SPM CRP-1: Update on Cryptoassets Classification Conditions

Supervisory Policy Manual CRP-1 Classification of Cryptoassets V.1 – 01.01.2026 This module should be read in conjunction with the Introduction and with the Glossary, which contains an explanation of abbreviations and other terms used in this Manual. If reading on-line, click on blue underlined headings to activate hyperlinks to the relevant module. ————————— Purpose To provide further guidance on the classification of cryptoassets for the purpose of their prudential treatment. Classification A non-statutory guideline issued by the MA as a guidance note Previous guidelines superseded This is a new guideline. Application Applicable to all AIs from 1 January 2026 Structure

1. Introduction 1.1 Background 1.2 Scope of application 1.3 Overview of cryptoasset classification 1.4 Implementation
2. Classification conditions for Group 1 cryptoassets 2.1 General 2.2 Classification condition 1 2.3 Classification condition 2 2.4 Classification condition 3 2.5 Classification condition 4

2 Supervisory Policy Manual CRP-1 Classification of Cryptoassets V.1 – 01.01.2026 2.6 Additional measures in relation to permissionless blockchains 3. Hedging recognition criteria for Group 2a cryptoassets Annex A: Abbreviations —————————

3 Supervisory Policy Manual CRP-1 Classification of Cryptoassets V.1 – 01.01.2026

1. Introduction 1.1 Background 1.1.1 The Basel Committee on Banking Supervision (“BCBS”) issued a standard titled “Prudential treatment of cryptoasset exposures” 1 in December 2022 and “Cryptoasset standard amendments” 2 in July 2024. These publications aim to provide a robust and prudent global regulatory framework for internationally active banks’ exposures to cryptoassets that promotes responsible innovation while preserving financial stability. 1.1.2 The HKMA implemented the prudential treatment for cryptoasset exposures (“cryptoassets standard”) closely aligned with the BCBS requirements mentioned in paragraph 1.1.1. The capital standards and the associated requirements on disclosure and exposure limits are set out in (i) the Banking (Capital) Rules (“BCR”), (ii) the Banking (Disclosure) Rules and (iii) the Banking (Exposure Limits) Rules respectively. 1.1.3 This module intends to provide guidance on the classification of cryptoassets for their prudential treatment. 1.1.4 The principles of regulatory classification conditions for cryptoassets and the approval requirements for the initial classification and the arrangements for subsequent reclassifications of a cryptoasset are set out in Part 12 of the BCR. AIs are advised to read this module in conjunction with the BCR. In case of any discrepancy between this module and the BCR, the BCR will prevail. 1.2 Scope of application 1.2.1 Under the cryptoassets standard, the term “cryptoasset” refers to an asset that: 1 http://www.bis.org/bcbs/publ/d545.htm 2 http://www.bis.org/bcbs/publ/d579.htm

4 Supervisory Policy Manual CRP-1 Classification of Cryptoassets V.1 – 01.01.2026  is a digital representation of value;  depends primarily on cryptography and distributed ledger technology (“DLT”) or similar technologies; and  can be used for payment or investment purposes or to access goods or services. 1.2.2 Dematerialised securities3 that are issued through DLT or similar technology are within the scope of the cryptoassets standard, whereas those dematerialised securities that only use electronic versions of traditional registers and databases which are centrally administered are not within the scope. 1.2.3 The prudential treatment of central bank digital currencies (“CBDCs”) is not covered by the cryptoassets standard. 4 1.3 Overview of cryptoasset classification 1.3.1 A cryptoasset is classified as a Group 1 cryptoasset if it fulfils the classification conditions 1, 2, 3 and 4 (see subsections 2.2 to 2.5), collectively referred to as the “classification conditions”. For cryptoassets running on permissionless blockchains, if they cannot meet certain requirements under the classification conditions solely due to the nature of the permissionless blockchain, they are still deemed to fulfil those requirements if they also meet the additional measures to mitigate key risks associated with permissionless blockchains (see subsection 2.6). If a cryptoasset is not classified as a Group 1 cryptoasset, it will be treated as a Group 2 cryptoasset. 1.3.2 Group 1 cryptoassets are further categorised into Group 1a (tokenised traditional assets) and Group 1b (stablecoins with effective stabilisation mechanisms). The capital requirements for Group 1 cryptoassets are based on the principle of “same activity, same risks, same regulation”, meaning that they are subject to the 3 Securities that have been moved from physical certificates to electronic book-keeping 4 In general, CBDCs should be treated as equivalent to the fiat currencies issued by the respective central banks, subject to the specific features and legal status of each CBDC.

