Managing ML/TF Risks Associated with Virtual Assets and Virtual Asset Service Providers

Our Ref.: B10/1C B1/15C 16 December 2019 The Chief Executive All Authorized Institutions Dear Sir/Madam, Managing ML/TF risks associated with virtual assets (VAs) and virtual asset service providers (VASPs) I am writing to provide guidance to Authorized Institutions (AIs) in relation to recent updates by the Financial Action Task Force (FATF) to its Recommendation 15, which clarify the businesses and activities that the FATF requirements apply in the case of VAs and VASPs1 . The FATF also published “Guidance for a Risk￾Based Approach – Virtual Assets and Virtual Asset Service Providers” (the FATF Guidance) in June 2019, which is intended to, among others, help private sector entities wishing to engage in VA activities to understand and comply with their AML/CFT obligations. The FATF Guidance can be found at: https://www.fatf-gafi.org/publications/fatfrecommendations/documents/guidance￾rba-virtual-assets.html. FATF member jurisdictions have put in place or are implementing regulatory regimes for VASPs in response to the international development2 . Therefore, increasingly there may be more VASPs which are licensed or registered in Hong Kong or other jurisdictions, and subject to AML/CFT regulation and supervision in line with the FATF Recommendations. Some VASPs may be in the process of applying for licensing or registration. Following the risk-based approach, when AIs establish and maintain business relationships with VASPs, appropriate risk assessments3 should be conducted to differentiate the risks of individual VASPs, recognising that there is no “one-size￾fits-all”. Depending on the nature of relationship, AIs may undertake additional

1 Please refer to the definitions of VAs and VASPs in the FATF Glossary. 2 For example, the Securities and Futures Commission has recently announced a framework allowing a VA trading platform operator to opt-in to its regulation. 3 The FATF Guidance provides examples of risk indicators that can be specifically considered in the VA context.

• 2 - customer due diligence measures 4 , including the collection of sufficient information to adequately understand the nature of the VASP’s business; determining from publicly available information whether the VASP are licensed or registered, and subject to AML/CFT supervision; and assessing the AML/CFT controls of the VASP as appropriate. The extent of customer due diligence measures should be commensurate with the assessed ML/TF risks of the VASP. Besides, globally there is an emerging range of new products and services involving VA. In line with the FATF standards, before an AI offers any new banking or investment products relating to VAs, it should undertake ML/TF risk assessment and take appropriate measures to manage and mitigate the identified risks in accordance with applicable legal and regulatory requirements including paragraph 2.11 of the Guideline on Anti-Money Laundering and Counter￾Financing of Terrorism (For Authorized Institutions). The HKMA will continue to participate in international discussions on this fast evolving subject matter and share updates of FATF’s work relating to VAs and VASPs with the banking sector from time to time. AIs should keep abreast of international and local developments to maintain an up-to-date understanding of risks, and apply a risk-based approach that supports responsible financial innovation as well as effective ML/TF risk management. This circular supersedes the letters on “Risks associated with virtual commodities” issued on 9 January and 30 April 2014 respectively. For questions relating to this circular, please send to aml@hkma.iclnet.hk . Yours faithfully, Carmen Chu Executive Director (Enforcement and AML)

4 Reference should be made to Chapter 11 of the Guideline on Anti-Money Laundering and Counter￾Financing of Terrorism (For Authorized Institutions) on “Correspondent Banking and Other Similar Relationships”.