulatory authorities against the operator; (c) the corporate governance structure and the background of the founders and senior management of the Virtual Asset trading platform; (d) the operational capabilities of the Virtual Asset trading platform; (e) the liquidity of Virtual Assets traded on the Virtual Asset trading platform (f) the custodial arrangements of the Virtual Asset trading platform where the trading platform takes custody of Virtual Assets; (g) the mechanisms (for example, surveillance) implemented by the Virtual Asset trading platform to guard against fraud and market misconduct with respect to the products traded on the trading platform; (h) the cybersecurity risk management measures of the Virtual Asset trading platform, including its business continuity plan; (i) the risk management tools adopted by the Virtual Asset trading platform to manage its counterparty risk arising from its payment, clearing, and settlement processes; and (j) the financial resources and insurance cover of the Virtual Asset trading platform. For example, the Virtual Asset trading platform’s ability to compensate its clients should there be any loss of their assets due to hacking or other events and the auditor’s opinion on the going concern of the Virtual Asset trading platform. 9.3. A Virtual Asset Fund Manager should set appropriate limits in relation to the fund’s exposure to the different counterparties of the fund, including Virtual Asset trading

40 platforms and custodians. For example, a Virtual Asset Fund Manager should consider using more than one custodian to hold the portfolio’s assets to avoid undue concentration of risk. E.C. Operational and cybersecurityCybersecurity risk 10. In designing the policies, procedures, and internal controls to reduce operational risk, a Virtual Asset Fund Manager should consider, amongst other considerations, physical and functional segregation of incompatible duties, maintenance and timely production of proper and adequate accounting and other records, the security and reliability of accounting and other information, staffing adequacy and competence as well as prompt reconciliation of trading information. 11.4. A Virtual Asset Fund Manager should implement adequate and appropriate security controls to protect the systems used in its operations. The security controls should include, but not be limited to, the following: (a) effective techniques to protect the confidentiality and integrity of information stored in the system and passed between internal and external networks; and (b) appropriate operating controls to prevent and detect unauthorisedunauthorized access, security breach and security attack. 12. A Virtual Asset Fund Manager should establish, implement and maintain a business continuity and transition plan. The plan should include policies and procedures that ensure, in the case of a business disruption or an interruption to the Virtual Asset Fund Manager’s operation, that the following matters are addressed: (a) the preservation of essential data and functions, and the maintenance of services and activities, or, where that is not possible, the timely recovery of such data and functions and the timely resumption of its services and activities; (b) continuity of effective communications with clients, employees, service providers and regulators; (c) identification, assessment and maintenance of third-party services critical to the operation of the Virtual Asset Fund Manager; and (d) appropriate transitioning arrangements that account for the possible winding down of the Virtual Asset Fund Manager’s business or the transition of the Virtual Asset Fund Manager’s business to others in the event where the Virtual Asset Fund Manager is unable to continue providing its services.

41 Appendix 3 Schedule 4 – Risk disclosure statements The Virtual Asset Fund Manager should properly disclose the risks associated with investment in the Virtual Asset fund under its management and Virtual Assets invested in the fund to potential fund investors and distributors appointed by it to distribute its Virtual Asset fund. Some examples of the associated risks are listed below. (a) Price volatility (b) Potential price manipulation on trading platforms (c) Lack of secondary markets for certain Virtual Assets (d) Difficulties in verifying ownership of Virtual Assets (e) Most trading platforms and custodians of Virtual Assets are presently unregulated (f) Counterparty risk when effecting transactions with issuers, private buyers/ sellers or through trading platforms (g) Risks arising from custodial arrangements, including self-custody of assets by the fund manager and use of hot wallets15 (h) Continuing evolution of Virtual Assets and global regulatory developments (i) Cybersecurity and technology related risks (j) Legal uncertainty on whether Virtual Assets can be regarded as “property” under the law 15 A “hot wallet” refers to the wallet used for holding Virtual Assets in an online environment which provides an interface with the internet, which is more susceptible to cyber-attacks.