Licensing and Registration Conditions for Virtual Asset Dealing and Advisory Services

Licensing or registration conditions and terms and conditions for licensed corporations or registered institutions providing virtual asset dealing services and virtual asset advisory services May 2026 Appendix A1 Appendix A to the Supplemental Joint Circular of 30 Sep 2025 Appendix 6

2 Contents Part I – Virtual asset dealing services Licensing or registration conditions for licensed corporations or registered institutions acting as introducing agents for SFC-licensed virtual asset trading platform operators or HKMA-licensed stablecoin issuers 4 Licensing or registration conditions for licensed corporations or registered institutions providing virtual asset dealing services under an omnibus account arrangement 6 Terms and conditions for licensed corporations or registered institutions providing virtual asset dealing services under an omnibus account arrangement 7 I. Interpretation 7 II. Codes and guidelines 9 III. Financial soundness (repealed) 10 IV. Operations 10 V. Prevention of market manipulative and abusive activities 12 VI. Dealing with clients 12 VII. Custody of client assets 24 VIII. Staking 28 IX. Record keeping 30 X. Auditors 34 XI. XII Conflicts of interest Ongoing reporting obligations 34 34 Schedule 1 – Existing regulatory requirements applicable to licensed corporations or registered institutions providing virtual asset dealing services under an omnibus account arrangement 36 Part II – Virtual asset advisory services Licensing or registration conditions for licensed corporations or registered institutions providing virtual asset advisory services 38 Terms and conditions for licensed corporations or registered institutions providing virtual asset advisory services 39 I. Interpretation 39 II. Codes and guidelines 40

3 III. Virtual asset-knowledge test and suitability 40

4 Part I – Virtual asset dealing services Licensing or registration conditions for licensed corporations or registered institutions acting as introducing agents for SFC-licensed virtual asset trading platform operators or HKMA-licensed stablecoin issuers (a) With respect to introducing clients to virtual asset trading platform operators or stablecoin issuers, the licensee or registered institution shall only engage in the introduction of persons to establish accounts with an SFC-licensed virtual asset trading platform (SFC-licensed platform) to effect dealing in or make offers to deal in virtual assets directly, except that the licensee or registered institution may engage in the introduction of persons to establish accounts with an HKMA-licensed stablecoin issuer directly to effect dealing in or make offers to deal in a specified stablecoin the issuance of which is authorised by a licence granted under the Stablecoins Ordinance (SO) (Relevant Stablecoin) and made by that issuer. The licensee or registered institution shall not communicate any offers to effect dealings in virtual assets to the SFC￾licensed platform or the HKMA-licensed stablecoin issuer (where applicable). Prior to introducing clients to establish accounts with an SFC-licensed trading platform or an HKMA-licensed stablecoin issuer (where applicable), the licensee or registered institution should enter into a written client agreement with clients which should set out a clear description of the nature of the services to be provided to or available to the client, including the role and obligation of the licensee or registered institution and that it would not provide any dealing, financial accommodation, settlement or custody services. The term “SFC-licensed platform” means a virtual asset trading platform operator which is licensed by the SFC pursuant to section 116 of the Securities and Futures Ordinance and/or section 53ZRK of the Anti-Money Laundering and Counter￾Terrorist Financing Ordinance (AMLO). The term “HKMA-licensed stablecoin issuer” means a stablecoin issuer which is licensed by the HKMA under section 15 of the SO. The term “virtual asset” is defined in section 53ZRA of the AMLO. The term “specified stablecoin” has the meaning given by section 4 of the SO. (b) (i) [For licensee or registered institution which provides services to retail investors and/ or professional investors] With respect to introducing clients to virtual asset trading platform operators or HKMA-licensed stablecoin issuers (where applicable), the licensee or registered institution shall only introduce persons which are its clients in respect of its business in Type 1 regulated activity (dealing in securities), except where the registered institution only introduces clients to virtual asset trading platform operators or HKMA-licensed stablecoin issuers (where applicable) which provide virtual asset dealing services only in Relevant Stablecoins as a service (Relevant Stablecoin-only dealing service) for the provision of Relevant Stablecoin-only dealing service, such clients need not be its clients in respect of its business in Type 1 regulated activities (dealing in securities). The term “dealing in securities” is specified in Part 2 of Schedule 5 to the Securities and Futures Ordinance. (ii) [For licensee or registered institution which only provides services to professional investors] With respect to introducing clients to virtual asset trading platform operators or HKMA-licensed stablecoin issuers (where applicable), the licensee or registered institution shall only introduce persons which are professional investors and are its clients in respect of its business in Type 1 regulated activity (dealing in securities), except where the registered institution only introduces clients to virtual asset trading platform operators or HKMA-licensed stablecoin

5 issuers (where applicable) which provide virtual asset dealing services only in Relevant Stablecoins as a service (Relevant Stablecoin-only dealing service) for the provision of Relevant Stablecoin-only dealing service, such clients need to be professional investors but need not be its clients in respect of its business in Type 1 regulated activity (dealing in securities).. The term “professional investor” is defined in section 1 of Part 1 of Schedule 1 to the Securities and Futures Ordinance (SFO) together with the Securities and Futures (Professional Investor) Rules. The term “dealing in securities” is specified in Part 2 of Schedule 5 to the SFO. (c) With respect to introducing clients to virtual asset trading platform operators or stablecoin issuers, the licensee or registered institution shall not hold client assets. • The term “hold” is as defined under the Securities and Futures Ordinance; and • The term “client assets” means: (i) “client virtual assets”, which means any virtual assets received or held by the licensee or registered institution, which are so received or held on behalf of a client or in which a client has a legal or equitable interest, and includes any rights thereto. The term “virtual asset” is defined in section 53ZRA of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance; and (ii) “client money”, which means any money received or held by the licensee or registered institution, which is so received or held on behalf of a client or in which a client has a legal or equitable interest, and includes any accretions thereto whether as capital or income.

6 Licensing or registration conditions for licensed corporations or registered institutions providing virtual asset dealing services under an omnibus account arrangement (a) With respect to providing virtual asset dealing services, the licensee or registered institution shall only provide such services through operating an omnibus account established and maintained with an SFC-licensed platform, or an HKMA-licensed stablecoin issuer as far as a specified stablecoin the issue of which is authorised by a licence granted under the Stablecoins Ordinance (SO) (Relevant Stablecoin) and made by that issuer is concerned. The term “SFC-licensed platform” refers to a virtual asset trading platform operator which is licensed by the SFC pursuant to section 116 of the Securities and Futures Ordinance and/or section 53ZRK of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO). The term “HKMA￾licensed stablecoin issuer” means a stablecoin issuer which is licensed by the HKMA under section 15 of the SO. The term “virtual asset” is defined in section 53ZRA of the AMLO. The term “specified stablecoin” has the meaning given by section 4 of the SO. (b) (i) [For licensee or registered institution which provides services to retail investors and/ or professional investors] With respect to providing virtual asset dealing services, the licensee or registered institution shall only provide such services to persons which are, and remain at all times, its clients in respect of its business in Type 1 regulated activity (dealing in securities), except where the registered institution provides virtual asset dealing services only in Relevant Stablecoins to its clients, such clients need not be its clients in respect of its business in Type 1 regulated activity (dealing in securities). The term “dealing in securities” is specified in Part 2 of Schedule 5 to the Securities and Futures Ordinance. The term “virtual asset” is defined in section 53ZRA of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance. (ii) [For licensee or registered institution which only provides services to professional investors] With respect to providing virtual asset dealing services, the licensee or registered institution shall only provide such services to professional investors which are, and remain at all times, its clients in respect of its business in Type 1 regulated activity (dealing in securities), except where the registered institution provides virtual asset dealing services only in Relevant Stablecoins to its clients, such clients need not be its clients in respect of its business in Type 1 regulated activity (dealing in securities). The term “professional investor” is defined in section 1 of Part 1 of Schedule 1 to the Securities and Futures Ordinance (SFO) together with the Securities and Futures (Professional Investor) Rules. The term “dealing in securities” is specified in Part 2 of Schedule 5 to the SFO. The term “virtual asset” is defined in section 53ZRA of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance. (c) With respect to providing virtual asset dealing services, the licensee or registered institution shall comply with the attached “Terms and conditions for licensed corporations or registered institutions providing virtual asset dealing services under an omnibus account arrangement” (as amended from time to time). The term “virtual asset” is defined in section 53ZRA of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance.