5 Supervisory Policy Manual CRP-1 Classification of Cryptoassets V.1 – 01.01.2026 same capital, liquidity and other requirements as the traditional assets to which the cryptoassets relate. However, an infrastructure risk add-on5 may be imposed on these cryptoassets to capture any unforeseeable risks that may result from the technological infrastructure that underlies Group 1 cryptoassets. 1.3.3 Group 2 cryptoassets include all unbacked cryptoassets as well as any tokenised traditional assets and stablecoins that do not meet the classification conditions. Group 2 cryptoassets are subject to a more conservative capital treatment with full capitalisation. A set of hedging recognition criteria (see section 3) is applied to distinguish between those Group 2 cryptoassets for which a limited degree of hedging is recognised (Group 2a) and those for which hedging is not recognised (Group 2b)6 . 1.4 Implementation 5 The infrastructure risk add-on will initially be set at zero, which could be increased by the HKMA based on any potentially observed weaknesses in the infrastructure used by Group 1 cryptoassets. 6 In addition to direct exposures, (i) funds of Group 2b cryptoassets (e.g. Group 2b cryptoasset ETFs) and other entities, the material value of which is primarily derived from the value of Group 2b cryptoassets; and (ii) equity investments, derivatives or short positions in the above funds or entities would also be treated as Group 2b cryptoassets under the cryptoassets standard.

6 Supervisory Policy Manual CRP-1 Classification of Cryptoassets V.1 – 01.01.2026 1.4.1 The cryptoassets standard and this SPM module will take effect from 1 January 2026. 1.4.2 In relation to the regulatory classification of a cryptoasset exposure being held prior to 1 January 2026, an AI must classify it as a Group 2b cryptoasset until the HKMA has agreed to the cryptoasset’s classification assessment. 2. Classification conditions for Group 1 cryptoassets 2.1 General 2.1.1 AIs, on an ongoing basis, are responsible for assessing whether the cryptoassets to which they are exposed are compliant with the classification conditions set out in this section and the hedging recognition criteria set out in section 3. These assessments will determine whether the cryptoassets are classified as Group 1a, Group 1b, Group 2a or Group 2b. To this end, AIs must have in place the appropriate risk management policies, procedures, governance, human and IT capacities to evaluate the risks of engaging in cryptoassets and implement these accordingly on an ongoing basis and in accordance with established standards. AIs must fully document the information used in determining compliance with the classification conditions and make this available to the HKMA on request. 2.1.2 For any acquisition of a new type of cryptoasset7 , an AI must notify the HKMA and classify it as a Group 2b cryptoasset until the HKMA has agreed to the AI’s classification assessment (other than a Group 2b classification) of the cryptoasset. 2.1.3 If a cryptoasset is classified as Group 1a, Group 1b or Group 2a with the HKMA’s agreement and subsequently ceases to meet the relevant classification conditions or hedging recognition criteria, an AI must immediately reclassify the cryptoasset as a Group 2b cryptoasset 7 For example, if an AI had no exposure to Bitcoin before, the notification requirement applies when it acquires a spot position of Bitcoin or enters into a derivative contract with Bitcoin as the underlying asset. However, if the AI has already been exposed to a Bitcoin spot position, the notification requirement does not apply if it would like to enter into Bitcoin futures.

