Terms and conditions for licensed corporations or registered institutions managing portfolios investing in virtual assets

1 Terms and conditions for licensed corporations or registered institutions which manage portfolios that invest in virtual assets May 2026 Appendix A2 Appendix 7

2 Contents General 3 Codes and guidelines 5 Financial resources 5 Custody of fund assets 5 Operations 9 Dealing with the fund and fund investors 11 Reporting to the SFC/ HKMA 11 Schedule 1 – Existing regulatory requirements applicable to Virtual Asset Fund Managers 13 Schedule 2 – Requirements for Virtual Asset Fund Managers conducting discretionary accounts management 15 Schedule 3 – Risk management control techniques and procedures 19 Schedule 4 – Risk disclosure statements 21

3 I. GENERAL Interpretation A reference in these terms and conditions (Terms and Conditions) to: • “AMLO” means the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615); • "fund" or "client" generally means a collective investment scheme1 managed by a Virtual Asset Fund Manager that invests in Virtual Assets and meets the de minimis threshold, except where a Virtual Asset Fund Manager is a delegate of another fund manager for the management of a fund or a portfolio within a fund, in which case a reference to "client" means the delegating fund manager, and a reference to "fund" means the portfolio managed by the delegated Virtual Asset Fund Manager; • "fund investors" means investors as a whole of a collective investment scheme managed by a Virtual Asset Fund Manager; • “professional investor” has the meaning as defined in section 1 of Part 1 of Schedule 1 to the Securities and Futures Ordinance (Cap. 571) (SFO); • “Relevant Stablecoin” means a specified stablecoin the issue of which is authorised by a licence granted under the Stablecoins Ordinance; • “retail client” means any person other than a professional investor; • “Relevant VA Asset Management Activities” means any Virtual Asset related asset management activities carried out by a Virtual Asset Fund Manager for its fund or client; • “SO” means the Stablecoins Ordinance (Cap. 656); • “specified stablecoin” has the meaning given by section 4 of the SO; • “Virtual Assets” means any “virtual asset” as defined in section 53ZRA of the AMLO; • “Virtual Asset Fund Manager” means a licensed corporation or registered institution that manages a fund (or portion of a fund) that invests in Virtual Assets and meets the de minimis threshold; • “de minimis threshold” refers to the situation where either: (a) the stated investment objective of a fund is to invest in Virtual Assets or (b) the intention of a fund is to invest 10% or more of its gross asset value (GAV) in Virtual Assets. For the avoidance of doubt, a fund will not be regarded as having met the de minimis threshold in the following situation: 1 These Terms and Conditions are designed for collective investment schemes in corporate form. If the collective investment schemes managed by the licensed corporation or registered institution adopt a different structure, for example, a unit trust structure, these Terms and Conditions will be modified accordingly.

4 (a) its mandate is to mainly invest in securities (including tokenised securities), futures contracts or both and there is no intention to invest 10% or more of its GAV in Virtual Assets; and (b) its investment in Virtual Assets exceeds 10% of its GAV due to the increase in prices of the Virtual Assets held in that fund, but all reasonably practicable steps are being taken to reduce the fund’s investment in Virtual Assets in a timely manner so as to reduce such investment proportion to below 10% of its GAV. However, if the situation referred to in (b) is anticipated to persist, the SFC (as well as the HKMA in the case of a registered institution) should be duly alerted by the licensed corporation or registered institution concerned so that the SFC (in consultation with the HKMA, where applicable) could consider imposing these Terms and Conditions on that licensed corporation or registered institution. Application Please note that: (a) certain Terms and Conditions (ie, paragraphs 4.1 to 4.12, 5.2, 5.6 to 5.7 and 6.1) are only applicable to a Virtual Asset Fund Manager that is responsible for the overall operation of a fund or has been delegated responsibility for that function; and (b) the additional requirements that are applicable to Virtual Asset Fund Managers conducting discretionary accounts management are set out in Schedule 2 of these Terms and Conditions.