7 Terms and conditions for licensed corporations or registered institutions providing virtual asset dealing services under an omnibus account arrangement I. Interpretation A reference in these Terms and conditions for licensed corporations or registered institutions providing virtual asset dealing services under an omnibus account arrangement (Terms and conditions) to: ▪ “AMLO” means the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615); ▪ “authorized financial institution” means an authorized institution as defined in section 2(1) of the Banking Ordinance (Cap. 155); ▪ “client” means a person to whom the licensed corporation or registered institution provides services in Relevant VA Dealing Activities; ▪ “client asset” means client virtual assets and client money; ▪ “client money” means any money received or held by or on behalf of the licensed corporation or registered institution, which is so received or held on behalf of a client or in which a client has a legal or equitable interest, and includes any accretions thereto whether as capital or income; ▪ “client virtual asset” means any virtual asset received or held by or on behalf of the licensed corporation or registered institution, which is so received or held on behalf of a client or in which a client has a legal or equitable interest, and includes any rights thereto and virtual asset collateral; ▪ “group of companies” is defined in section 1 of Part 1 of Schedule 1 to the SFO; ▪ “HKMA-licensed stablecoin issuer” means a stablecoin issuer which is licensed by the HKMA under section 15 of the SO; ▪ “licensed corporation” means a corporation which is licensed by the SFC and upon which these Terms and conditions are imposed by way of a licensing condition pursuant to section 116 of the SFO; ▪ “margin ratio”, in relation to each description of virtual asset collateral, means the percentage of the value of such collateral up to which a client of a licensed corporation or registered institution is permitted to borrow (or otherwise secure other forms of financial accommodation) from the licensed corporation or registered institution against that particular description of virtual asset collateral; ▪ “margin value”, in relation to each description of virtual asset collateral, means the maximum amount of money which a client of a licensed corporation or registered institution is permitted to borrow (or otherwise secure other forms of financial accommodation) from the licensed corporation or registered institution against that particular description of virtual assets collateral;

8 ▪ “professional investor” is defined in section 1 of Part 1 of Schedule 1 to the SFO; ▪ “registered institution” means an authorized financial institution which is registered with the SFC and upon which these Terms and conditions are imposed by way of a registration condition pursuant to section 119 of the SFO; ▪ “regulated activity” means any of the regulated activities specified in Part 1 of Schedule 5 to the SFO, and a reference to a type of regulated activity by number shall be construed as a reference to the type of regulated activity of that number as specified in that Part; ▪ “Relevant Stablecoin” means a specified stablecoin the issue of which is authorised by a licence granted under the SO; ▪ “Relevant VA Dealing Activities” means any virtual asset dealing activities carried out by the licensed corporation or registered institution on behalf of its clients through operating an omnibus account established and maintained with an SFC￾licensed platform or as far as a Relevant Stablecoin is concerned, an SFC￾licensed platform or the HKMA-licensed stablecoin issuer of the Relevant Stablecoin; ▪ “retail client” or “retail investor” means any person other than a professional investor; ▪ “SFC-licensed platform” means a virtual asset trading platform operator which is licensed by the SFC pursuant to section 116 of the SFO and/or section 53ZRK of the AMLO; ▪ “SFO” means the Securities and Futures Ordinance (Cap. 571); ▪ “SO” means the Stablecoins Ordinance (Cap. 656); ▪ “specified stablecoin” has the meaning given by section 4 of the SO; ▪ “Relevant VA Staking Activities” means any activities carried out by the licensed corporation or registered institution on behalf of its clients which involves the process of committing or locking client virtual assets (other than virtual asset collateral) to participate in a blockchain protocol’s validation process based on a proof-of-stake consensus mechanism, with returns generated and distributed for that participation in accordance with Part VIII below; ▪ “validator” means the operator of one or more nodes participating in a blockchain protocol’s validation process based on a proof-of-stake consensus mechanism; ▪ “virtual asset” means any “virtual asset” as defined in section 53ZRA of the AMLO; ▪ “virtual asset collateral” means (a) in relation to a licensed corporation, means any virtual asset— (i) deposited with, or otherwise provided by or on behalf of a client of the licensed corporation to, the licensed corporation; or

9 (ii) deposited with, or otherwise provided by or on behalf of a client of the licensed corporation to, any other licensed corporation, registered institution or person, which are so deposited or provided— (A) as security for the provision by the licensed corporation of financial accommodation; or (B) to facilitate the provision by the licensed corporation of financial accommodation under an arrangement that confers on the licensed corporation a collateral interest in the virtual asset; or (b) in relation to a registered institution, means any virtual asset— (i) deposited with, or otherwise provided by or on behalf of a client of the registered institution to, the registered institution, in the course of the conduct of Relevant VA Dealing Activities; or (ii) deposited with, or otherwise provided by or on behalf of a client of the registered institution to, any other licensed corporation, registered institution or person, in relation to such conduct of the Relevant VA Dealing Activities, which are so deposited or provided— (A) as security for the provision by the registered institution of financial accommodation; or (B) to facilitate the provision by the registered institution of financial accommodation under an arrangement that confers on the registered institution a collateral interest in the virtual asset; and ▪ “VA financing” has the meaning given to it under the “Circular on licensed corporations providing virtual asset dealing services (1) to offer financing for virtual asset dealing and access to shared ordered book, and (2) to safeguard client virtual assets relating to withdrawals” dated 11 February 2026 and it is construed accordingly for registered institutions. II. Codes and guidelines 2.1 In conducting Relevant VA Dealing Activities, Relevant VA Staking Activities and VA financing, to the extent not already covered elsewhere in these Terms and conditions, a licensed corporation or registered institution is expected to observe the requirements of the codes and guidelines (as supplemented by circulars, frequently asked questions (FAQs) and other related guidance issued by the SFC from time to time) listed in Schedule 1 hereto as if: (i) any reference to a financial product (for example, securities) or investment product included virtual assets and (if applicable) “staked” virtual assets;

10 (ii) any reference to a client included a person to whom a licensed corporation or registered institution provides services in Relevant VA Dealing Activities and a person to whom a licensed corporation or registered institution provides services in Relevant VA Staking Activities, and VA financing; (iii) any reference to client assets included client virtual assets and (if applicable) “staked” client virtual assets (other than virtual asset collateral); and (iv) any reference to regulated activities included Relevant VA Dealing Activities, Relevant VA Staking Activities and VA financing. III. Financial soundness (repealed) IV. Operations 4.1 A licensed corporation or registered institution should only establish and maintain an omnibus account (designated as a trust or client account) with an SFC-licensed platform or an HKMA-licensed stablecoin issuer (where applicable). Furthermore, if the licensed corporation or registered institution provides services in Relevant VA Dealing Activities to retail clients, the licensed corporation or registered institution should ensure that the retail clients of the licensed corporation or registered institution can only trade in those virtual assets that are made available for trading by retail investors by the SFC-licensed platform or the HKMA-licensed stablecoin issuer of the Relevant Stablecoin concerned (where applicable). For the avoidance of doubt, the licensed corporation or registered institution may establish and maintain omnibus accounts with multiple SFC-licensed platforms and HKMA-licensed stablecoin issuers (where applicable). 4.2 Subject to paragraph 4.3, a licensed corporation or registered institution should execute a trade for a client through the omnibus account only if there are sufficient fiat currencies or virtual assets in the client’s account to cover that trade. 4.3 A licensed corporation or registered institution should not provide any financial accommodation1 for its clients to acquire virtual assets unless the licensed corporation or registered institution engages in securities margin financing and these terms and conditions are imposed on its Type 1 licence or registration. 4.4 Except for Relevant VA Staking Activities (see Part VIII below), a licensed corporation or registered institution should not make any arrangements with its clients on using the client virtual assets received or held by the licensed corporation or registered institution with the effect of generating returns for the clients or any other parties. 4.5 Where a client is entitled to voting rights arising out of its ownership of a virtual asset, upon notification by the SFC-licensed platform or the authorized financial institution (or a subsidiary of a locally incorporated authorized financial institution) as described in paragraph 7.1 below, the licensed corporation or registered institution should inform the client how those voting rights will be handled by that SFC-licensed platform or that 1 This term is defined in section 1 of Part 1 of Schedule 1 to the SFO.

11 authorized financial institution (or a subsidiary of a locally incorporated authorized financial institution) and the licensed corporation or registered institution. 4.6 For orders in virtual assets (including virtual assets classified as complex products2 ) which are placed by a client directly on the trading platform of a licensed corporation or registered institution or directly to staff of the licensed corporation or registered institution for onward passing to the SFC-licensed platform or the HKMA-licensed stablecoin issuer of the Relevant Stablecoin concerned for execution, the licensed corporation or registered institution is not required to ensure that the transaction is suitable for the client if there has been no solicitation or recommendation made by the licensed corporation or registered institution. 4.7 Where a licensed corporation or registered institution is authorized by a client in writing to operate the client’s account for trading securities on a discretionary basis as an ancillary service and the client has further authorized the licensed corporation or registered institution to operate the client’s account to trade in virtual assets on a discretionary basis, the licensed corporation or registered institution should only invest less than 10% of the gross asset value of the client’s account in virtual assets. 4.8 Where a licensed corporation or registered institution makes a solicitation or recommendation or provides advisory services to retail clients on virtual assets3 , the licensed corporation or registered institution should take all reasonable steps to ensure that the virtual asset solicited or recommended: (i) except where the virtual asset is a Relevant Stablecoin, is of high liquidity. In assessing the liquidity of a specific virtual asset for trading by retail clients, the licensed corporation or registered institution should, at a minimum, ensure that the virtual asset is an eligible large-cap virtual asset, ie, the specific virtual asset should have been included in a minimum of two acceptable indices issued by at least two different index providers; and Note 1: An acceptable index refers to an index which has a clearly defined objective to measure the performance of the largest virtual assets in the global market, and should fulfil the following criteria: (a) The index should be investible, meaning the constituent virtual assets should be sufficiently liquid; (b) The index should be objectively calculated and rules-based; (c) The index provider should possess the necessary expertise and technical resources to construct, maintain and review the 2 “Complex product” refers to an investment whose terms, features and risks are not reasonably likely to be understood by a retail investor because of its complex structure, having regard to the factors set out in paragraph 5.5 of the Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission (Code of Conduct)/paragraph 6.1 of the Guidelines on Online Distribution and Advisory Platforms. 3 Where a licensed corporation or registered institution makes a solicitation or recommendation or provides advisory services to clients other than institutional professional investors and qualified corporate professional investor clients on Relevant Stablecoins, it should, amongst others, (a) act diligently and carefully in providing any advice to its clients, ensuring that the advice and recommendations are based on thorough analysis (for instance, Relevant Stablecoin use case of the client) and take into account available alternatives to clients; and (b) it should also ensure that any conflicts of interest are properly managed and minimised (for example, it should not take commission rebates or other benefits as the primary basis for soliciting or recommending a Relevant Stablecoin to clients).