7 Supervisory Policy Manual CRP-1 Classification of Cryptoassets V.1 – 01.01.2026 until the cryptoasset once again meets the applicable classification conditions or hedging recognition criteria. 2.1.4 For subsequent acquisitions of a cryptoasset in any form, an AI must assign the cryptoasset to the same classification as its last classification assessment. 2.1.5 For a cryptoasset with the HKMA’s agreement for a Group 1a, Group 1b or Group 2a classification, any reclassification to a group other than Group 2b is also subject to the HKMA’s agreement. 2.1.6 In case the HKMA disagrees with the classification assessments undertaken by an AI, it will override the AI’s classification. 2.1.7 To ensure consistent application across jurisdictions, the HKMA will routinely compare and share its supervisory information on AIs’ assessments of cryptoassets against the classification conditions with regulators or supervisors in other jurisdictions. 2.1.8 The prudential treatment of an AI’s cryptoasset exposures varies according to the regulatory classification of the cryptoassets. To determine the regulatory classification, an AI must screen the cryptoassets on an ongoing basis and classify them into two broad groups:  Group 1 cryptoassets are cryptoassets that meet the classification conditions. Group 1 consists of: – Group 1a: tokenised traditional assets; and – Group 1b: cryptoassets with an effective stabilisation mechanism.  Group 2 cryptoassets are cryptoassets that fail to meet any of the classification conditions. It consists of: – Group 2a: cryptoassets (including tokenised traditional assets, stablecoins and unbacked cryptoassets) that meet the Group 2a hedging recognition criteria; and – Group 2b: all other cryptoassets (including tokenised traditional assets, stablecoins and unbacked cryptoassets) that fail to meet the

8 Supervisory Policy Manual CRP-1 Classification of Cryptoassets V.1 – 01.01.2026 Group 2a hedging recognition criteria. 2.1.9 To be classified as Group 1a or Group 1b, cryptoassets must meet on an ongoing basis the classification conditions. 2.1.10 To be classified as Group 2a, cryptoassets must meet on an ongoing basis the hedging recognition criteria set out in section 3. 2.1.11 Each AI is required to conduct only a single assessment for the classification conditions (and to take any additional measures to mitigate key risks associated with permissionless blockchains, where applicable) for the same type of tokenised traditional assets issued through the same platform, 8 using identical blockchain infrastructure and operational arrangements. Once the HKMA is satisfied with the AI’s assessment, all of the same type of tokenised traditional assets issued via that platform can be assigned based on that single assessment. However, AIs remain responsible for monitoring any material changes to the platform that could affect the ongoing compliance with the classification conditions (and the additional measures to mitigate key risks associated with permissionless blockchains, where applicable). 2.2 Classification condition 1 2.2.1 The cryptoasset is either: (i) a tokenised traditional asset; or (ii) has a stabilisation mechanism that is effective at all times in linking its value to a traditional asset or a pool of traditional assets (i.e. reference assets). 2.2.2 Tokenised traditional assets can only meet classification condition 1 if they satisfy all of the following requirements:  They are digital representations of traditional assets using cryptography, DLT or similar technology to record ownership. 8 For example, the Central Moneymarkets Unit (CMU)

9 Supervisory Policy Manual CRP-1 Classification of Cryptoassets V.1 – 01.01.2026  They pose the same level of credit and market risk as the traditional (non-tokenised) form of the asset. In practice, this means the following for tokenised traditional assets. – Bonds, loans, claims on banks (including in the form of deposits), equities and derivatives: the cryptoasset must confer the same level of legal rights as ownership of these traditional forms of financing (e.g. rights to cash flows, claims in insolvency, etc.). In addition, there must not be any features of the cryptoasset that could prevent obligations to the holder being paid in full when due as compared with a traditional (non￾tokenised) version of the asset. – Commodities: the cryptoasset must confer the same level of legal rights as traditional account￾based records of ownership of a physical commodity. – Cash held in custody: the cryptoasset must confer the same level of legal rights as cash held in custody. 2.2.3 Cryptoassets do not meet the condition set out in paragraph 2.2.2 if they:  need to be redeemed or converted into traditional assets first before they receive the same legal rights as direct ownership of traditional assets; or  involve additional counterparty credit risks relative to traditional assets through their specific construction. 2.2.4 Cryptoassets that have a stabilisation mechanism will only meet classification condition 1 if they satisfy all of the following requirements.  The cryptoasset is designed to be redeemable for a predefined amount of one or more reference assets (e.g. HKD 1 or 1 ounce of gold) or cash equivalent to the current market value of the reference assets. The value of the reference assets to which one unit of the cryptoasset is designed to be redeemable is referred to as the peg value.  The stabilisation mechanism aims to minimise

