Circular on intermediaries engaging in tokenised securities-related activities

The Securities and Futures Commission (SFC) has issued a new circular in response to the growing interest among financial institutions in tokenizing traditional financial instruments. According to the SFC, tokenization involves recording claims on assets from traditional ledgers onto a programmable platform using distributed ledger technology (DLT). While the SFC acknowledges the potential benefits of tokenization in increasing efficiency, transparency, reducing settlement time, and lowering costs, it also recognizes new risks associated with this technology. Therefore, and in view of these risks, this circular aims to provide guidance to firms to clarify regulatory expectations as regards the tokenization of financial instruments in an effort to ensure adequate investor protection.
To begin with, the SFC notes that various intermediaries, such as traditional brokers, fund managers, and virtual asset trading platforms, have already been piloting tokenization of securities which are defined as traditional financial instruments using DLT in their security lifecycle. Due to this definition, existing legal and regulatory requirements governing traditional securities also apply to tokenized securities. However, in view of the unique nature of tokenized securities, the SFC highlights some common risks associated with tokenized securities and presents some issues to be considered by financial market participants engaging in or seeking to engage in securities tokenization. The key points are briefly described below:
#### Key risks arising from tokenization
Key risks arising from tokenization involve cyber security threats, operational issues, and the lack of properly recording ownership transfers which could result in the use of tokenized securities for money laundering purposes. According to the SFC there are different types of technology networks used for tokenization and the risks strongly depend upon which type is used. For instance, if tokenized securities are issued using open and public networks without restrictions, there’s a higher risk of cybersecurity threats. This is because anyone can access these networks, potentially leading to investor losses in case of theft or hacking. Recovering assets and addressing issues like money laundering may also be more challenging in such cases compared to more controlled and registered forms of tokenized securities such as private networks.
#### Issues to consider
General obligations: Intermediaries involved in tokenized securities activities need to have the right expertise to understand the nature of this business and manage associated risks effectively. They are expected to act with skill, care, and diligence, conducting due diligence on both the tokenized securities themselves and the technology involved in tokenization.
Regarding the issuance of tokenized securities, intermediaries, especially fund managers, remain responsible for the overall operation of tokenization arrangements, even if they outsource tasks to third-party vendors. They are advised to assess risks related to technical aspects, considering a list of factors provided in the circular. For custodial arrangements, intermediaries should choose the most appropriate setup based on the features and risks of the tokenized securities, with additional considerations for bearer form tokenized securities on public-permissionless networks.
When dealing in, advising on, or managing portfolios investing in tokenized securities, intermediaries are reminded to conduct due diligence on issuers and third-party vendors involved in tokenization. They should be satisfied with the controls implemented by these entities to manage ownership and technology risks before engaging in related activities. The circular’s appendices provide a non-exhaustive list of factors for consideration in these processes.
Client disclosures: Intermediaries engaging in tokenized securities activities should disclose relevant material information, including risks, in a clear and easily understandable manner. They are expected to provide clients with key details about the tokenization process, such as whether settlement is conducted off-chain or on-chain, any limitations on token transfers, whether a smart contract audit has been performed before deployment, information about administrative controls, business continuity planning for distributed ledger technology (DLT)-related events, and details about the custodial arrangement if applicable.
Offering restrictions: Unlike previously stated by the SFC, the Commission no longer considers security tokens per se as „complex products“ subject to additional investor protection measures. The complexity depends on the underlying traditional security. Intermediaries should adopt a „see-through“ approach, considering factors outlined in the Guidelines on Online Distribution and Advisory Platforms and the Code of Conduct.
Similarly, given that tokenized securities are fundamentally traditional securities, the SFC now believes there’s no need for a mandatory professional investors-only restriction. However, intermediaries are reminded that offering tokenized securities to the public in Hong Kong is subject to the prospectus and offers of investments regimes, and non-compliant offerings can only be made to professional investors or under other applicable exemptions.
—
To conclude, the SFC clarifies that the „de minimis threshold“ under the Terms and Conditions, as defined in section 53ZRA of the Anti-Money Laundering Ordinance (AMLO), applies only to virtual assets. For fund managers dealing with portfolios investing in tokenized securities meeting the „de minimis threshold“, the Terms and Conditions would not be imposed „unless the portfolios also invest in virtual assets meeting the de minimis threshold“.
Also, the SFC reminds intermediaries that most digital securities (cryptoassets), if not tokenized securities, cannot be offered to retail investors. In fact, digital securities with complex features that may not be easily understood by retail investors are likely to be regarded as „complex products“ for which intermediaries must ensure suitability regardless of whether or not they have advised clients on the purchase of such securities.
Finally, intermediaries are urged to implement adequate systems and controls to comply with legal and regulatory requirements before engaging in digital securities-related activities. In this context, they should exercise professional judgment, assess each digital security individually, and implement appropriate internal controls to address specific risks and protect client interests. Furthermore, it is necessary that intermediaries seeking to engage in digital securities trading or distribution, including tokenized securities, get in contact with the SFC prior to their anticipated engagement.