External assessment reports for licence applications

External assessment reports for licence applications

Q1 : Why does the SFC require a corporation applying to be licensed as a Platform Operator to submit external assessment reports for its licence application?

A: Over the past few years, the assessment process for a licence application to be a Platform Operator is typically longer than that for other licence applications. Whilst this is partly because VA trading platforms have complex business models, the SFC has observed that some applicants may not fully understand the SFC’s regulatory expectations.

To streamline the application process, the SFC requires applicants to engage an external assessor to assess its policies, procedures, systems and controls , and submit the assessor’s reports to the SFC (i) when submitting the licence application (Phase 1 Report) and (ii) after approval-in-principle is granted (Phase 2 Report).

Q2 : What should be contained in the Phase 1 Report and Phase 2 Report?

A: The Phase 1 Report should cover the design effectiveness of the VA trading platform’s proposed structure, governance, operations, systems and controls, with a focus on key areas such as governance and staffing, token admission, custody of virtual assets, know-your-client processes, anti-money laundering and counter-financing of terrorism processes, market surveillance, risk management and cybersecurity. The assessor should review and assess whether the VA trading platform’s policies and procedures are clearly written and in compliance with the applicable legal and regulatory requirements, particularly the VATP Guidelines and the Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations and SFC-licensed Virtual Asset Service Providers).

The Phase 2 Report should be the assessor’s assessment of the implementation and effectiveness of the actual adoption of the planned policies, procedures, systems and controls. The SFC will grant final approval only if it is satisfied with the findings of the Phase 2 Report.

For more details, please refer to the Scope of External Assessment Reports on the SFC’s website.

Q3 : Is there any selection criteria on the external assessor for the external assessment reports?

In relation to the selection and appointment of external assessors:

the VA trading platform applicant should exercise due skill, care and diligence in the selection and appointment of the external assessor and should consider its expertise, experience and track record in reviewing the areas concerned. The external assessor’s capability statement should be submitted to the SFC together with the external assessment report.
separate external assessors may be engaged to review different areas of the business, depending on their expertise, experience and track records.
the external assessor should be independent in the sense that the service provider of a particular system should not also act as the external assessor for the same system.

Last update: 31 May 2023