10 Supervisory Policy Manual CRP-1 Classification of Cryptoassets V.1 – 01.01.2026 fluctuations in the market value of the cryptoassets relative to the peg value. In order to satisfy the “effective at all times” condition, AIs must have a monitoring framework in place to verify that the stabilisation mechanism is functioning as intended.  The stabilisation mechanism enables risk management similar to the risk management of traditional assets, based on sufficient data or experience. For newly established cryptoassets, there may be insufficient data and/or practical experience to perform a detailed assessment of the stabilisation mechanism. AIs should document and make available to the HKMA on request the assessment they conducted and the evidence used to determine the effectiveness of the stabilisation mechanism, including the composition, valuation and frequency of valuation of the reserve assets and the quality of available data.  There exists sufficient information that AIs use to verify the ownership rights of the reserve assets upon which the stable value of the cryptoasset is dependent. In the case of underlying physical assets, AIs must verify that these assets are stored and managed appropriately. This monitoring framework must function regardless of the cryptoasset issuer. AIs may use the assessments of independent third parties for verification of ownership rights only if they are satisfied that the assessments are reliable.  The cryptoasset passes the redemption risk test set out in paragraph 2.2.5 and the issuer is supervised and regulated by a supervisor that applies prudential capital and liquidity requirements to the issuer.  AIs must perform due diligence to ensure that they have an adequate understanding, at acquisition and thereafter on a regular basis, of the stabilisation mechanism of the cryptoasset and of its effectiveness. As part of that due diligence, an AI must conduct statistical or other tests demonstrating that the cryptoasset maintains a stable relationship in comparison to its reference asset (basis risk test).

11 Supervisory Policy Manual CRP-1 Classification of Cryptoassets V.1 – 01.01.2026 AIs must make available to the HKMA, upon request, the methodology used and the results of such tests. 2.2.5 Paragraphs 2.2.6 to 2.2.9 set out the redemption risk test for Group 1b cryptoassets. The objective of this test is to ensure that the reserve assets are sufficient to enable the cryptoassets to be redeemable at all times for the peg value, including during periods of extreme stress. To pass the redemption risk test, an AI must ensure that the cryptoasset arrangement meets the following conditions. 2.2.6 Value and composition of reserve assets: the value of the reserve assets (net all non-cryptoasset claims on these assets) must at all times, including during periods of extreme stress, equal or exceed the aggregate peg value of all outstanding cryptoassets. If the reserve assets expose the holder to risk in addition to the risks arising from the reference assets, 9 the value of the reserve assets must sufficiently overcollateralise the redemption rights of all outstanding cryptoassets. The level of overcollateralisation must be sufficient to ensure that even after stressed losses are incurred on the reserve assets, their value exceeds the aggregate value of the peg of all outstanding cryptoassets. 2.2.7 Asset quality criteria for reserve assets for cryptoassets pegged to currencies: for cryptoassets that are pegged to one or more currencies, the following requirements must be met:  The reserve assets must be comprised of assets with minimal market and credit risk. The reserve assets should consist mainly of assets with short￾term maturities and high credit quality. In addition, the reserve assets must have a proven record of relative stability of market terms (e.g. low volatility of traded prices and spreads) even during stressed market conditions.  The assets shall be capable of being liquidated 9 For example, consider a cryptoasset that is redeemable for a given currency amount (i.e. the currency amount is the reference asset) but is backed by bonds denominated in the same currency (i.e. the bonds are the reserve asset). The reserve assets will give rise to credit, market and liquidity risks that may result in losses relative to the value of the reference asset.

