This announcement sets out the expected regulatory standards that the Financial Services Authority ("FSA") requires recognized institutions to comply with when selling and distributing tokenized products to customers.

Editor: Bowen, White Dew Reception Room

On February 20, 2024, the Hong Kong FSA issued a circular on "Sale and Distribution of Tokenized Products," setting out the expected regulatory standards that the FSA requires recognized institutions to comply with when selling and distributing tokenized products to customers, i.e., using distributed ledger technology or similar technology to digitally represent real-world assets (RWA), including coverage, general principles, due diligence, product and risk disclosure, risk management, custody services, and implementation methods.

The following is the original circular.

This announcement sets out the expected regulatory standards that the Financial Services Authority ("FSA") requires recognized institutions to comply with when selling and distributing tokenized products to customers.

Coverage

This announcement covers tokenized products (for the purposes of this announcement, referring to the use of distributed ledger technology or similar technology to digitally represent real-world assets), but does not apply to tokenized products regulated under the Securities and Futures Ordinance or subject to restrictions imposed by the Securities and Futures Commission ("SFC") and the FSA from time to time.

General Principles

The FSA supports recognized institutions' initiatives in tokenization and is encouraged by the progress made by the industry to date. The FSA believes that it is time to provide guidance on tokenized product-related activities to support the industry's continued innovation and realization of the benefits of tokenization, while taking appropriate protective measures from a consumer/investor protection perspective.

As a general principle, existing regulatory requirements for the sale and distribution of a product and consumer/investor protection measures also apply to the sale and distribution of the product in tokenized form, as the terms, characteristics, and risks (except for risks arising from tokenization itself) are similar to those of the related product.

The following examples further illustrate the application of the above general principle:

(i) When recognized institutions distribute structured investment products in tokenized form not regulated under the Securities and Futures Ordinance, they should adopt the existing regulatory requirements and investor protection measures set by the FSA for the sale of unregulated structured investment products.

(ii) When recognized institutions distribute tokenized gold, they should follow the same regulations governing the sale of gold, including the Banking Code, the Code of Banking Practice, and any other relevant regulations issued by the FSA.

Although some tokenized products are essentially traditional products packaged in tokenized form, there may still be cases where the nature, characteristics, and risks of a tokenized product are altered due to the structure and arrangement of the product in the tokenization process. For example, the arrangement of tokenizing the rights to a subdivided asset may constitute a collective investment scheme. Therefore, recognized institutions should ensure that they assess and understand the terms, characteristics, and risks of each tokenized product and exercise professional judgment to determine the applicable legal and regulatory requirements. In addition to the expected standards set out in this announcement, recognized institutions should also comply with all applicable laws and regulations when selling and distributing tokenized products. When selling and distributing tokenized products to customers, recognized institutions should establish sufficient systems and monitoring measures to ensure compliance with all applicable regulations and implement additional internal monitoring measures to address the specific risks and unique nature of the relevant tokenized products. If in doubt, recognized institutions should seek professional advice.

In addition to the above general principles, recognized institutions should implement the following consumer/investor protection measures for tokenized products in terms of due diligence, disclosure, and risk management.

(A) Due Diligence

In accordance with the regulations applicable to the relevant products, recognized institutions should conduct sufficient due diligence before selling tokenized products to customers and fully understand the relevant tokenized products, and conduct ongoing due diligence at appropriate intervals based on the nature, characteristics, and risks of the products.

Recognized institutions should act with appropriate skill, care, and diligence and conduct due diligence based on all available information to identify and ensure that they fully understand the terms, characteristics, and risks of tokenized products (including terms, characteristics, and risks related to the product and the technological aspects of tokenization).