5 II. CODES AND GUIDELINES 2.1 In conducting Relevant VA Asset Management Activities, to the extent not already covered elsewhere in these Terms and Conditions, a Virtual Asset Fund Manager is expected to observe the requirements of the codes and guidelines (as supplemented by circulars, frequently asked questions and other related guidance issued by the SFC from time to time) listed in Schedule 1 hereto as if: (a) any reference to a financial product (for example, securities) or investment product included Virtual Assets; (b) any reference to a client/ fund included a person/ fund to whom a Virtual Asset Fund Manager provides services in Relevant VA Asset Management Activities; (c) any reference to client assets included fund assets; and (d) any reference to regulated activities included Relevant VA Asset Management Activities. III. FINANCIAL RESOURCES 3.1 If the Virtual Asset Fund Manager, which is a licensed corporation, holds Virtual Assets on behalf of the funds it manages, the Virtual Asset Fund Manager shall at all times maintain liquid capital which is not less than an amount equal to the higher of (a) HK$ 3 million and (b) its variable required liquid capital. The terms “liquid capital” and "variable required liquid capital" shall have the same meaning as defined in section 2 of the Securities and Futures (Financial Resources) Rules (Cap. 571N). IV. CUSTODY OF FUND ASSETS Safety of fund assets 4.1 A Virtual Asset Fund Manager should ensure that any fund assets entrusted to it are accounted for properly and promptly and adequately safeguarded. In this connection: (a) A Virtual Asset Fund Manager should select and arrange for the appointment of, and entrust the fund assets to, a custodian that is functionally independent from it; (b) A Virtual Asset Fund Manager should ensure that fund assets are segregated from the assets of the Virtual Asset Fund Manager, and, unless held in an omnibus client account, assets of other clients; (c) Where fund assets are held in an omnibus client account, the Virtual Asset Fund Manager should ensure that adequate safeguards are put in place such that assets belonging to each fund are appropriately recorded with frequent and appropriate reconciliations being performed; and (d) A Virtual Asset Fund Manager should implement and maintain adequate processes and controls when:

6 (i) Creating new accounts with trading platforms and custodians; (ii) Whitelisting new internet protocol addresses (IP addresses) at trading platforms and custodians; (iii) Whitelisting new wallet addresses at trading platforms and custodians; and (iv) Effecting transfer of assets between trading platforms, custodians and wallets held by the Virtual Asset Fund Manager. 4.2 Where a Virtual Asset Fund Manager (except for a Virtual Asset Fund Manager that is a registered institution) receives fiat currency on behalf of the funds it manages (client money), it should: (a) establish one or more segregated bank accounts for holding the client money received by it. Such bank accounts should be established and maintained with an authorized financial institution in Hong Kong or another bank in a jurisdiction as agreed by the SFC from time to time; (b) ensure that such client monies are (i) transferred into a segregated bank account; or (ii) paid to the fund, within one business day after the receipt of such currencies; (c) ensure that client money is retained in the segregated bank account until it is: (i) paid to the fund managed by the Virtual Asset Fund Manager, being the client on whose behalf it is being held; (ii) required to pay money that the fund managed by the Virtual Asset Fund Manager, being the fund on whose behalf it is being held, owes to the Virtual Asset Fund Manager; or (iii) required to meet the fund’s obligations to meet settlement or margin requirements. A Virtual Asset Fund Manager may not pay, or permit to be paid, any client money of the Virtual Asset Fund Manager to any of its officers or employees or any officer or employee of any corporation with which the Virtual Asset Fund Manager is in a controlling entity relationship2 , unless that officer or employee is the fund investor of the fund on whose behalf such client money is being held; and (d) pay out of the segregated bank account any amount held in the segregated bank account that is not client money within one business day of becoming so aware. 4.3 A Virtual Asset Fund Manager should select the most appropriate custodial arrangement for holding fund’s Virtual Assets. In assessing which custodial arrangement (or combination of custodial arrangements) to adopt, the Virtual Asset Fund Manager should assess the advantages and disadvantages of holding Virtual Assets under each custodial arrangement (for example, independent custodian or self-custody, host locations, use of hot or cold wallets) with reference to, among other things,: 2 As defined under Part 1 of Schedule 1 to the SFO.