12 Supervisory Policy Manual CRP-1 Classification of Cryptoassets V.1 – 01.01.2026 rapidly with minimal adverse price effect where: – each reserve asset has a proven record as a reliable source of liquidity in the markets even during stressed market conditions, and those that are marketable securities are traded in large, deep and active markets; – if the price of a reserve asset is determined by a pricing formula, the formula must be easy to calculate and not depend on strong assumptions, and the inputs into the pricing formula must be publicly available; – the reserve assets provide sufficient daily liquidity to meet “instant” redemption requests from the cryptoasset holders; and – the reserve assets are placed in structures that are bankruptcy-remote from any party that issues the cryptoasset, manages or is involved in the stablecoin operation or custodies the reserve assets.10  The reserve assets must be denominated in the same currency or currencies in the same ratios as the currencies used for the peg value (unless explicitly otherwise allowed by the HKMA). A de￾minimis portion of the reserve assets may be held in a currency other than the currencies used for the peg value, provided that the holding of such currency is necessary for the operation of the cryptoasset arrangement and all currency mismatch risk between the reserve assets and peg value has been appropriately hedged.  Eligible types of reserve assets include: – central bank reserves, to the extent that the stablecoin issuer is eligible to hold these reserves and the central bank’s policies allow these reserves to be drawn down in times of 10 In the case of a bank serving as both the custodian and deposit counterparty, the bank deposits are not required to be bankruptcy remote from that bank, subject to it being a prudentially regulated bank that meets the conditions set out in the third indent under the fourth bullet point on eligible types of reserve assets in paragraph 2.2.7.

13 Supervisory Policy Manual CRP-1 Classification of Cryptoassets V.1 – 01.01.2026 stress; – marketable securities representing claims on or guaranteed by sovereigns and central banks with high credit quality 11 and cash receivable from short-term reverse repurchase agreements on the basis that they are overcollateralised by these marketable securities; – deposits at banks with high credit quality and safeguards, such as a concentration limit applied at group level that includes entities with close links; bankruptcy remoteness of the deposits from any party that issues, manages or is involved in the stablecoin operation; and application of the Basel Framework (including the liquidity coverage ratio); and – other types of assets which are acceptable to the HKMA. 2.2.8 Asset quality criteria for reserve assets for cryptoassets not pegged to currencies: for cryptoassets that are not pegged to currencies, the reserve assets must largely include asset(s) presenting the same risk profile of the reference assets. That means, the reserve assets should include only the reference assets, except for a de￾minimis portion of the reserve assets that may be held in cash or bank deposit, provided that the holding is necessary for the operation of the cryptoasset arrangement. 2.2.9 Management of reserve assets: the governance arrangements relating to the management of reserve assets must be comprehensive and transparent. They must ensure that the following requirements are met:  The reserve assets are managed and invested with an explicit and legally enforceable objective of ensuring that all cryptoassets can be redeemed promptly at the peg value, including under periods 11 Securities referred to under LCR30.41(3) of the Basel Framework, as well as securities representing claims on or guaranteed by a sovereign or central bank with a non-0% risk weight under the standardised approach to credit risk, to the extent that the cryptoasset is pegged to the domestic currency of that sovereign or central bank, can be considered as high credit quality.

14 Supervisory Policy Manual CRP-1 Classification of Cryptoassets V.1 – 01.01.2026 of extreme stress.  A robust operational risk and resilience framework exists to ensure the availability and safe custody of the reserve assets.  A mandate that describes the types of assets that may be included in the reserve must be publicly disclosed and kept up to date.  An appropriate risk management framework exists to assess and monitor the risks of reserve assets, including but not limited to market risk, credit risk, concentration risk and liquidity risk. Examples include ongoing monitoring of deposit counterparties and custodians, daily valuation of reserve assets and stress testing.  The composition and value of the reserve assets are publicly disclosed on a regular basis. The value and outstanding amount of cryptoassets in circulation must be disclosed at least once every trade day and the composition must be disclosed at least weekly. The disclosed information must be verified by an independent third party at least semi-annually to confirm its completeness, fairness of valuation and accuracy.  The composition and value of the reserve assets and the outstanding amount of cryptoassets in circulation are subject to an independent external audit at least annually to confirm they match the disclosed reserves and are consistent with the mandate. 2.2.10 Stabilisation mechanisms that: (i) reference other cryptoassets as underlying assets (including those that reference other cryptoassets that have traditional assets as underlying); or (ii) use protocols to increase or decrease the supply of the cryptoasset12 do not meet classification condition 1. 12 Cryptoassets that use protocols to maintain their value are in some cases referred to as “algorithm￾based stablecoins”.