Recognized institutions should conduct due diligence on the issuer of the tokenized product and third-party suppliers/service providers involved in the tokenization arrangement (such as tokenization platform providers), including their experience and track record, as well as the characteristics of the tokenization arrangement and the risks it poses. Recognized institutions should understand and trust the systems and monitoring measures established by the issuer and their third-party suppliers/service providers, including the management of ownership and new risks related to the technology of tokenized products. Recognized institutions should have appropriate technological inspection arrangements for the operation of tokenized products (especially smart contract audits), proper policies, procedures, systems, and monitoring measures (including sufficient management monitoring measures), such as private key management, and safeguards against theft, fraud, errors and omissions, hacker attacks, and other network security risks. At the same time, recognized institutions should have effective contingency plans to deal with situations such as distributed ledger technology (DLT) network failures, network attacks, unauthorized transfers, and loss of private keys used to access tokenized products. Recognized institutions should also consider the interoperability of DLT networks with the systems of issuers and other parties, the robustness of the DLT network used for tokenized products, including its potential impact on security, privacy, vulnerabilities, and scalability, as well as the legal and regulatory status of tokenized products. Recognized institutions should ensure that the assets supporting digital tokens and the rights attached to those assets actually exist.

The FSA notes that recognized institutions may also issue tokenized products themselves. If recognized institutions issue or are significantly involved in the issuance of tokenized products, they should consider the factors related to due diligence on the issuer and third-party suppliers/service providers involved in the tokenization arrangement as set out in the above paragraphs. In addition, recognized institutions should consider the most appropriate custody arrangements for the product based on its characteristics and risks (including but not limited to the relevant factors to be considered when using non-permissioned tokens on public non-permissioned DLT networks).

(B) Product and Risk Disclosure

Recognized institutions should act in the best interests of their customers and should fully disclose important information related to tokenized products, including key terms, characteristics, and risks, to enable customers to make informed decisions. When selling tokenized products, recognized institutions should disclose important information related to the tokenization arrangement, such as:

(i) Risks posed by the use of DLT networks (including potential uncertainties related to operations and security due to evolving technology) and the potential inability of the related DLT network to interact with other networks or infrastructure.

(ii) Vulnerability to network security threats, such as hacker attacks and security breaches.

(iii) Any restrictions imposed on the transfer of tokenized products.

(iv) Risks associated with the use of smart contracts (including risks of concerns or security flaws in smart contracts) and whether smart contract audits have been conducted before their application.

(v) Legal uncertainties in areas such as ownership and finality of settlement on DLT networks.

(vi) The actual settlement on-chain or off-chain.

(vii) Key management and monitoring measures, as well as contingency and backup plans to deal with system failures, DLT network failures, and other unforeseen circumstances.

(viii) Custody arrangements and risks related to custody of tokenized products, if applicable.

(ix) Risks related to reliance on third-party suppliers/service providers and technology, if applicable.

All information provided to customers should be accurate, fair, and not misleading, and should be presented in a clear, concise, and user-friendly manner for easy reference by customers. This information includes information provided in advertisements and promotional materials distributed online, in print, or through social media platforms. Recognized institutions should provide disclosures to customers in plain and understandable language, avoiding the use of technical jargon or terms.

(C) Risk Management

Recognized institutions should establish proper policies, procedures, systems, and monitoring measures to identify and mitigate the risks associated with tokenized product-related activities. Recognized institutions should ensure that they have an appropriate risk management framework for the sale of tokenized products, including risk management policies and procedures, internal monitoring, complaint handling, compliance, internal audit, and business continuity planning.

Recognized institutions should allocate resources to ensure that their management and relevant staff have the professional knowledge necessary to fulfill their responsibilities in conducting tokenized product-related activities, including the ability to explain tokenized products to customers and manage the risks associated with tokenization.

(D) Custody Services

If recognized institutions also provide custody services for tokenized products, they should comply with the expected standards for the custody of digital assets issued by the FSA.

Implementation

Before engaging in tokenized product-related activities, recognized institutions should first implement sufficient policies, procedures, systems, and monitoring measures to ensure compliance with the regulations set out in this announcement and other applicable regulations, and consult with the FSA in advance. The FSA will continue to monitor the regulatory environment for tokenization and global developments and provide further guidance to recognized institutions as needed.

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。