7 (a) the ease with which Virtual Assets are accessible, ie, the time required to transfer the Virtual Assets to the trading venue; and (b) the security of the custodial facility, ie, whether there are adequate safeguards in place to protect the facility from external threats, including cyberattacks or the ability of the custodian to compensate for any loss of Virtual Assets. A Virtual Asset Fund Manager should also assess the features and characteristics of the different custodial arrangements. For example: (a) the hardware and software infrastructure; (b) the Virtual Assets which are supported; (c) the security controls over key generation, storage, management and transaction signing; (d) the documented process of handling software upgrades to the storage devices used by the custodians and the Virtual Asset Fund Manager; and (e) the process of handling blockchain forks. A Virtual Asset Fund Manager should document the reasons for selecting its custodial arrangements, including self-custody of Virtual Assets. Self-custody 4.4 Where self-custody is adopted, the Virtual Asset Fund Manager should ensure that it has effective policies, procedures, and internal controls in place to protect the fund from financial loss arising from theft, fraud, and other dishonest acts, professional misconduct or omissions. For example, the persons fulfilling the custodial function are independent from the persons fulfilling the fund’s management functions. 4.5 A Virtual Asset Fund Manager should ensure that the assets held in self-custody are identified as owned beneficially by the fund and not by the Virtual Asset Fund Manager through proper record-keeping and arrangements to ensure that these assets can be effectively segregated from the Virtual Asset Fund Manager’s own assets upon the Virtual Asset Fund Manager’s insolvency. For example, the Virtual Asset Fund Manager may make a declaration of trust over the fund’s crypto wallet (including access keys) and all assets held in the wallet. 4.6 A Virtual Asset Fund Manager should acquire and maintain adequate insurance cover over these assets. Selection and appointment of an independent custodian 4.7 A Virtual Asset Fund Manager should exercise due skill, care and diligence in the selection, appointment, and ongoing monitoring, of the custodian and take all reasonable steps to ensure that the custodian is capable of performing its functions. On an ongoing basis, a Virtual Asset Fund Manager should satisfy itself as to the continued suitability and

8 financial standing of any appointed custodian, for example, a Virtual Asset Fund Manager should request for and review the audited financial statements of the appointed custodian. Moreover, a Virtual Asset Fund Manager should consider appointing more than one custodian to avoid undue concentration of risks. Note: In considering whether a custodian is capable of properly performing its functions, the Virtual Asset Fund Manager should consider the following as part of the selection process for custodians3 and document the reasons for its selection: (a) the experience and track record of the custodian in providing custodial services for Virtual Assets, for example, the number of years for which the custodian has provided custodial services for Virtual Assets and the types of Virtual Assets which have been under its custody; (b) the regulatory status of the custodian, in particular, whether the custodian is subject to any regulatory oversight over its Virtual Asset custodial business; (c) the corporate governance structure and background of the senior management of the custodian; (d) whether the custodian has appropriate segregation arrangements in place such that the fund assets are, throughout the custody chain, segregated from: (i) the assets of the custodian/ sub-custodian; and (ii) the assets of other funds and other clients of the custodian (unless the fund assets are held in an omnibus client account); (e) the financial resources and insurance cover of the custodian (ie, the custodian's ability to compensate its customers in the event of any loss of customers’ assets); (f) the custodian's management of actual and potential conflicts of interest; (g) the custodian's operational capabilities and arrangements, for example, the “wallet” arrangements and cybersecurity risk management measures; (h) the physical setup and processes of the custodian, especially in dealing with transfer of assets, blockchain forks and software upgrades of devices; and (i) where the appointment of sub-custodians is allowed, the custodian would use due skill, care and diligence in the selection, appointment and monitoring of its sub￾custodians. To the extent possible, a Virtual Asset Fund Manager should select a custodian that is subject to regulatory oversight over its Virtual Asset custodial business. 3 Where the custodian also operates as a Virtual Asset trading platform, a Virtual Asset Fund Manager may also consider other factors, such as the liquidity provided by the trading platform, during the selection process.