15 Supervisory Policy Manual CRP-1 Classification of Cryptoassets V.1 – 01.01.2026 2.3 Classification condition 2 2.3.1 All rights, obligations and interests arising from the cryptoasset arrangement are clearly defined and legally enforceable in all the jurisdictions where the asset is issued and redeemed. In addition, the applicable legal frameworks must ensure settlement finality in both primary and secondary markets. AIs are required to conduct a legal review of the cryptoasset arrangement to ensure this condition is met and make the review available to the HKMA upon request. 2.3.2 To meet classification condition 2, the following requirements must be met:  At all times, the cryptoasset arrangements must ensure full transferability and settlement finality. In addition, cryptoassets with stabilisation mechanisms must provide a robust legal claim against the underlying reserve assets and/or issuer and must ensure full redeemability (i.e. the ability to exchange cryptoassets for amounts of pre-defined assets such as cash, bonds, commodities, equities or other traditional assets) at all times and at their peg value. In order for a cryptoasset arrangement to be considered as having full redeemability, it must allow for the redemption to be completed within five calendar days of the redemption request at all times.  At all times, the cryptoasset arrangements are properly documented. For cryptoassets with stabilisation mechanisms, cryptoasset arrangements must clearly define which parties have the right to redeem; the obligation of the redeemer to fulfil the arrangement; the timeframe for this redemption to take place; the traditional assets in the exchange; and how the redemption value is determined. These arrangements must also be valid in instances where parties involved in these arrangements may not be located in the same jurisdiction where the cryptoasset is issued and redeemed. At all times, settlement finality in cryptoasset arrangements must be properly documented such that it is clear when the cryptoasset has become irrevocably and

16 Supervisory Policy Manual CRP-1 Classification of Cryptoassets V.1 – 01.01.2026 unconditionally transferred, i.e. key financial risks have been moved from one party to another. The documentation described in this subparagraph must be publicly disclosed by the cryptoasset issuer. If the offering of the cryptoasset to the public has been approved by the relevant regulator on the basis of this public disclosure, the condition in this bullet point will be considered fulfilled. Otherwise, an independent legal opinion would be needed to confirm the requirements mentioned in this bullet point have been met. 2.4 Classification condition 3 2.4.1 The functions of the cryptoasset and the network on which it operates, including the distributed ledger or similar technology on which it is based, are designed and operated to sufficiently mitigate and manage any material risks. 2.4.2 To meet classification condition 3, the following requirements must be met:  The functions of the cryptoasset, such as issuance, validation, redemption and transfer of the cryptoassets, and the network on which it runs, do not pose any material risks that could impair the transferability, settlement finality or, where applicable, redeemability of the cryptoasset. To this end, entities performing activities associated with these functions13 must follow robust risk governance and risk control policies and practices to address risks including, but not limited to: credit, market and liquidity risks; operational risk (including outsourcing, fraud and cyber risk) and risk of loss of data; various non-financial risks, such as data integrity; operational resilience (i.e. operational reliability and capacity); third-party risk management; and anti-money laundering / countering the financing of terrorism (AML/CFT). 13 Examples of these entities include but are not limited to: issuers, operators of the transfer and settlement systems for the cryptoasset; administrators of the cryptoasset stabilisation mechanism and custodians of any underlying assets supporting the stabilisation mechanism.