12 methodology and rules of the index; (d) The methodology and rules of the index should be well documented, consistent and transparent. Note 2: The two index providers should be separate and independent from each other, the issuer of the virtual asset (if applicable) and the licensed corporation or registered institution (for example, they are not within the same group of companies). Further, at least one of the indices should be issued by an index provider which complies with the IOSCO Principles for Financial Benchmarks and has experience in publishing indices for the conventional securities market. (ii) is made available by SFC-licensed platforms for trading by retail investors, or is a Relevant Stablecoin. 4.9 A licensed corporation or registered institution should adopt a fee structure that is clear, fair and reasonable in the circumstances and characterized by good faith. In relation to Relevant VA Dealing Activities, the licensed corporation or registered institution should clearly set out how different fees may apply based on the type of order (including whether the client is providing or taking liquidity), transaction size and type of virtual assets transacted (if applicable). V. Prevention of market manipulative and abusive activities 5.1 A licensed corporation or registered institution should establish and implement written policies and controls for identifying any red flags which may arouse reasonable suspicions of market manipulative or abusive trading activities, such as anomalies in trading patterns and the potential use of abusive trading strategies. 5.2 Upon becoming aware of any actual or potential market manipulative or abusive activities, a licensed corporation or registered institution should notify the SFC (and the HKMA if a Relevant Stablecoin is or was involved) as soon as practicable, take immediate steps to prevent these activities from continuing and provide the SFC (and the HKMA if a Relevant Stablecoin is or was involved) with additional assistance in connection with such activities as it might request. VI. Dealing with clients 6.1 Except for institutional and qualified corporate professional investors4 , a licensed corporation or registered institution should assess a client’s knowledge of virtual assets (including knowledge of relevant risks associated with virtual assets) before providing any services in Relevant VA Dealing Activities to the client5 .

6.2 Where the client does not possess such knowledge, a licensed corporation or 4 Same definitions as in paragraph 15 of the Code of Conduct. “Qualified corporate professional investors” refers to corporate professional investors which have passed the assessment requirements under paragraph 15.3A and gone through the procedures under paragraph 15.3B of the Code of Conduct. 5 The following are some non-exhaustive criteria for assessing whether a client can be regarded as having knowledge of virtual assets: (i) whether the client has undergone training or attended courses on virtual assets; (ii) whether the client has current or previous work experience related to virtual assets; or (iii) whether the client has prior trading experience in virtual assets.

13 registered institution may only provide services in Relevant VA Dealing Activities to the client if the licensed corporation or registered institution has provided adequate training to the client. 6.2A For licensed corporations or registered institutions which provide services in Relevant VA Dealing Activities only in Relevant Stablecoins (Relevant Stablecoin-only dealing services) to specific clients (Relevant Stablecoin-only clients) and the accounts of such clients are clearly demarcated as Relevant Stablecoin-only client accounts, paragraphs 6.1 and 6.2 above do not apply to their provision of Relevant Stablecoin-only dealing services to Relevant Stablecoin-only clients. 6.3 Except for institutional and qualified corporate professional investors, a licensed corporation or registered institution, before providing services in Relevant VA Dealing Activities, should assess a client’s risk tolerance level, accordingly determine the client’s risk profile and assess whether it is suitable for the client to participate in the trading of virtual assets. The licensed corporation or registered institution should exercise due skill, care and diligence to ensure the methodology for risk profiling is properly designed and should determine the client’s risk profile based on an assessment of the information about the client obtained through its know-your-client process. The methodology adopted for categorising clients and an explanation of the risk profiles of clients should be made available to the client6. 6.3A For licensed corporations or registered institutions which provide Relevant Stablecoin￾only dealing services to specific clients and the accounts of such clients are clearly demarcated as Relevant Stablecoin-only client accounts, for the purpose of paragraph 6.3, licensed corporations or registered institutions should consider the Relevant Stablecoin-only client’s objective in the trading of Relevant Stablecoins (e.g. use case). Generally, Relevant Stablecoins may be made available to clients across different risk profiles. 6.4 Except for institutional and qualified corporate professional investors, a licensed corporation or registered institution should set a limit for each client to ensure that the client’s exposure to virtual assets is reasonable, with reference to the client’s financial situation (including the client’s net worth) and personal circumstances7 . The licensed corporation or registered institution should notify the client of the assigned limit and review this limit regularly to ensure that it remains appropriate. In calculating the client’s exposure to virtual assets in order to set the client’s exposure limit to virtual assets, the client’s holdings in Relevant Stablecoins need not be included in the calculation. 6.4A For licensed corporations or registered institutions which provide Relevant Stablecoin￾only dealing services to specific clients and the accounts of such clients are clearly demarcated as Relevant Stablecoin-only client accounts, paragraph 6.4 above does not apply to their provision of Relevant Stablecoin-only dealing services to Relevant Stablecoin-only clients. 6 Where risk-scoring questionnaires are used to risk profile clients, the licensed corporation or registered institution should pay particular attention to the design of the questions and the underlying scoring mechanism, which should be properly designed to accurately reflect the personal circumstances of a client. The licensed corporation or registered institution should also have appropriate processes in place to periodically review the risk profiling methodology and mechanism for clients. 7 The licensed corporation or registered institution should take into account the client’s overall holdings in virtual assets (but excluding the client’s holdings in Relevant Stablecoins), whether held by the licensed corporation or registered institution or otherwise, on a best efforts basis.

14 6.5 A licensed corporation or registered institution should ensure that it complies with the applicable laws and regulations in the jurisdictions in which it provides services. In particular, it should establish and implement measures which include: (a) ensuring its marketing activities are only conducted in permitted jurisdictions without violation of the relevant restrictions on offers of investments; and (b) implementing measures to prevent persons from jurisdictions which have banned trading in virtual assets from accessing its services (for example, by checking IP addresses and blocking access). For the avoidance of doubt, the licensed corporation or registered institution should also implement appropriate measures to detect and prevent persons who are attempting to circumvent the relevant jurisdictions’ ban on trading virtual assets (for example, by using a virtual private network to mask their IP addresses) from accessing its services. Client identity: origination of instructions and beneficiaries 6.6 A licensed corporation or registered institution should be satisfied on reasonable grounds about8 : (a) the identity, address and contact details of: (i) the person or entity (legal or otherwise) ultimately responsible for originating the instruction in relation to a transaction; (ii) the person or entity (legal or otherwise) that stands to gain the commercial or economic benefit of the transaction, bear its commercial or economic risk or both gain the benefit and bear its risks; and (b) the instruction given by the person or entity referred to in paragraph 6.6(a)(i) above. 6.7 A licensed corporation or registered institution should not do anything to effect a transaction unless it has complied with, and kept records in Hong Kong of the details referred to in, paragraph 6.6 above. 6.8 In relation to a collective investment scheme or discretionary account, the “entity” referred to in paragraph 6.6 above is the collective investment scheme or account, and the manager of that collective investment scheme or account, not those who hold a beneficial interest in that collective investment scheme or account. Client agreement 6.9 In conducting any Relevant VA Dealing Activities or VA financing, a licensed corporation or registered institution should: (a) enter into a written client agreement with each client9 in the same manner as set 8 The licensed corporation or registered institution must satisfy itself about and record information that identifies those who are really behind a transaction; those who ultimately originate instructions in relation to a transaction and those who ultimately benefit from, or bear the risk of, that transaction. The SFC is concerned about the substance of what is going on with a transaction and not the technicalities. 9 Except for institutional and qualified corporate professional investors.