9 Custody agreement 4.8 A Virtual Asset Fund Manager should ensure that a formal custody agreement is entered into with the custodian that is to be entrusted with a fund's assets. 4.9 A Virtual Asset Fund Manager should formulate custodial arrangements with due skill, care and diligence and clarify the duties and responsibilities of the various parties to the custodial arrangements. In particular, the Virtual Asset Fund Manager should ensure that the custody agreement contains provisions to specify the scope of the responsibility and liability of the custodian. 4.10 A Virtual Asset Fund Manager should monitor custodial arrangements and the custodian's compliance with the terms of the custody agreement on an ongoing basis. Disclosure of custodial arrangements 4.11 A Virtual Asset Fund Manager should ensure that: (a) the custodial arrangements in respect of assets of the fund, which should include the intended distribution of the amount of assets kept with each custodian and under self-custody of the Virtual Asset Fund Manager if the Virtual Asset Fund Manager intends to keep more than 10% of the fund’s assets (in terms of GAV) with a particular custodian or under self-custody; and (b) any material risks associated with the arrangements are properly disclosed to the fund investors and that fund investors are updated about any significant changes. 4.12 Where the Virtual Asset Fund Manager intends to hold fund assets in self-custody, the Virtual Asset Fund Manager should also specifically disclose the existence and risks of such an arrangement, the additional safeguards that have been put in place and the details of insurance coverage over these assets (where applicable). V. OPERATIONS Risk management 5.1 A Virtual Asset Fund Manager should take into account, where applicable, the risk management control techniques and procedures set out in Schedule 3 in monitoring such risks. Fund portfolio valuation 5.2 The Virtual Asset Fund Manager should exercise due care to ensure that valuation policies, principles, methodologies and models selected are reasonably appropriate in light of the circumstances and in the best interests of the fund and fund investors. Record keeping

10 5.3 A Virtual Asset Fund Manager should establish and implement effective policies and procedures to ensure the integrity, security, availability, reliability and completeness of all information, both in physical and electronically stored form, relevant to the Virtual Asset Fund Manager’s business operations. 5.4 A Virtual Asset Fund Manager should keep its accounts and records properly. Proper record keeping includes: (a) maintaining an audit trail of all transactions (such as orders placed, trades executed and allocated, trades settlement, deposits and withdrawals of fund assets) effected by the Virtual Asset Fund Manager, all information relating to fund accounts produced by third parties and all relevant internal reports, including trade confirmations, statements of account and records of investment processes adopted. In addition, in respect of each fund for whom the Virtual Asset Fund Manager holds assets, the Virtual Asset Fund Manager should maintain sufficient records to show particulars of the fund’s assets and liabilities, including any financial commitments and contingent liabilities; (b) maintaining sufficient records to demonstrate that the Virtual Asset Fund Manager has complied with these Terms and Conditions; (c) keeping records in such a manner as will enable an audit to be conveniently and properly carried out; and (d) making entries in the records in accordance with generally accepted accounting principles. 5.5 A Virtual Asset Fund Manager should retain- (a) subject to paragraph (b), the records or documents as mentioned under paragraph 5.4 for a period of not less than seven years; and (b) in the case of records or documents showing particulars of any orders concerning Virtual Assets that are initiated by the Virtual Asset Fund Manager, for a period of not less than two years. A Virtual Asset Fund Manager that is a licensed corporation should retain records or documents related to its business as mentioned under paragraph 5.4 in premises which have been approved by the SFC for keeping records or documents required under the SFO or the AMLO4 . Auditors and audited accounts 5.6 A Virtual Asset Fund Manager should ensure that an independent auditor is appointed to perform an audit of the financial statements of the fund (whether by appointing the independent auditor or procuring the relevant fund to appoint the independent auditor) in order to make available, at a minimum, an annual report for each of the funds it manages. When selecting the auditor, the Virtual Asset Fund Manager should take into account, among other things, the experience and capability of the auditor in auditing the financial statements of Virtual Asset funds. A Virtual Asset Fund Manager should understand the 4 Virtual Asset Fund Managers, which are registered institutions, should keep all required records in accordance with the applicable requirements.