17 Supervisory Policy Manual CRP-1 Classification of Cryptoassets V.1 – 01.01.2026  All key elements of the network must be well-defined such that all transactions and participants are traceable. Key elements include: (i) the operational structure (i.e. whether there are one or more entities that perform core functions of the network); (ii) degree of access (i.e. whether the network is restricted or unrestricted); (iii) technical roles of the nodes (including whether there is a differential role and responsibility among nodes); and (iv) the validation and consensus mechanism of the network (i.e. whether validation of a transaction is conducted with single or multiple entities). 2.5 Classification condition 4 2.5.1 All entities that execute redemptions, transfers, storage or settlement of the cryptoasset, or manage or invest reserve assets, must: (i) be regulated and supervised, or subject to appropriate risk management standards; and (ii) have in place and disclose a comprehensive governance framework. 2.5.2 Entities subject to condition 4 include operators of the transfer and settlement systems for the cryptoasset, wallet providers and, for cryptoassets with stabilisation mechanisms, administrators of the stabilisation mechanism and custodians of the reserve assets. Node validators may be subject to appropriate risk management standards as an alternative to being regulated and supervised. 2.6 Additional measures in relation to permissionless blockchains 2.6.1 The BCBS has identified several key risks associated with the use of permissionless blockchains in its paper published in August 2024 14 , of which the major risks are summarised as follows:  Governance risk: permissionless blockchains often lack clear accountability and oversight in governance activities. Depending on the degree to 14 https://www.bis.org/bcbs/publ/wp44.htm

18 Supervisory Policy Manual CRP-1 Classification of Cryptoassets V.1 – 01.01.2026 which the governance is decentralised, effective due diligence and oversight of third parties may be challenging.  Technology risk: permissionless blockchains might be vulnerable to unique type of cybersecurity attacks, e.g. 51% attacks.  Settlement risk: transactions on permissionless blockchains may be reversible, undermining settlement finality.  AML/CFT risk: permissionless blockchains may pseudonymise participants and hence complicate compliance with KYC, AML/CFT and sanctions regulations. 2.6.2 Certain cryptoassets running on permissionless blockchains may still be eligible to be classified as Group 1 if additional measures15 are in place to mitigate the key risk associated with the use of permissionless blockchain. The additional measures are set out in paragraphs 2.6.5 to 2.6.7. 2.6.3 Stablecoins issued under the HKMA’s licensing regime can be deemed as fulfilling the additional measures set out in paragraphs 2.6.5 to 2.6.7. For other stablecoins operating on permissionless blockchains, these stablecoins must be subject to a regulatory regime that is, in the HKMA’s opinion, comparable to that of the Stablecoins Ordinance and includes measures comparable to those outlined in paragraphs 2.6.5 to 2.6.7 that govern the use of permissionless blockchains.16 2.6.4 Similarly, for tokenised traditional assets operating on permissionless blockchains17, the tokenised instrument 15 Reference has been made to the HKMA’s Guideline on Supervision of Licensed Stablecoin Issuers and Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Stablecoin Issuers) when formulating the additional measures. 16 The HKMA will keep in view of global regulatory development and international consensus, and will consider any necessary steps in terms of regulatory coordination or put in place recognition agreements with other jurisdictions for regulation for stablecoin issuers as appropriate. 17 Tokenised traditional assets operating on permissionless blockchains issued by sovereigns can be deemed as fulfilling the additional measures set out in paragraphs 2.6.5 to 2.6.7, as these assets are