15 out in paragraph 6 of the Code of Conduct; and (b) include a provision stating that: “In conducting any Relevant VA Dealing Activities, if we [the licensed corporation or registered institution] solicit the sale of or recommend any product including any virtual assets to you [the client], the product must be reasonably suitable for you, having regard to your financial situation, investment experience and investment objectives. No other provision of this agreement or any other document we may ask you to sign and no statement we may ask you to make derogates from this clause.” Disclosure 6.10 Except for institutional and qualified corporate professional investors, a licensed corporation or registered institution should fully disclose the nature and risks that clients may be exposed to when dealing in virtual assets10 . All information provided to clients should be presented in a clear and fair manner which is not misleading. The disclosed risks should, amongst other things, include: (a) virtual assets are highly risky and investors should exercise caution in relation to these products; (b) a virtual asset may or may not be considered as “property” under the law, and such legal uncertainty may affect the nature and enforceability of a client’s interest in such virtual asset; (c) the offering documents or product information provided by the issuer have not been subject to scrutiny by any regulatory body; (d) the protection offered by the Investor Compensation Fund does not apply to transactions involving virtual assets (irrespective of the nature of the tokens); (e) a virtual asset is not legal tender, ie, it is not backed by the government and authorities; (f) transactions in virtual assets may be irreversible, and, accordingly, losses due to fraudulent or accidental transactions may not be recoverable; (g) the value of a virtual asset may be derived from the continued willingness of market participants to exchange fiat currencies for a virtual asset, which means that the value of a particular virtual asset may be completely and permanently lost should the market for that virtual asset disappear. There is no assurance that a person who accepts a virtual asset as payment today will continue to do so in the future; (h) the extreme volatility and unpredictability of the price of a virtual asset relative to fiat currencies may result in a total loss of the investment over a short period of time; (i) legislative and regulatory changes may adversely affect the use, storage, 10 A one-off disclosure made by the licensed corporation or registered institution prior to entering into a virtual asset transaction is acceptable.

16 transfer, exchange and value of virtual assets; (j) some virtual asset transactions may be deemed to be executed only when they are recorded and confirmed by an SFC-licensed platform, which may not necessarily be the time at which the client initiates the transaction; (k) the nature of virtual assets exposes them to an increased risk of fraud or cyberattack; and (l) the nature of virtual assets means that technological difficulties experienced by an SFC-licensed platform may prevent clients from dealing in their virtual assets. 6.10A For licensed corporations or registered institutions which provide Relevant Stablecoin￾only dealing services to specific clients and the accounts of such clients are clearly demarcated as Relevant Stablecoin-only client accounts, paragraph 6.10 above does not apply to their provision of Relevant Stablecoin-only dealing services to Relevant Stablecoin-only clients. 6.11 A licensed corporation or registered institution should also disclose the following information in relation to its Relevant VA Dealing Activities: (a) its services in relation to Relevant VA Dealing Activities are only available to professional investors (where applicable); (b) whether the licensed corporation or registered institution will be acting as principal or agent for the client; (c) the execution venue of transactions for a client (for example, whether the transaction will be executed on the platform of an SFC-licensed platform or off￾platform of an SFC-licensed platform) and the associated risks; (d) name and website of the execution venue through which client transactions are executed and settled; (e) list of virtual assets available for trading by its retail clients (where applicable); (f) relevant information of the virtual assets available for trading11 or inform clients where such information could be accessed, such as the website of the SFC￾licensed platform or the HKMA-licensed stablecoin issuer of the Relevant Stablecoin concerned (where applicable); (g) the licensed corporation or registered institution will only execute a trade for a client if there are sufficient fiat currencies or virtual assets in the client’s account to cover that trade (where applicable); and (h) trading hours and other trading and operational matters. Provision of contract notes, statements of account and receipts to clients 6.12 A licensed corporation or registered institution should provide to each client timely and 11 For Relevant Stablecoins, this would include material information on the stabilisation mechanism and redemption arrangement of the Relevant Stablecoin.

17 meaningful information about the transactions conducted with the client or on the client’s behalf, the client’s holdings and movements of client virtual assets and fiat currencies, and other activities in the client’s account. Where contract notes, statements of account and receipts are provided by a licensed corporation or registered institution to a client, the licensed corporation or registered institution should ensure that the information included in the contract notes, statements of account and receipts is fit for purpose, comprehensive and accurate in respect of the particular type of virtual asset involved. Contract notes (a) Where a licensed corporation or registered institution enters into a relevant contract with or onbehalf of a client, it must prepare and provide a contract note to the client no later than the end of the second business day after entering into the relevant contract. The term “relevant contract” means a contract, entered into by a licensed corporation or registered institution with or on behalf of a client in the conduct of its businesses which constitute any Relevant VA Dealing Activities, that is a contract for dealing in virtual assets. (b) Where a licensed corporation or registered institution enters into more than one relevant contract with or on behalf of a client on the same day, unless the client has given contrary instructions to the licensed corporation or registered institution, the licensed corporation or registered institution may prepare a single contract note which: (i) records all of those relevant contracts; and (ii) in respect of each of those relevant contracts, includes all of the information which would have been required to be included in the contract note. (c) If such a single contract note is prepared, the licensed corporation or registered institution should provide it to the client no later than the end of the second business day after entering into those relevant contracts. (d) A contract note should include, to the extent applicable, the following information: (i) the name under which the licensed corporation or registered institution carries on business; (ii) the name and account number of the client; (iii) full particulars of the relevant contract including: (1) the quantity, name, description and such other particulars of the virtual asset involved, as are sufficient to enable it to be identified; (2) the nature of the dealing; (3) where the licensed corporation or registered institution is acting as principal or as agent, an indication that it is so acting; (4) the date (i) on which the relevant contract is entered into; (ii) of

18 settlement or performance of the relevant contract; and (iii) on which the contract note is prepared; (5) the name of the execution venue on which the relevant contract has been executed; (6) the price per unit of the virtual asset traded; (7) the rate or amount of commission payable in connection with the relevant contract; (8) the rate or amount of fees and charges payable in connection with the relevant contract; (9) an indication that the client’s account is a margin account; and (10) the amount of consideration payable under the relevant contract. (e) Where a licensed corporation or registered institution has entered into a relevant contract with or on behalf of a client, it may, at the request of the client, include in the contract note in respect of the relevant contract, the average price per unit for the purchase or sale (as the case may be) of the same description of virtual assets, rather than the price per unit as referred to in subparagraph (d)(iii)(6) above. (f) A licensed corporation or registered institution may, instead of preparing and providing to a client one or more than one contract note under subparagraph (a) above in respect of one or more than one relevant contract entered into on the same day, consolidate the contract note with any statement of account it is required to prepare and provide to the client under sections 8 or 9 (or any consolidation of such statements of account under section 10) of the Securities and Futures (Contract Notes, Statements of Account and Receipts) Rules (Cap. 571Q) in respect of the same day. Daily statements of account relating to financial accommodation (fa) where a licensed corporation or registered institution provides financial accommodation to a client and any event specified in paragraph (iii) below takes place, it must prepare and provide a statement of account to the client no later than the end of the second business day after the event takes place, or in the case of an event specified in paragraph (iii)(1)(iii) or (2)(iii), after the licensed corporation or registered institution becomes aware that the event has taken place. (fb) A statement of account should include, to the extent applicable, the following information (i) Information required in all statements of account, including: (1) the name under which the licensed corporation or registered institution carries on business; (2) the name, address and account number of the client to whom the

19 licensed corporation or registered institution is required to provide the statement of account; (3) the date on which the statement of account is prepared; and (4) where client assets of the client to whom the licensed corporation or registered institution is required to provide the statement of account are held for the account of the client by an associated entity (other than an authorized financial institution) of the licensed corporation or registered institution, the name under which the associated entity carries on business. (ii) information relating to the account of the client on the day on which the event takes place, including: (1) the outstanding balance of that account as at the beginning and as at the end of that day and details of all movements in the balance of that account during that day; (2) the quantity, and, in so far as readily ascertainable, the market price and market value of each description of client virtual assets held for that account as at the end of that day; (3) the margin ratio and margin value of each description of virtual assets collateral held for that account as at the end of that day; (4) details of all movements of client virtual assets held for that account during that day, including the quantity of each description of client virtual assets deposited in or withdrawn from that account during that day; (5) details of all disposals initiated by the licensed corporation or registered institution of client virtual assets held for that account during that day and what happened to the proceeds of those disposals; (6) details of all income credited to and charges levied against that account during that day; and (7) details of all financial accommodation provided to the client during that day, including the nature, credit limit and expiry date of the accommodation and the basis for calculation of interest charges thereon. (iii) The following events are specified for the purpose of (fa) and (fb) (ii) — (1) a deposit of client assets with (i) the licensed corporation or registered institution; (ii) an associated entity of the licensed corporation or registered institution; or (iii)any other person; (2) a withdrawal of client assets from (i) the licensed corporation or registered institution; (ii)an associated entity of the licensed corporation or registered institution; or (iii)any other person;

20 (3) a disposal initiated by the licensed corporation or registered institution of any client virtual assets held for the account of the client; or (4) an adjustment by the licensed corporation or registered institution to the account of the client comprising (i) an adjustment of the amount of financial accommodation; (ii) a credit to the account, except as a result of accrual of interest paid by the licensed corporation or registered institution or an associated entity of the licensed corporation or registered institution; or (iii) debit from the account, except as a result of accrual of interest charged by the licensed corporation or registered institution or an associated entity of the licensed corporation or registered institution. Monthly statements of account (g) Where any of the following circumstances applies, a licensed corporation or registered institution should prepare and provide a monthly statement of account to its client no later than the end of the seventh business day after the end of the monthly accounting period: (i) during a monthly accounting period, the licensed corporation or registered institution is required to prepare and provide to the client a contract note or receipt; (ii) at any time during a monthly accounting period, the client has an account balance which is not nil; or (iii) at any time during a monthly accounting period, any client virtual assets are held for the account of the client. (h) Where a licensed corporation or registered institution is required to prepare a monthly statement of account, it should include the following information: (i) the name under which the licensed corporation or registered institution carries on business; (ii) the name, address and account number of the client to whom the licensed corporation or registered institution is required to provide the statement of account; and (iii) the date on which the statement of account is prepared. (i) A licensed corporation or registered institution should also include, to the extent applicable, the following information in the monthly statement of account: (i) the address of the licensed corporation or registered institution’s principal place of business in Hong Kong;