11 steps taken by the auditor in proving the existence and ownership of Virtual Assets and ascertaining the reasonableness of the valuation of the Virtual Assets and provide such information to the fund investors upon request. 5.7 A Virtual Asset Fund Manager should arrange for the counterparties of any funds it manages to provide the necessary information to the fund’s auditor for conducting the audit. VI. DEALING WITH THE FUND AND FUND INVESTORS Provision of Information 6.1 A Virtual Asset Fund Manager should make adequate disclosure of information (as well as any material changes to the information) on the fund5 which is necessary for fund investors to be able to make an informed decision about their investment in the fund. This includes the list of trading platforms and custodians which the fund uses. Except for institutional professional investors and qualified corporate professional investors6 , the Virtual Asset Fund Manager should also disclose the key risks associated with the fund’s investment in Virtual Assets. Some examples of these risks are specified under Schedule 4. 6.1A Where a Virtual Asset Fund Manager provides services in Relevant VA Asset Management Activities to a fund of which the Virtual Assets portion of the fund only consists of Relevant Stablecoins, the examples of risks of the fund’s investment in Virtual Assets set out in Schedule 4 do not apply. Offer of the Virtual Asset fund 6.2 A Virtual Asset Fund Manager should comply with the relevant offer of investments requirements when distributing the Virtual Asset fund, including: (a) the prospectus requirements for offering of shares and debentures under the C(WUMP)O7 ; and (b) the restrictions on offers of investments under Part IV of the SFO. VII. REPORTING TO THE SFC/ HKMA 7.1 A Virtual Asset Fund Manager should report to the SFC (as well as the HKMA where the Virtual Asset Fund Manager is a registered institution) as soon as practicable upon the happening of any actual or suspected material non-compliance with these Terms and Conditions or any other applicable legal and regulatory requirements. 7.2 A Virtual Asset Fund Manager should notify the SFC (as well as the HKMA where the 5 A Virtual Asset Fund Manager should also make the same disclosure to the distributors it has appointed for distribution of its Virtual Asset fund. 6 “Institutional professional investors” is defined under paragraph 15.2 of the Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission (Code of Conduct) as persons falling under paragraphs (a) to (i) of the definition of “professional investor” in section 1 of Part 1 of Schedule 1 to the SFO. “Qualified corporate professional investors” refers to corporate professional investors which have passed the assessment requirements under paragraph 15.3A and have gone through the procedures under paragraph 15.3B of the Code of Conduct. 7 Parts II and XII of the Companies (Winding Up and Miscellaneous Provisions) Ordinance (C(WUMP)O).

12 Virtual Asset Fund Manager is a registered institution) of any significant change in its business activities, at least 7 business days before the change takes place. 7.3 A Virtual Asset Fund Manager should also provide any other information as may be requested by the SFC (and/ or the HKMA where the Virtual Asset Fund Manager is a registered institution) from time to time. The SFC and/ or the HKMA may request for information to be provided on a periodic or ad hoc basis. Note: For example, such information may include: (a) the fund’s investment in each product or market; (b) valuation policies, procedures, principles and methodologies of the fund’s assets; and (c) details of custodial arrangements. 7.4 The Virtual Asset Fund Manager should respond to requests and enquiries from the SFC (and/ or the HKMA where the Virtual Asset Fund Manager is a registered institution) promptly in an open and co-operative manner. 7.5 A Virtual Asset Fund Manager should ensure that all information which it provides and which is provided on its behalf to the SFC (and/ or the HKMA where the Virtual Asset Fund Manager is a registered institution) is in all material respects complete, accurate and not misleading. If it becomes aware that any information provided does not meet this requirement, the Virtual Asset Fund Manager should inform the SFC (and/ or the HKMA where the Virtual Asset Fund Manager is a registered institution) promptly.

