Read the new STO rules in Hong Kong in one article

**Written by: **Will Awang, Master of International Business Law, 10 years of legal experience, serial entrepreneur in the technology industry, investment and financing lawyer, focusing on Web3 virtual assets

Recently, the popularity of tokenization has been spreading from DeFi to TradFi, and we can see that MakerDAO has allocated a large number of tokenized US bond assets in recent years, and the Bank for International Settlements (BIS) has been promoting various pilots of CBDC tokenization. Hong Kong’s Securities and Futures Commission (SFC) has also observed a growing interest in tokenising traditional financial instruments in the global financial markets, with an increasing number of intermediaries exploring the tokenisation of securities and the distribution of tokenised securities to customers.

The SFC believes that it is time to provide more guidance on activities related to tokenised securities (e.g. Security Token Offering, STO). This will help clarify the regulatory requirements for intermediaries engaged in these activities, provide guidance for intermediaries in addressing and managing the new risks arising from the use of this new tokenization technology, and support the industry to continue to innovate while taking appropriate precautions from an investor protection perspective.

As a result, on 2 November 2023, the SFC issued two circulars on tokenised securities: the Circular on Intermediaries Engaging in Activities Related to Tokenised Securities, and the Circular on Tokenised SFC Authorised Investment Products, which are collectively referred to as the “Tokenised Circulars”.

This article will sort out the definition of tokenized securities in the Tokenization Circular from the perspective of a lawyer, as well as the content of activities related to tokenized securities (issuance, trading, advice, fund investment, etc.), to help you better understand the new STO rules in Hong Kong.

I. Summary of the Tokenization Circular

The essence of tokenized securities is that traditional securities (Tokenised Securities) are packaged in tokenization, which are still regulated according to the positioning of the underlying assets of the securities, and are applicable to the current legal and regulatory provisions of the traditional securities market.

The SFC allows products licensed by the SFC to be issued to the public in Hong Kong under Part IV of the SFO to be tokenised and traded in the primary market of tokens, provided that the tokenised products are authorised by the SFC and have adequate risk control measures in place to address the new risks brought about by tokenisation.

Intermediaries involved in activities related to tokenized securities should have the necessary manpower and expertise to be able to understand the nature of the business (in particular the new risks associated with ownership and technology) and conduct due diligence on tokenized securities based on all available information to identify the key features and risks of tokenized securities.

If an intermediary issues (a product issuer) or is substantially involved in the issuance of tokenised securities that it intends to trade or advise on, it will still be responsible for the overall operation of the tokenisation arrangement, even if they outsource certain functions to third-party providers.

The Tokenization Circular replaces the 2019 Statement on Security Token Offerings, removes the recognition of tokenized securities as “complex products” and removes the mandatory requirement of “professional investors only”.

Although the Tokenized Circular considers tokenized securities to be essentially traditional securities, intermediaries should still take a “perspective” approach to assess the complexity of the underlying traditional securities related to tokenized securities.

Restrictions on the “de minimis exemption” – Portfolios in which the Fund has previously indicated that its investment objective is virtual assets, as well as portfolios in which 10% or more of its total asset value is invested in virtual assets, do not apply to tokenised securities.

The SFC supports intermediaries in carrying out any activities in any digital securities, including tokenised securities, but should communicate their business plans to the SFC in advance.

2. What are tokenized securities

Tokenization involves the process of recording the rights to assets existing in a traditional ledger on a programmable platform, including the use of Distributed Ledger Technology (DLT) throughout the securities lifecycle. This can be seen as record keeping in digital form, incorporating the rules and logic used to govern the asset transfer process.

The potential value of tokenization to financial markets includes improving efficiency, increasing transparency, shortening settlement times and reducing costs for the traditional financial industry. While the SFC supports intermediaries in taking steps to tokenise traditional securities, it should also be aware of the new risks that arise from the use of this new technology.

2.1 Tokenized Securities = Securities, Regulated by Traditional Securities Market Regulations

According to the Tokenisation Circular, tokenised securities are traditional financial instruments (e.g. bonds or funds) that are “securities” as defined in section 1 of Part 1 of Schedule 1 to the Securities and Futures Ordinance and have used DLTs (e.g. blockchain technology) or similar technology (tokenised securities) during the life cycle of their securities.