21 (ii) the outstanding balance of that account as at the beginning and the end of that monthly accounting period and details of all movements in the balance of that account during that period; (iii) details of all relevant contracts entered into by the licensed corporation or registered institution with or on behalf of the client during that monthly accounting period, indicating those initiated by thelicensed corporation or registered institution; (iv) details of all movements during that monthly accounting period of any client virtual assets held for that account; (v) details of the provision of services in Relevant VA Staking Activities relating to client virtual assets held for that account; (vi) the quantity and, in so far as readily ascertainable, the market price and market value of each client virtual asset held for that account as at the end of that monthly accounting period; and (vii) the margin ratio and margin value of each description of virtual asset collateral held for that account as at the end of the monthly accounting period; (viii) the amount of margin excess or margin shortfall in that account as at the end of that monthly accounting period; (ix) an indication that it is a margin account; and (x) details of all income credited to and charges levied against that account during that monthly accounting period. Duty to provide statements of account upon request (j) Where a licensed corporation or registered institution receives a request from a client for a statement of account as of the date of the request, it should: (i) prepare a statement of account in respect of the client which includes the information required for all statements of account (see subparagraph (h) above) and, to the extent applicable, the following information relating to the account of the client as of the date of the request: (1) the outstanding balance of that account; (2) the quantity and, in so far as readily ascertainable, the market price and market value of each client virtual asset, held for that account (including client virtual assets for which services in Relevant VA Staking Activities are provided); (3) the margin ratio and margin value of each description of virtual asset collateral held for that account; (4) the amount of margin excess or margin shortfall in that account as at the end of that day; and

22 (ii) provide the statement of account to the client as soon as practicable after the date of the request. Receipts (k) On each occasion that a licensed corporation receives any client assets or a registered institution receives any client virtual assets from or on behalf of a client, the licensed corporation or the registered institution should prepare and provide a receipt to the client no later than the end of the second business day after receiving the client money and/or client virtual assets. (l) The requirement under subparagraph (k) is not applicable under the following circumstances: (i) where the client money is deposited directly into the bank account of a licensed corporation by the client or on behalf of the client by any person other than the licensed corporation; or (ii) where a contract note or other trade document provided to the client expressly states that it also serves as a receipt and includes the information specified in subparagraph (m) below. (m) A licensed corporation or registered institution should include the following information in thereceipt: (i) the name under which the licensed corporation or registered institution carries on business; (ii) the date on which the receipt is prepared; (iii) the name and account number of the client; and (iv) in respect of the client money and/or client virtual assets received: (1) the amount of client money and/or client virtual assets received; (2) the account into which the client money and/or client virtual assets has been deposited; and (3) the date on which the client money and/or client virtual assets was received. Miscellaneous (n) Where a licensed corporation or registered institution receives a request from a client for a copy of any contract note, statement of account or receipt that the licensed corporation or registered institution was required to provide to the client, the licensed corporation or registered institution should, as soon as practicable after receiving the request, provide the copy to the client. A licensed corporation or registered institution may impose a reasonable charge for a copy of the document provided by it under this paragraph.

23 (o) If, on an application made by a client, the SFC so directs, a licensed corporation or registered institution should make available for inspection by the client during the ordinary business hours of the licensed corporation or registered institution a copy of any contract notes, statements of account or receipts, except for those dated after the expiration of the period for which the licensed corporation or registered institution is required to retain them. (p) Where a licensed corporation or registered institution is required to prepare any contract notes, statements of account or receipts, the licensed corporation or registered institution should prepare them in the Chinese or English language as preferred by the client to whom they are intended to be provided. (q) Any contract notes, statements of account or receipts (or any copies of any such documents) required to be provided to a client should for all purposes be regarded as duly provided to the client if they are served on: (i) the client; or (ii) any other person (except an officer or employee of the licensed corporation or registered institution which is required to provide the documents to the client) designated by the client for the purposesof this subparagraph by notice in writing to the licensed corporation or registered institution which is required to provide the documents to the client, and it is: (I) delivered to the person by hand; (II) left at (where applicable), or sent by post to the person’s address; (III) sent by facsimile transmission to the person’s last known facsimile number; (IV) sent by electronic mail transmission to the person’s last known electronic mail address; or (V) provided to the person by access through the licensed corporation or registered institution’s website12 . 6.13 Where a client of a licensed corporation or registered institution is a professional investor within the meaning of: (a) any of paragraphs (a) to (i) of the definition of professional investor in section 1 of Part 1 of Schedule 1 to the SFO, and the licensed corporation or registered institution has notified the client in writing that unless the client objects, it will not provide to the client any contract notes, statements of account or receipts (as the case may be) in accordance with paragraph 6.12 above and it has not received any objection from the client; or (b) paragraph (j) of the definition of professional investor in section 1 of Part 1 of Schedule 1 to the SFO and has agreed in writing with the licensed corporation or 12 Due regard should be paid to the SFC’s circular dated 29 September 2020 on Provision of Trade Documents to Clients by Access through Intermediaries’ Websites.

24 registered institution not to receive from it any contract notes, statements of account or receipts (as the case may be) in accordance with paragraph 6.12 above; then paragraph 6.12 (except for subparagraphs (j), and (p) to (q)) does not apply to the licensed corporation or registered institution in relation to the client. VII. Custody of client assets Client virtual assets 7.1 A licensed corporation or registered institution should properly handle and safeguard client virtual assets. In particular, the licensed corporation or registered institution should, amongst others, comply with the following when conducting Relevant VA Dealing Activities, Relevant VA Staking Activities or VA financing: (a) Receive client virtual assets through and hold these client virtual assets on trust for its clients in segregated account(s)13 established and maintained with: (i) an SFC-licensed platform; or (ii) an authorized financial institution (or a subsidiary of a locally incorporated authorized financial institution) which meets the expected standards of virtual asset custody issued by the HKMA from time to time; or (iii) the HKMA-licensed stablecoin issuer of the Relevant Stablecoin concerned (where applicable) (referred to as “VA Segregated Account”). (b) Subject to paragraphs 4.4 and 7.1(c), the licensed corporation or registered institution should ensure all withdrawal or transfer of client virtual assets are made to the client directly from the VA Segregated Account(s). (c) Subject to paragraph 4.4, the licensed corporation or registered institution should not deposit, transfer, lend, pledge, repledge or otherwise deal with or create any encumbrance over client virtual assets except for (i) the settlement of transactions, and fees and charges owed by the client to the licensed corporation or registered institution in respect of the Relevant VA Dealing Activities, the Relevant VA Staking Activities and VA financing carried out by the licensed corporation or registered institution on behalf of the client or in accordance with the client’s standing authorities (see paragraph 7.7 below) (ii) taking virtual asset collateral as a secured creditor in relation to VA financing, or (iii) one-off written directions. (d) No client virtual assets should be paid or permitted to be paid to: (i) any officers or employees of the licensed corporation or registered institution; or 13 The account designated as a collateral account for holding virtual asset collateral should be separate from the account designated as client account for holding other client virtual assets.

25 (ii) any officers or employees of any corporations with which the licensed corporation or registered institution is in a controlling entity relationship, unless that officer or employee is the client of the licensed corporation or registered institution from whom or on whose behalf such client virtual asset has been received or is being held. (e) Ensure that receipt and withdrawal of client virtual assets are conducted through a wallet address which belongs to the client, unless where the licensed corporation or registered institution has implemented adequate and effective policies and procedures in relation to third party deposits and payments in compliance with the relevant requirements14 . (f) Access to the control of the movement of client virtual assets (including to the control of “staked” client virtual assets) should be tightly restricted to authorized personnel of the licensed corporation or registered institution to guard against losses arising from theft, fraud or other dishonest acts, professional misconduct or omissions. Client money 7.2 A licensed corporation should properly handle and safeguard client money. In particular, a licensed corporation should, amongst others, comply with the following when conducting Relevant VA Dealing Activities: (a) Establish one or more segregated bank accounts for holding client money received by it. Such segregated bank accounts should be established and maintained with an authorized financial institution in Hong Kong or another bank in another jurisdiction as agreed by the SFC from time to time. (b) Within one business day after a licensed corporation receives any client money: (i) pay it into a segregated bank account maintained with an authorized financial institution in Hong Kong; (ii) pay it into a segregated bank account maintained with another bank in another jurisdiction as agreed by the SFC from time to time if the client money is received outside Hong Kong; (iii) pay it to the client from whom or on whose behalf it has been received; or (iv) pay it in accordance with the client’s standing authority (see paragraph 7.7 below) or one-off written direction. (c) No client money should be paid or permitted to be paid to: (i) any officers or employees of the licensed corporation; or 14 Relevant requirements on third-party deposits and payments are set out in paragraphs 5.18 to 5.20, Chapter 11 and paragraph 12.10 of the Guideline on Anti-Money Laundering and Counter Financing of Terrorism (For Licensed Corporations and SFC-licensed Virtual Asset Service Providers.