13 Schedule 1 – Existing regulatory requirements applicable to Virtual Asset Fund Managers Relevant codes (1) The Fund Manager Code of Conduct, except for the following paragraphs which are not relevant or have been modified and incorporated in these Terms and Conditions: ▪ Paragraph 4.1.1 to 4.4.2 (Custody) ▪ Paragraph 5.1 (Record Keeping) ▪ Paragraph 5.2.2 (Auditors and Audited Accounts) ▪ Paragraphs 9.1.1 to 9.1.3 (Reporting Obligations to the SFC) (2) The Code of Conduct, except for the following paragraphs which are not relevant or have been modified and incorporated in these Terms and Conditions: ▪ Paragraph 16 (Analysts) ▪ Paragraph 17 (Sponsors) ▪ Paragraph 19 (Alternative liquidity pools) ▪ Paragraph 20 (Dealing with group affiliates and other connected persons) ▪ Paragraph 21 (Bookbuilding and placing activities in equity capital market and debt capital market transactions) ▪ Schedule 3 (Additional requirements for licensed or registered persons dealing in securities listed or traded on The Stock Exchange of Hong Kong Limited) ▪ Schedule 4 (Additional requirements for licensed or registered persons dealing in futures contracts and/ or options contracts traded on Hong Kong Futures Exchange Limited) ▪ Schedule 5 (Additional requirements for licensed persons providing margin lending) ▪ Schedule 6 (Additional requirements for licensed persons engaging in leveraged foreign exchange trading) ▪ Schedule 8 (Additional requirements for licensed or registered persons operating alternative liquidity pools) ▪ Schedule 10 (Risk mitigation requirements and margin requirements in relation to non-centrally cleared OTC derivative transactions)

14 Relevant guidelines (3) Guidelines on Online Distribution and Advisory Platforms (4) Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations and SFC-licensed Virtual Asset Service Providers) and Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Authorized Institutions) (as applicable) (5) Guidelines for Reducing and Mitigating Hacking Risks Associated with Internet Trading (6) Management, Supervision and Internal Control Guidelines for Persons Licensed by or Registered with the Securities and Futures Commission (7) Fit and Proper Guidelines (8) Guidelines on Competence (9) Guidelines on Continuous Professional Training

15 Schedule 2 – Requirements for Virtual Asset Fund Managers conducting discretionary accounts management Introduction Where applicable, Virtual Asset Fund Managers that are involved in the management of discretionary accounts which are operated in the following manner should observe these Terms and Conditions as well as any additional requirements set out in this Schedule: (a) where a Virtual Asset Fund Manager provides discretionary accounts management services to a client, in the form of an investment mandate or a pre-defined model investment portfolio; and Note: The investment mandate may set out, among others, the types, risks and allocation of investments after taking into account the client’s circumstances, such as investment objectives and/ or strategies. In the case of a pre-defined model portfolio, it may specify the proportion of the asset classes and markets and the risk profile of the selected portfolio. (b) the Virtual Asset Fund Manager receives a management fee and/ or performance fee as remuneration for managing the discretionary account for its client. For the avoidance of doubt, this Schedule only applies to a Virtual Asset Fund Manager that manages a discretionary account which invests in Virtual Assets and meets the de minimis threshold. Where a Virtual Asset Fund Manager is involved in the management of both collective investment schemes and discretionary accounts, this Schedule only applies to the extent that that person is involved in the management of discretionary accounts. Note: In relation to certain principles and requirements (as specifically set out under these Terms and Conditions) that are only applicable to a Virtual Asset Fund Manager that is responsible for the overall operation of a fund or has been delegated responsibility for that function, a Virtual Asset discretionary account manager should also observe these principles and requirements, to the extent relevant to the functions and powers of the Virtual Asset discretionary account manager. Interpretation Except for those requirements mentioned in the section below, these Terms and Conditions are applicable to Virtual Asset discretionary account managers, terminologies that are specific to collective investments schemes/ funds in these Terms and Conditions should be read as modified below: (a) any reference to “fund” or “client” means "discretionary account”; (b) any reference to "fund investors” means “discretionary account clients”; and

16 (c) any reference to “Virtual Asset Fund Manager” means "Virtual Asset Discretionary Account Manager”. Additional requirements applicable to Virtual Asset Discretionary Account Managers The requirements set out in the following paragraphs are also generally applicable to a Virtual Asset Discretionary Account Manager: Target Clients