19 Supervisory Policy Manual CRP-1 Classification of Cryptoassets V.1 – 01.01.2026 must be approved by a financial market regulator and be subject to regulatory requirements comparable to those outlined in paragraphs 2.6.5 to 2.6.7 that govern the use of permissionless blockchains. 2.6.5 To address the governance risk, at a minimum, the issuer of a tokenised traditional asset or a stablecoin must, in relation to its operations for issuance, redemption and distribution of the tokenised traditional asset or stablecoin:  identify all operations throughout the product cycle, assign an appropriate level of authorisation for each key operation, and prevent any single party from being able to perform any high-risk operation unilaterally;  perform appropriate due diligence on its third-party arrangements in relation to the issuance, redemption and distribution of the tokenised traditional asset or stablecoin, assess the materiality of such arrangements, promptly notify its supervisory authority of any material third-party arrangement prior to its commencement, and continuously monitor existing non-material third￾party arrangements. 2.6.6 To address the technology risk and settlement risk, at a minimum, the issuer of a tokenised traditional asset or a stablecoin must:  have in place a technology risk management framework to ensure (i) the adequacy of information technology controls, (ii) the quality and security, including the reliability, robustness, stability and availability, of its technologies, and (iii) the safety and efficiency of its operations;  have in place an effective business continuity management programme with adequate resources to ensure the preservation of essential data at a sufficient interval; and expected to be subject to sufficient oversight. Such tokenised traditional assets can be classified as Group 1a, provided that they meet the classification conditions.

20 Supervisory Policy Manual CRP-1 Classification of Cryptoassets V.1 – 01.01.2026  regularly test the business continuity plan (including trial simulations), at least on an annual basis. 2.6.7 To address the AML/CFT risk, at a minimum, the issuer of a tokenised traditional asset or a stablecoin must:  have in place adequate and effective policies and procedures for customer on-boarding for the issuance and redemption;  ensure that a mechanism is in place for verifying the identity of each individual holder unless measures that have been proven to be effective in mitigating the AML/CFT risk associated with peer-to-peer transactions and unhosted wallets are in place;  maintain effective functioning of the tokenised traditional asset or the stablecoin and guard against the risk of the misuse for unlawful purposes through ongoing monitoring of transactions and associated wallet addresses; and  implement additional controls when conducting transfers to or from unhosted wallets in order to mitigate the associated AML/CFT risk. 3. Hedging recognition criteria for Group 2a cryptoassets 3.1.1 Group 2 cryptoassets that are assessed to meet all three of the following hedging recognition criteria18, will be classified as Group 2a cryptoassets:  An AI’s cryptoasset exposure is one of the following: – A direct holding of a spot Group 2 cryptoasset where there exists a derivative or exchange￾traded fund (“ETF”) / exchange-traded note (“ETN”) that solely references the cryptoasset and that is traded on a regulated exchange that clears these trades through a qualifying central counterparty (“QCCP”). – A derivative or ETF/ETN that references a 18 The BCBS intends to monitor closely the specification of the various thresholds in the criteria and the degree of hedge recognition that the Group 2a classification permits. As such, the HKMA will impose the BCBS’s potential updates.

21 Supervisory Policy Manual CRP-1 Classification of Cryptoassets V.1 – 01.01.2026 Group 2 cryptoasset, where the derivative or ETF/ETN has been explicitly approved by a jurisdiction’s markets regulators for trading or the derivative is cleared by a QCCP. – A derivative or ETF/ETN that references a derivative or ETF/ETN that meets the criterion of the second indent above. – A derivative or ETF/ETN that references a cryptoasset-related reference rate published by a regulated exchange that clears these trades through a QCCP.  The AI’s cryptoasset exposure, or the cryptoasset referenced by the derivative or ETF/ETN, is highly liquid. Specifically, both of the following must apply: – The average market capitalisation was at least HKD 78 billion over the previous year. – The 10% trimmed mean of daily trading volume with major fiat currencies is at least HKD 390m over the previous year.  Sufficient data is available over the previous year. Specifically, both of the following must apply: – There are at least 100 real price observations over the previous year. The “real price observation” is defined in section 281 of the BCR. – There are sufficient data on trading volumes and market capitalisation.

22 Supervisory Policy Manual CRP-1 Classification of Cryptoassets V.1 – 01.01.2026 Annex A: Abbreviations AML/CFT anti-money laundering / countering the financing of terrorism BCBS Basel Committee on Banking Supervision BCR Banking (Capital) Rules CBDC central bank digital currency DLT distributed ledger technology ETF exchange-traded fund ETN exchange-traded note IT information technology KYC know-your-customer QCCP qualifying central counterparty ——————— Contents Glossary Home Introduction