26 (ii) any officers or employees of any corporations with which the licensed corporation is in a controlling entity relationship, unless that officer or employee is the client of the licensed corporation from whom or on whose behalf such client money has been received or is being held. (d) No client money should be paid out of a segregated bank account other than for: (i) paying the client on whose behalf it is being held; (ii) meeting the client’s settlement obligations or margin requirements in respect of Relevant VA Dealing Activities and VA financing carried out by the licensed corporation on behalf of the client, being the client on whose behalf it is being held; (iii) paying money that the client, being the client on whose behalf it is being held, owes to the licensed corporation in respect of the conduct of Relevant VA Dealing Activities and VA financing; or (iv) paying in accordance with the client’s standing authorities (see paragraph 7.7 below) or one-off written directions. 7.3 Subject to paragraph 7.4 below, any amount of interest derived from the holding of client money in a segregated bank account should be dealt with in accordance with paragraph 7.2 above. 7.4 A licensed corporation should ensure that any amount of interest retained in a segregated bank account which the licensed corporation is entitled to retain under an agreement in writing with a client of the licensed corporation, being the client on whose behalf the client money is being held, should be paid out of the account within one business day after: (a) the interest is credited to the account; or (b) the licensed corporation becomes aware that the interest has been credited to the account, whichever is later. 7.5 A licensed corporation which becomes aware that it is holding an amount of money in a segregated bank account that is not client money shall, within one business day of becoming so aware, pay that amount of money out of the segregated bank account. 7.6 A licensed corporation should use its best endeavours to match any unidentified receipts in its bank accounts (including segregated accounts) with all relevant information in order to establish the nature of any receipt and the identity of the person who has made it. (a) Upon ascertaining that a receipt represents client money, the amount should be transferred into a segregated bank account within one business day, even if it has not been able to identify which specific client has made the payment. (b) Where the receipt is not client money, within one business day of becoming so aware, that amount of money should be paid out of the segregated bank account. Standing authority to deal with client assets

27 7.7 A standing authority is a written instruction that is given to a licensed corporation or the registered institution which: (a) authorizes the licensed corporation or the registered institution to deal with client assets from time to time received from or on behalf of or held on behalf of the client, in one or more specified ways; (b) specifies a period not exceeding 12 months during which it is valid. This does not apply to a standing authority which is given to the licensed corporation or the registered institution by a client of the licensed corporation or the registered institution who is a professional investor; and (c) specifies the manner in which it may be revoked. 7.8 A standing authority which is not revoked prior to its expiry: (a) may be renewed for one or more further periods: (i) not exceeding 12 months, if the client of the licensed corporation or the registered institution who gave it is not a professional investor; or (ii) of any duration, if the client of the licensed corporation or the registered institution who gave it is a professional investor, at any one time, with the written consent of the client of the licensed corporation or the registered institution who gave it; or (b) shall be deemed to have been renewed if: (i) at least 14 days prior to the expiry of the standing authority, the licensed corporation or the registered institution to which it was given gives a written notice to the client of the licensed corporation or the registered institution who gave the standing authority, reminding the client of its impending expiry, and informing the client that unless the client objects, it will be renewed upon expiry upon the same terms and conditions as specified in the standing authority and for: (I) an equivalent period to that specified in the standing authority; (II) any period not exceeding 12 months specified by the licensed corporation or the registered institution, if the client of the licensed corporation or the registered institution is not a professional investor; or (III) a period of any duration specified by the licensed corporation or the registered institution, if the client of the licensed corporation or the registered institution is a professional investor; and (ii) the client does not object to the renewal of the standing authority before its expiry.

28 Where a standing authority is deemed to have been renewed in accordance with subparagraph (b), the licensed corporation or the registered institution shall give a written confirmation of the renewal of the standing authority to the client of the licensed corporation or the registered institution within one week after the date of expiry. Disclosure to clients 7.9 A licensed corporation or registered institution should fully disclose to its clients the custodial arrangements in relation to client assets held on their behalf, including the rights and obligations of each party and how client assets are stored. This should include: (a) for a licensed corporation or registered institution, client virtual assets may not enjoy the same protection as that conferred on “client securities” and “securities collateral” under the SFO and the Securities and Futures (Client Securities) Rules (Cap. 571H); (b) for a licensed corporation, client money may not enjoy the same protection as that conferred on “client money” under the SFO and the Securities and Futures (Client Money) Rules (Cap. 571I); (c) how the licensed corporation or registered institution will compensate its clients in the event of hacking or any other losses of client virtual assets caused by the default of the operator(s) of the VA Segregated Account(s); and (d) the treatment of client virtual assets kept in the VA Segregated Account(s) and their respective rights and entitlements when events such as, but not limited to, voting, hard forks and airdrops occur. Upon becoming aware of such events, a licensed corporation or registered institution should notify its clients as soon as practicable. VIII. Staking 8.1 A licensed corporation or registered institution should only provide services in Relevant VA Staking Activities to persons which are, and remain at all times, its clients. 8.2 A licensed corporation or registered institution should only engage in staking on behalf of its clients through an SFC-licensed platform or an authorized financial institution (or a subsidiary of a locally incorporated authorized financial institution) (referred to as the “Staking Service Provider”). 8.3 A licensed corporation or registered institution should ensure that the Staking Service Provider has obtained the necessary regulatory approval from the SFC or discuss with the HKMA (as the case may be) before providing services in Relevant VA Staking Activities. 8.4 A licensed corporation or registered institution should, in relation to the provision of services in Relevant VA Staking Activities, establish and maintain relevant operational rules and procedures for responding to any events that may negatively impact “staked” client virtual assets (including the initiation of withdrawals from the staking contract as appropriate).

29 8.5 A licensed corporation or registered institution should only provide services in Relevant VA Staking Activities in accordance with the client’s standing authority (see paragraph 7.7 above) or one-off written direction. Both prior to the initiation of the staking process and promptly after the completion of the staking process, the licensed corporation or registered institution should confirm with its clients the relevant terms (such as the name of the virtual asset to be staked, amount or value of the virtual asset to be staked, and the fees and charges to be borne by the client). 8.6 Where a licensed corporation or registered institution plans to cease or suspend provision of services in Relevant VA Staking Activities, its decision to terminate the provision of such staking services should take due account of the best interests of its clients. It should make adequate disclosure of all relevant material information in relation to the termination of the services to all its clients in an appropriate and timely manner. Note: Such information should include without limitation termination decisions, options available (for example, unstaking) and material changes in circumstances arising during the termination process. 8.7 A licensed corporation or registered institution should, at a minimum, make the following information regarding its provision of services in Relevant VA Staking Activities available to its clients: (a) specific virtual asset(s) for which such services are provided and any third parties involved in the provision of such services (such as the Staking Service Provider and third party validators); (b) the risks that clients may be exposed to in using such services, including the types and nature of additional risks that the “staked” client virtual assets may be subject to (for example, slashing risk, lock up risk due to delayed unstaking processes, blockchain protocol staking related technical error / bug risk, hacking risk and inactivity risk relating to the validators, and the legal uncertainty relating to staking which may affect the nature and enforceability of a client’s interest in client virtual assets which have been staked); (c) requirements for participation, types of returns offered, sources of returns, method of calculation of the returns, staking amount limitations, return limitations, timing relating to the returns, minimum lock up periods, unstaking process and length; (d) fees and charges for the provision of such services (for example, including those as agreed between itself and the Staking Service Provider) and the method of calculation of the fees and charges; and (e) manner in which losses relating to the risks identified in subparagraph (b) above will be dealt with (such as compensation arrangements (if any) for slashing incidents). 8.8 Except for dealing with institutional and qualified corporate professional investors, prior to providing services in Relevant VA Staking Activities to its clients, a licensed corporation or registered institution should obtain an acknowledgement executed by the client confirming that the client understands the risks involved in using such services including the risks specified in paragraph 8.7(b) above.

30 IX. Record keeping 9.1 A licensed corporation or registered institution should establish policies and procedures to ensure the integrity, security, availability, reliability and completeness of all information, both in physical and electronically stored form, in relation to Relevant VA Dealing Activities, Relevant VA Staking Activities and VA financing. 9.2 A licensed corporation or registered institution should, in relation to its Relevant VA Dealing Activities, Relevant VA Staking Activities and VA financing: (a) keep, where applicable, such accounting, trading and other records as are sufficient to: (i) explain and reflect the financial position and operation of such businesses; (ii) enable profit and loss accounts and balance sheets which give a true and fair view of its financial affairs to be prepared from time to time; (iii) account for all client virtual assets and client money it receives or holds in relation to its Relevant VA Dealing Activities, Relevant VA Staking Activities and VA financing; (iv) enable all movements of such client virtual assets and client money it receives or holds in relation to its Relevant VA Dealing Activities, Relevant VA Staking Activities and VA financing to be traced through its accounting systems; (v) show separately and account for all receipts, payments, deliveries and other uses or applications of the client assets effected by it, or on its behalf, and on whose behalf such receipts, payments, deliveries or other uses or applications of the client assets have been effected; (vi) reconcile, on a daily basis, any differences in its balances or positions with other persons, including banks and SFC-licensed platform(s) or HKMA￾licensed stablecoin issuer(s) of the Relevant Stablecoin(s) concerned (where applicable), and show how such differences were resolved; (vii) demonstrate compliance with, and that it has systems of control in place to ensure compliance with, Part VII (Custody of Client Assets) herein; and (viii) enable, in relation to a licensed corporation, it to readily establish whether it has complied with the Securities and Futures (Financial Resources) Rules and other financial resources requirements in Part III (Financial Soundness); (b) keep those records in such a manner as will enable an audit to be conveniently and properly carried out; and (c) make entries in those records in accordance with generally accepted accounting principles. The records required to be kept are specified in paragraph 9.6 below.