1. Except for institutional professional investors and qualified corporate professional investors, a Virtual Asset Discretionary Account Manager should assess whether clients have knowledge of investing in Virtual Assets or related products prior to providing discretionary account management services to them. If the clients do not possess such knowledge, a Virtual Asset Discretionary Account Manager may only proceed to provide such services if it has provided adequate training to the client on the nature and risks of Virtual Assets. 1A. Where a Virtual Asset Discretionary Account Manager provides discretionary account management services to a client the discretionary account of which invests in Virtual Assets but only in Relevant Stablecoins insofar as the Virtual Assets portion of the discretionary account is concerned as per the investment mandate or asset allocation of the pre-defined model investment portfolio as agreed with the client, paragraph 1 above does not apply to its provision of discretionary account services to such a client.
2. When providing discretionary account management services to retail clients, a Virtual Asset Discretionary Account Manager should only trade in Virtual Assets that are: (a) except where the Virtual Asset concerned is a Relevant Stablecoin, of high liquidity on behalf of the retail clients. In assessing the liquidity of a specific Virtual Asset for trading by retail clients, the Virtual Asset Discretionary Account Manager should, at a minimum, ensure that the Virtual Asset is an eligible large￾cap virtual asset, ie, the specific Virtual Asset should have been included in a minimum of two acceptable indices issued by at least two different index providers. Note 1: An acceptable index refers to an index which has a clearly defined objective to measure the performance of the largest Virtual Assets in the global market, and should fulfil the following criteria: (i) The index should be investible, meaning the constituent Virtual Assets should be sufficiently liquid; (ii) The index should be objectively calculated and rules-based; (iii) The index provider should possess the necessary expertise and technical resources to construct, maintain and review the methodology and rules of the index;

17 (iv) The methodology and rules of the index should be well documented, consistent and transparent. Note 2: The two index providers should be separate and independent from each other, the issuer of the virtual asset (if applicable) and the Virtual Asset Discretionary Account Manager (for example, they are not within the same group of companies). Further, at least one of the indices should be issued by an index provider which complies with the IOSCO Principles for Financial Benchmarks and has experience in publishing indices for the conventional securities market. (b) made available by SFC-licensed Virtual Asset trading platforms for trading by retail investors, or are Relevant Stablecoins. Suitability 3. A Virtual Asset Discretionary Account Manager should ensure that the mandate or predefined model investment portfolio established for or chosen by a client is suitable for that client (except for institutional professional investors and qualified corporate professional investors) based on information about the client’s personal circumstances of which it is or should be aware through the exercise of due diligence. Such suitability assessment could be conducted on a holistic basis when the mandate or portfolio is agreed8 (for example, in establishing a predefined model investment portfolio with a particular overall risk profile, the Virtual Asset Discretionary Account Manager could have the discretion to invest in particular products with a lower or higher risk profile so long as the overall risk profile of the portfolio is maintained). The Virtual Asset Discretionary Account Manager should document its assessment and provide a copy of the rationale to the client in writing. To avoid concentrated exposure to Virtual Assets, the Virtual Asset Discretionary Account Manager should also ensure that the aggregate amount to be invested by a client in the discretionary account is reasonable, considering the client’s net worth. 4. A Virtual Asset Discretionary Account Manager should review the mandate or predefined model investment portfolio on a regular basis (for example, at least on an annual basis and whenever there have been significant market movements), having regard to the client’s latest circumstances at the time of review and, where appropriate, recommend revisions to the mandate or predefined model investment portfolio and agree them with the client. The Virtual Asset Discretionary Account Manager should also document the rationale for recommending the revised mandate or predefined model investment portfolio and provide a copy of the rationale to the client in writing. 5. A Virtual Asset Discretionary Account Manager should ensure that the transactions carried out on behalf of the clients are suitable and in accordance with the mandate or predefined model investment portfolio. Client agreements 8 Where the mandate or pre-defined model investment portfolio to be agreed with the client may have holdings in Relevant Stablecoins, the Virtual Asset Discretionary Account Manager should also disclose material information on the stabilisation mechanism and redemption arrangement of the Relevant Stablecoins to the client.