According to the meaning of the CSRC’s “Tokenization Circular”, tokenized securities are the underlying regulated traditional securities (such as fixed income debt, ABS, MBS, REIT, etc.) at the product design level, adding a layer of blockchain DLT technology shell, and then using the shell to package the traditional securities and then tokenize (Wrapped Securities). Here, the underlying traditional securities themselves are regulated, and the Tokenization Circular sets out more regulatory requirements for risk control, information disclosure, investor protection, etc.

Taking a traditional financial security such as a fund as an example, if DLT or similar technology is used at any stage of the fund’s life cycle, such as issuance, subscription, redemption, trading, transfer, settlement, etc., it should be classified as a tokenized fund and fall into the category of tokenized securities. For example, Franklin Templeton’s Franklin OnChain U.S. Government Money Fund (FOBXX), launched in 2021 with an underlying asset of U.S. Treasury bonds, is the first SEC-approved tokenized fund in the U.S. to use Stellar blockchain technology to process transactions and record ownership.

2.2 New Risks Arising from Tokenization

The first principle of the CSRC’s regulatory approach is “same business, same risks, same rules”. In addition to complying with existing legal and regulatory requirements applicable to traditional securities, intermediaries should also manage ownership risks involving tokenization activities (e.g., how ownership interests in tokenized securities are transferred and recorded) and blockchain technology risks (e.g., forking, blockchain network disruption and cyber security risks).

The SFC noted that there are several common prototypes of DLT networks, including: (a) Private Permissioned;( b) Public Permissioned, and © Public-Permissionless. The risks vary depending on the type of DLT network used and should be addressed through the implementation of adequate control measures.

Although there are currently no tokenized securities issued on public-permissionless networks, the cybersecurity risks of such tokenized securities may be higher, the implementation is more difficult, and more public chains that are compatible with traditional finance are needed. In addition, due to the relative ease with which ownership of such tokenized securities can be transferred and their anonymity, they may carry a higher risk in terms of money laundering and “KYC” matters than registered tokenized securities.

So what you will see later is more tokenized securities projects on Private Permissioned and Public Permissioned.

BOCI, the first company to issue tokenized securities in Hong Kong, announced that it had successfully issued RMB200 million of tokenized notes on the Ethereum blockchain (without involving a central securities depository), which was issued through the Ethereum Public Permissioned network. On October 2, 2023, UBS’s tokenized fund pilot project was also the same. Fund tokens appear as smart contracts on Ethereum, representing equity in the underlying money market fund, and tokenization can help improve the issuance, distribution, subscription, and redemption process of the fund.

In 2022, BIS and the Hong Kong Monetary Authority jointly launched Project Evergreen to issue green bonds using tokenization and a unified ledger under the BIS Innovation Hub’s Genesis project. The project is being implemented on Goldman Sachs’ Private Permissioned network, the GS DAP digital platform. The structure and first-level issuance process of the project are shown in the figure below.

(Tokenisation of Hong Kong Bond Market)

III. Considerations for Engaging in Tokenized Securities-Related Activities

The Tokenization Circular clarifies that the essence of tokenized securities is that tokenised securities are traditional securities (Tokenised Securities) wrapped in tokenization, which are still regulated according to the positioning of the underlying assets of the securities, and are applicable to the current laws and regulations of the traditional securities market. In particular, the offering of tokenised securities will be governed by the prospectus regime under the Companies (Winding Up and Miscellaneous Provisions) Ordinance (Cap. 32) and the investment offer regime under Part IV of the Securities and Futures Ordinance.

Intermediaries are also subject to the current requirements applicable to the company’s securities-related activities if they engage in the following activities: distribution of tokenized securities or advising on tokenized securities, management of tokenized funds, management of funds investing in tokenized securities, and secondary market trading of tokenized securities on virtual asset trading platforms.

In addition, the SFC requires intermediaries engaged in activities related to tokenised securities to have the necessary manpower and expertise to understand the nature of the business (in particular the emerging risks related to ownership and technology) and to properly manage these risks.

Intermediaries should act with due skill, care and diligence and conduct due diligence on tokenized securities based on all available information to identify the key features and risks of tokenized securities. This includes the responsibility of the intermediary to conduct due diligence on the product itself (e.g. the underlying bond or fund being tokenised) under the existing requirements, as well as on the technology aspects of the product as a result of the use of tokenisation.

As can be seen from the Tokenization Circular, after the definition of tokenized securities as securities, all intermediaries engaged in activities related to tokenized securities are still required to comply with the legal and regulatory requirements of the traditional securities market. This means that in addition to the intermediaries involved in blockchain DLT technology, the other participants are also licensed institutions in traditional finance.