31 Form and premises in which records are to be kept 9.3 A licensed corporation or registered institution should keep all the required records: (a) in writing in the Chinese or English language; or (b) in such a manner as to enable them to be readily accessible and readily convertible into written form in the Chinese or English language. 9.4 A licensed corporation or registered institution should adopt all reasonably necessary procedures to guard against the falsification of any of the required records, to facilitate the discovery of any such falsification and to ensure the security, authenticity, reliability, integrity, confidentiality and timely availability of required records. 9.5 A licensed corporation should keep all the required records at the premises used by it which have been approved under section 130(1) of the SFO. A registered institution should keep all required records in accordance with the applicable requirements. Records to be kept 9.6 A licensed corporation or registered institution should retain the following records: (a) Records showing particulars of: (i) all money received by it, whether or not such money belongs to it, or is paid into accounts maintained by it or on its behalf, and disbursed by it; (ii) all income received by it, whether the income relates to charges made by it for the provision of services, commissions, brokerage, remuneration, interest or otherwise; (iii) all expenses, commissions and interest incurred or paid by it; (iv) all orders or instructions concerning client virtual assets that it receives or initiates, including particulars: (1) of the date and time that any order or instruction was received, executed, modified (including particulars of any subsequent modifications) or cancelled; (2) of each transaction entered into by it or on its behalf to implement any such order or instruction; (3) identifying with whom or for whose account it has entered into such transaction; and (4) that enable such transaction to be traced through its accounting, trading and settlement systems; (v) all disposals of client virtual assets initiated by it, showing in the case of each disposal:

32 (1) the name of the client; (2) the date on which the disposal was effected; (3) the name of the execution venue which effected the disposal; (4) the charges incurred for effecting the disposal; and (5) the proceeds of the disposal and how such proceeds were dealt with; (vi) its assets and liabilities, including financial commitments and contingent liabilities; (vii) all virtual assets belonging to it, identifying: (1) with whom such virtual assets are deposited; and (2) the date on which they were so deposited; (viii) all virtual assets held by it but not belonging to it, identifying: (1) for whom such virtual assets are held and with whom they are deposited, ie, the relevant operator of the VA Segregated Account(s); and (2) the date on which they were so deposited; (ix) all bank accounts held by it, including segregated accountsmaintained; (x) all other accounts held by it; (xi) all off-balance sheet transactions or positions; and (xii) in relation to Relevant VA Staking Activities, all “staked” client virtual assets held by it but not belonging to it, information identifying for whom such “staked” client virtual assets are held, the relevant VA segregated account associated with such “staked” client virtual assets, the date on which they were staked and unstaked, and the returns associated with such “staked” client virtual assets; (xiii) in relation to VA financing: (1) its margin policy; (2) all virtual assets and client virtual asset collateral deposited with another person under an arrangement that confers on it a collateral interest in the virtual assets or client virtual asset collateral; (3) with whom and on whose behalf the virtual assets or client virtual asset collateral referred in (2) are deposited, showing separately the quantity and market value of:

33 (I) virtual assets deposited for safe custody; and (II) virtual assets and client virtual asset collateral deposited as security for, or to facilitate, the provision by it of VA financing or other financial accommodation (as the case may be), and (4) particulars of clients to whom it provides VA financing or other financial accommodation (as the case may be), including particulars in respect of each client showing— (I) the market value and margin value of each description of virtual asset collateral deposited with it; (II) the aggregate of the market values of such virtual asset collateral; (III) the aggregate of the margin values of such virtual asset collateral; and (IV) details of margin calls made. For the purpose of paragraph 9.6(a)(xiii)(2) and (3), “client virtual asset collateral” means (a) virtual asset collateral and (b) other collateral as defined under Part 1 of Schedule 1 of the SFO. (b) Records of all contracts (including written agreements with clients) entered into by it; (c) Records evidencing: (i) any standing authority given to it by a client and any renewal of such authority; and (ii) any one-off written directions given to it by a client; (d) Records of knowing your clients, including the process and outcomes of any risk profiling; (e) Records of suitability assessments conducted; (f) In respect of a client who is a professional investor any notice given by it to the client or agreement by the client with it referred to in paragraph 6.13 above; (g) A copy of each monthly statement of account prepared in accordance with Part VI (Dealing with Clients) above; (h) Records of all client complaints relating to client virtual assets and client money it receives or holds in relation to the Relevant VA Dealing Activities, the Relevant VA Staking Activities and VA financing and details of follow-up action, including the substance and resolution of each complaint;

34 (i) Records regarding client identity for confirmation of the origination of the instructions and the beneficiaries and details of the instructions as prescribed in paragraph 6.7 above; and (j) To the extent not already covered elsewhere in this paragraph, records evidencing the licensed corporation or registered institution’s compliance with these Terms and conditions. 9.7 A licensed corporation or registered institution should retain the records required under paragraph 9.6 (except for records required to be kept under paragraph 9.6(a)(iv)) for a period of not less than seven years. 9.8 A licensed corporation or registered institution should retain the following for a period of not less than two years: (a) a copy of each contract note and receipt prepared in accordance with Part VI (Dealing with Clients) above; (b) a copy of each statement of account prepared upon the client’s request in accordance with paragraph 6.12(j) above; and (c) records required to be kept under paragraph 9.6(a)(iv) above. X. Auditors 10.1 A licensed corporation should prepare and submit an auditor’s report in respect of a financial year which contains, in addition to other information required under the laws, a statement by the auditor as to whether, in the auditor’s opinion: (a) during the financial year in question, the licensed corporation had systems of control in place which were adequate to ensure compliance with Part VII (Custody of Client Assets) above; (b) during the financial year in question, the licensed corporation complied with Part VII (Custody of Client Assets) and Part IX (Record Keeping) above. XI. Conflicts of interest 11.1 A licensed corporation or registered institution should not engage in virtual asset market making activities on an execution venue such as an SFC-licensed platform through which it provides to its clients services in Relevant VA Dealing Activities. XII. Ongoing reporting obligations 12.1 A licensed corporation or registered institution should report to the SFC (and the HKMA in the case of a registered institution) as soon as practicable upon the happening of any actual or suspected material non-compliance with these Terms and conditions. 12.2 A licensed corporation or registered institution should provide any information in relation to its Relevant VA Dealing Activities, its Relevant VA Staking Activities and its VA financing as may be requested by the SFC (and the HKMA in the case of a registered institution) from time to time. The SFC (and the HKMA in the case of a

35 registered institution) may request information on a periodic or ad hoc basis.

36 Schedule 1 – Existing regulatory requirements applicable to a licensed corporation or registered institution providing virtual asset dealing services under an omnibus account arrangement Relevant codes (1) The Code of Conduct, except for the following paragraphs which are not relevant or have been modified and incorporated in these Terms and conditions: ▪ Paragraph 5.1A (Know your client: investor characterization) ▪ Paragraph 5.3 (Know your client: derivative products) ▪ Paragraph 5.4 (Client identity: origination of instructions and beneficiaries) ▪ Paragraph 16 (Analysts) ▪ Paragraph 17 (Sponsors) ▪ Paragraph 19 (Alternative liquidity pools) ▪ Paragraph 20 (Dealing with group affiliates and other connected persons) ▪ Paragraph 21 (Bookbuilding and placing activities in equity capital market and debt capital market transactions) ▪ Schedule 3 (Additional requirements for licensed or registered persons dealing in securities listed or traded on The Stock Exchange of Hong Kong Limited) ▪ Schedule 4 (Additional requirements for licensed or registered persons dealing in futures contracts and/or options contracts traded on Hong Kong Futures Exchange Limited) ▪ Schedule 6 (Additional requirements for licensed persons engaging in leveraged foreign exchange trading) ▪ Schedule 8 (Additional requirements for licensed or registered persons operating alternative liquidity pools) ▪ Schedule 10 (Risk mitigation requirements and margin requirements in relation to non-centrally cleared OTC derivative transactions)

37 Relevant guidelines (2) Guidelines on Online Distribution and Advisory Platforms (3) Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations and SFC-licensed Virtual Asset Service Providers) and Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Authorized Institutions) (as applicable) (4) Guidelines for Reducing and Mitigating Hacking Risks Associated with Internet Trading (5) Management, Supervision and Internal Control Guidelines for Persons Licensed by or Registered with the Securities and Futures Commission (6) Fit and Proper Guidelines (7) Guidelines on Competence (8) Guidelines on Continuous Professional Training (9) Guidelines for Securities Margin Financing Activities