18 6. A Virtual Asset Discretionary Account Manager should ensure that a written agreement (Discretionary Client Agreement) is entered into with a client (except for institutional professional investors and qualified corporate professional investors) before any services are provided to, or transactions are made on behalf of, that client. A Discretionary Client Agreement should set out, amongst other things: (a) the following clause: “If we [the intermediary] solicit the sale of or recommend any Virtual Assets to you [the client], the Virtual Assets must be reasonably suitable for you having regard to your financial situation, investment experience and investment objectives. No other provision of this agreement or any other document we may ask you to sign and no statement we may ask you to make derogates from this clause.”; and (b) the risk disclosure statements (please see Schedule 4 for some examples of these risks) Note: Where a Virtual Asset Discretionary Account Manager provides discretionary account management services to a client the discretionary accounts of which invest in Virtual Assets but only in Relevant Stablecoins, insofar as the Virtual Assets portion of the discretionary accounts are concerned as per the investment mandates or asset allocation of the pre-defined model investment portfolios as agreed with the client, the examples of risks of the discretionary accounts’ investment in Virtual Assets set out in Schedule 4 do not apply.

19 Schedule 3 – Risk management control techniques and procedures A. Risk management

1. A Virtual Asset Fund Manager should establish and maintain effective risk management policies and reporting mechanisms which take into account the following risk management control techniques and procedures where applicable. B. Counterparty risk
2. A Virtual Asset Fund Manager should establish and maintain an effective credit assessment system to evaluate the creditworthiness of the funds’ counterparties. For example, when assessing the creditworthiness of a Virtual Asset trading platform, a Virtual Asset Fund Manager should consider the following: (a) the experience and track record of the Virtual Asset trading platform; (b) the legal and regulatory status of the Virtual Asset trading platform’s operator, including its compliance history. For example, whether any disciplinary actions have been taken by any regulatory authorities against the operator; (c) the corporate governance structure and the background of the founders and senior management of the Virtual Asset trading platform; (d) the operational capabilities of the Virtual Asset trading platform; (e) the liquidity of Virtual Assets traded on the Virtual Asset trading platform (f) the custodial arrangements of the Virtual Asset trading platform where the trading platform takes custody of Virtual Assets; (g) the mechanisms (for example, surveillance) implemented by the Virtual Asset trading platform to guard against fraud and market misconduct with respect to the products traded on the trading platform; (h) the cybersecurity risk management measures of the Virtual Asset trading platform, including its business continuity plan; (i) the risk management tools adopted by the Virtual Asset trading platform to manage its counterparty risk arising from its payment, clearing, and settlement processes; and (j) the financial resources and insurance cover of the Virtual Asset trading platform. For example, the Virtual Asset trading platform’s ability to compensate its clients should there be any loss of their assets due to hacking or other events and the auditor’s opinion on the going concern of the Virtual Asset trading platform.
3. A Virtual Asset Fund Manager should set appropriate limits in relation to the fund’s exposure to the different counterparties of the fund, including Virtual Asset trading platforms and custodians. For example, a Virtual Asset Fund Manager should consider

20 using more than one custodian to hold the portfolio’s assets to avoid undue concentration of risk. C. Cybersecurity risk 4. A Virtual Asset Fund Manager should implement adequate and appropriate security controls to protect the systems used in its operations. The security controls should include, but not be limited to, the following: (a) effective techniques to protect the confidentiality and integrity of information stored in the system and passed between internal and external networks; and (b) appropriate operating controls to prevent and detect unauthorized access, security breach and security attack.

21 Schedule 4 – Risk disclosure statements The Virtual Asset Fund Manager should properly disclose the risks associated with investment in the Virtual Asset fund under its management and Virtual Assets invested in the fund to potential fund investors and distributors appointed by it to distribute its Virtual Asset fund. Some examples of the associated risks are listed below. (a) Price volatility (b) Potential price manipulation on trading platforms (c) Lack of secondary markets for certain Virtual Assets (d) Difficulties in verifying ownership of Virtual Assets (e) Most trading platforms and custodians of Virtual Assets are presently unregulated (f) Counterparty risk when effecting transactions with issuers, private buyers/ sellers or through trading platforms (g) Risks arising from custodial arrangements, including self-custody of assets by the fund manager and use of hot wallets9 (h) Continuing evolution of Virtual Assets and global regulatory developments (i) Cybersecurity and technology related risks (j) Legal uncertainty on whether Virtual Assets can be regarded as “property” under the law 9 A “hot wallet” refers to the wallet used for holding Virtual Assets in an online environment which provides an interface with the internet, which is more susceptible to cyber-attacks.