16 December 2019
The Chief Executive
All Authorized Institutions
Managing ML/TF risks associated with virtual assets (VAs) and virtual asset service providers (VASPs)
I am writing to provide guidance to Authorized Institutions (AIs) in relation to recent updates by the Financial Action Task Force (FATF) to its Recommendation 15, which clarify the businesses and activities that the FATF requirements apply in the case of VAs and VASPs . The FATF also published “Guidance for a Risk-Based Approach – Virtual Assets and Virtual Asset Service Providers” (the FATF Guidance) in June 2019, which is intended to, among others, help private sector entities wishing to engage in VA activities to understand and comply with their AML/CFT obligations. The FATF Guidance can be found at: https://www.fatf-gafi.org/publications/fatfrecommendations/documents/guidance- rba-virtual-assets.html.
FATF member jurisdictions have put in place or are implementing regulatory regimes for VASPs in response to the international development . Therefore, increasingly there may be more VASPs which are licensed or registered in Hong Kong or other jurisdictions, and subject to AML/CFT regulation and supervision in line with the FATF Recommendations. Some VASPs may be in the process of applying for licensing or registration.
Following the risk-based approach, when AIs establish and maintain business relationships with VASPs, appropriate risk assessments should be conducted to differentiate the risks of individual VASPs, recognising that there is no “one-size- fits-all”. Depending on the nature of relationship, AIs may undertake additional customer due diligence measures , including the collection of sufficient information to adequately understand the nature of the VASP’s business; determining from publicly available information whether the VASP are licensed or registered, and subject to AML/CFT supervision; and assessing the AML/CFT controls of the VASP as appropriate. The extent of customer due diligence measures should be commensurate with the assessed ML/TF risks of the VASP.
Besides, globally there is an emerging range of new products and services involving VA. In line with the FATF standards, before an AI offers any new banking or investment products relating to VAs, it should undertake ML/TF risk assessment and take appropriate measures to manage and mitigate the identified risks in accordance with applicable legal and regulatory requirements including paragraph 2.11 of the Guideline on Anti-Money Laundering and Counter- Financing of Terrorism (For Authorized Institutions).
The HKMA will continue to participate in international discussions on this fast evolving subject matter and share updates of FATF’s work relating to VAs and VASPs with the banking sector from time to time. AIs should keep abreast of international and local developments to maintain an up-to-date understanding of risks, and apply a risk-based approach that supports responsible financial innovation as well as effective ML/TF risk management.
This circular supersedes the letters on “Risks associated with virtual commodities” issued on 9 January and 30 April 2014 respectively. For questions relating to this circular, please send to firstname.lastname@example.org .
Executive Director (Enforcement and AML)