38 Part II – Virtual asset advisory services Licensing or registration conditions for licensed corporations or registered institutions providing virtual asset advisory services (a) (i) [For licensee or registered institution which provides services to retail investors and/ or professional investors] With respect to providing virtual asset advisory services, the licensee or registered institution shall only provide such services to persons which are, and remain at all times, clients of the licensed corporation or registered institution in respect of its business in Type 4 regulated activity (advising on securities), except where the registered institution provides virtual asset advisory services only in specified stablecoins the issue of which is authorised by a licence granted under the Stablecoins Ordinance (SO) (Relevant Stablecoin) to its clients, such clients need not be its clients in respect of its business in Type 4 regulated activity (advising on securities). The term “advising on securities” is specified in Part 2 of Schedule 5 to the Securities and Futures Ordinance. The term “virtual asset” is defined in section 53ZRA of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance. The term “specified stablecoin” has the meaning given by section 4 of the SO. (ii) [For licensee or registered institution which only provides services to professional investors] With respect to providing virtual asset advisory services, the licensee or registered institution shall only provide such services to professional investors which are, and remain at all times, clients of the licensed corporation or registered institution in respect of its business in Type 4 regulated activity (advising on securities), except where the registered institution provides virtual asset advisory services only in specified stablecoins the issue of which is authorised by a licence granted under the Stablecoins Ordinance (SO) (Relevant Stablecoin) to its clients, such clients need not be its clients in respect of its business in Type 4 regulated activity (advising on securities). The term “professional investor” is defined in section 1 of Part 1 of Schedule 1 to the Securities and Futures Ordinance (SFO) together with the Securities and Futures (Professional Investor) Rules. The term “advising on securities” is specified in Part 2 of Schedule 5 to the SFO. The term “virtual asset” is defined in section 53ZRA of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance. The term “specified stablecoin” has the meaning given by section 4 of the SO. (b) With respect to providing virtual asset advisory services, the licensee or registered institution shall comply with the attached “Terms and conditions for licensed corporations or registered institutions providing virtual asset advisory services” (as amended from time to time). The term “virtual asset” is defined in section 53ZRA of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance.

39 Terms and conditions for licensed corporations or registered Institutions providing virtual asset advisory services I. Interpretation A reference in these Terms and conditions for licensed corporations or registered Institutions providing virtual asset advisory services (Terms and conditions) to: ▪ “AMLO” means the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615); ▪ “client” means a person to whom a licensed corporation or registered institution provides virtual asset advisory services; ▪ “Code of Conduct” means the Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission; ▪ “HKMA-licensed stablecoin issuer” means a stablecoin issuer which is licensed by the Hong Kong Monetary Authority (HKMA) under section 15 of the SO; ▪ “licensed corporation” means a corporation which is licensed by the Securities and Futures Commission (SFC) and upon which these Terms and conditions are imposed by way of a licensing condition pursuant to section 116 of the SFO; ▪ “professional investor” has the meaning as defined in section 1 of Part 1 of Schedule 1 to the SFO; ▪ “registered institution” means an authorized financial institution which is registered under section 119 of the SFO; ▪ “Relevant Stablecoin” means a specified stablecoin the issue of which is authorised by a licence granted under the SO; ▪ “retail client” or “retail investor” means any person other than a professional investor; ▪ “Relevant VA Advisory Activities” means any virtual asset advisory services provided by the licensed corporation or registered institution to its clients; ▪ “SFO” means the Securities and Futures Ordinance (Cap. 571); ▪ “SFC-licensed platform” means a virtual asset trading platform operator which is licensed by the SFC pursuant to section 116 of the SFO and/or section 53ZRK of the AMLO; ▪ “SO” means the Stablecoins Ordinance (Cap. 656); ▪ “specified stablecoin” has the meaning given by section 4 of the SO; and ▪ “virtual asset” means any “virtual asset” as defined in section 53ZRA of the AMLO.

40 II. Codes and guidelines 2.1 In conducting its Relevant VA Advisory Activities, to the extent not already covered elsewhere in these Terms and conditions, a licensed corporation or registered institution is expected to observe the requirements of the codes and guidelines (as supplemented by the circulars and FAQs issued from time to time and, in particular, the suitability requirement under paragraph 5.2 of the Code of Conduct) published by the SFC as if: (i) any reference to a financial product (for example, securities) or investment product included virtual assets; (ii) any reference to a client included a person to whom the licensed corporation or registered institution provides services in Relevant VA Advisory Activities; and (iii) any reference to regulated activities included Relevant VA Advisory Activities. III. Virtual asset-knowledge test and suitability 3.1 Except for institutional and qualified corporate professional investors15, a licensed corporation or registered institution should assess a client’s knowledge of virtual assets (including knowledge of relevant risks associated with virtual assets) before providing any services to the client16 . 3.2 Where a client does not possess such knowledge, a licensed corporation or registered institution may only provide services in Relevant VA Advisory Activities to the client if the licensed corporation or registered institution has provided adequate training to the client. 3.2A For licensed corporations or registered institutions which provide services in Relevant VA Advisory Activities only in Relevant Stablecoins (Relevant Stablecoin-only advisory services) to specific clients (Relevant Stablecoin-only clients) and the accounts of such clients are clearly demarcated as Relevant Stablecoin-only client accounts, paragraphs 3.1 and 3.2 above do not apply to their provision of Relevant Stablecoin-only advisory services to Relevant Stablecoin-only clients. 3.3 Except for institutional and qualified corporate professional investors, a licensed corporation or registered institution, before providing services in Relevant VA Advisory Activities, should assess a client’s risk tolerance level, accordingly determine the client’s risk profile and assess whether it is suitable for the client to participate in the trading of virtual assets. The licensed corporation or registered institution should exercise due skill, care and diligence to ensure the methodology for risk profiling is properly designed and should determine the client’s risk profile based on an assessment of the information about the client obtained through its know-your-client process. The methodology adopted for categorising clients and an explanation of the 15 Same definitions as in paragraph 15 of the Code of Conduct. “Qualified corporate professional investors” refers to corporate professional investors which have passed the assessment requirements under paragraph 15.3A and gone through the procedures under paragraph 15.3B of the Code of Conduct. 16 The following are some non-exhaustive criteria for assessing whether a client can be regarded as having knowledge of virtual assets: (i) whether the client has undergone training or attended courses on virtual assets; (ii) whether the client has current or previous work experience related to virtual assets; or (iii) whether the client has prior trading experience in virtual assets.

41 risk profiles of clients should be made available to the client17 . 3.3A For licensed corporations or registered institutions which provide Relevant Stablecoin￾only advisory services to specific clients and the accounts of such clients are clearly demarcated as Relevant Stablecoin-only client accounts, to discharge suitability obligations, licensed corporations or registered institutions should consider the Relevant Stablecoin-only client’s objective in the trading of Relevant Stablecoins (e.g. use case). Generally, Relevant Stablecoins may be made available to clients across different risk profiles. 3.3B A licensed corporation or registered institution should disclose the relevant material information on the stabilisation mechanism and redemption arrangement of the Relevant Stablecoin. 3.4 In conducting any Relevant VA Advisory Activities, a licensed corporation or registered institution should enter into a written client agreement with each client18 in the same manner as set out in paragraph 6 of the Code of Conduct and include a provision stating that: “…… if we [the licensed corporation or registered institution] solicit the sale of or recommend any product including any virtual assets to you [the client], the product must be reasonably suitable for you, having regard to your financial situation, investment experience and investment objectives. No other provision of this agreement or any other document we may ask you to sign and no statement we may ask you to make derogates from this clause.” 3.5 Where a licensed corporation or registered institution provides services in Relevant VA Advisory Activities to retail clients, the licensed corporation or registered institution should take all reasonable steps to ensure that the virtual asset recommended: (i) except where the virtual asset concerned is a Relevant Stablecoin, is of high liquidity. In assessing the liquidity of a specific virtual asset for trading by retail clients, the licensed corporation or registered institution should, at a minimum, ensure that the virtual asset is an eligible large-cap virtual asset, ie, the specific virtual asset should have been included in a minimum of two acceptable indices issued by at least two different index providers; and Note 1: An acceptable index refers to an index which has a clearly defined objective to measure the performance of the largest virtual assets in the global market, and should fulfil the following criteria: (a) The index should be investible, meaning the constituent virtual assets should be sufficiently liquid; (b) The index should be objectively calculated and rules-based; 17 Where risk-scoring questionnaires are used to risk profile clients, the licensed corporation or registered institution should pay particular attention to the design of the questions and the underlying scoring mechanism, which should be properly designed to accurately reflect the personal circumstances of a client. The licensed corporation or registered institution should also have appropriate processes in place to periodically review the risk profiling methodology and mechanism for clients. 18 Except for institutional and qualified corporate professional investors.

42 (c) The index provider should possess the necessary expertise and technical resources to construct, maintain and review the methodology and rules of the index; (d) The methodology and rules of the index should be well documented, consistent and transparent. Note 2: The two index providers should be separate and independent from each other, the issuer of the virtual asset (if applicable) and the licensed corporation or registered institution (for example, they are not within the same group of companies). Further, at least one of the indices should be issued by an index provider which complies with the IOSCO Principles for Financial Benchmarks and has experience in publishing indices for the conventional securities market. (ii) is made available by SFC-licensed platforms for trading by retail investors, or is a Relevant Stablecoin.