(Securities and Futures Ordinance (Cap. 571) - Schedule 5 Regulated Activities)

3.1 Issuance of Tokenized Securities

If an intermediary issues (a product issuer) or is substantially involved in the issuance of tokenised securities that it intends to trade or advise on, it will still be responsible for the overall operation of the tokenisation arrangement, even if they outsource certain functions to third-party providers.

In assessing the technical and other aspects of the risks involved in tokenized securities, intermediaries should consider the following factors:

(a) the experience and track record of third-party vendors (e.g. tokenisation technology developers, tokenization platform providers, wallet service providers/custodians and anti-money laundering solutions);

(b) the technical scope of the Tokenized Securities: (i) the audit of the smart contract code, (ii) the security and robustness of the DLT network, (iii) the interoperability of the back-end systems of the parties involved, (iv) the robustness and proper maintenance of policies and procedures, systems and controls to support the operation of the Tokenized Securities;

© the legal and regulatory situation in relation to tokenised securities, in particular: (i) the legal position regarding “settlement finality”, (ii) the enforceability of any security interest (if applicable), (iii) the enforceability of any extrinsic rights and the potential impact of tokenised securities trading activities on the relevant market, (iv) the regulatory position in Hong Kong and whether regulatory approvals are required under the relevant laws;

(d) a business continuity plan to respond to DLT contingencies;

(e) Appropriate measures to address data privacy risks;

(f) Money laundering and terrorist financing risks;

(g) Consideration of the most appropriate custody arrangement, in particular the case on public-permissionless networks.

3.2 Buying, selling, or advising on tokenized securities, or managing a portfolio of investments in tokenized securities

Intermediaries that buy, sell or advise on tokenised securities, or manage portfolios investing in tokenised securities, are required to meet the following requirements:

(a) conducting due diligence on the issuer and the third party providers involved in the tokenisation arrangement, as well as the features of the tokenization arrangement and the risks associated with it;

(b) Before engaging in the relevant activities, you should understand and be satisfied with the controls implemented by the issuer and its third party providers to manage the ownership and technology risks of tokenized securities, with reference to 3.1 Factors to be considered in the issuance of tokenised securities.

© should adequately disclose certain material information relating to the Tokenized Securities, including: (i) the finality of off-chain or on-chain settlements; (ii) restrictions imposed on the transfer of tokenized securities; (iii) whether a smart contract audit has been conducted prior to the deployment of the smart contract; (iv) key management controls and business continuity plans for DLT-related events; and (v) custody arrangements.

(d) adopt a “see-through” approach to assess the complexity of the underlying traditional securities associated with the Tokenized Securities and comply with the requirements governing the sale of complex products (including product suitability requirements);

(e) If the offering of tokenised securities is not authorized by the SFC under Part IV of the SFO or does not comply with the prospectus regime, only such tokenised securities-related services may be provided to professional investors (unless other applicable exemptions apply).

3.3 Manage a portfolio that may invest in tokenized securities

As tokenised securities are essentially tokenised securities, the restrictions on the “minimum exemption provisions” referred to in the Terms and Conditions for Licensed Corporations or Registrars Managing Portfolios Investing in Virtual Assets published on 4 October 2019 do not apply to tokenised securities.

The “de minimis exemption” restriction (a portfolio in which the Fund has indicated that its investment objective is virtual assets and a portfolio in which 10% or more of its total asset value is invested in virtual assets) only applies to “virtual assets” as defined in section 53 ZRA of the AMLO, such as BTC, ETH, stablecoins, utility tokens and governance tokens.

3.4 Protection Arrangements for Licensed Virtual Asset Trading Platforms

According to paragraph 10.22 of the Guidelines for Virtual Asset Trading Platform Operators, virtual asset trading platforms are required to have compensation arrangements approved by the SFC to provide protection against potential losses of security tokens (e.g. third-party insurance, internal control mechanisms for funds).

If these measures can satisfy the SFC that the risk of financial loss to customers holding tokenised securities in the event of loss of such tokenised securities can be effectively mitigated (e.g. a virtual asset trading platform can demonstrate that the issuer has implemented regulatory controls (e.g. transfer restrictions or permitlists) to protect the risk of theft and hacking to protect holders of tokenised securities using a public non-permissioned network), then the SFC may remove the security tokens from the scope of protection on the basis of the licensee’s application。

4. The Tokenization Circular replaces the 2019 Statement on the Issuance of Security Tokens**

4.1 Tokenized Securities = Securities

The SFC’s Statement on Security Token Offerings issued on 29 March 2019, when it was more of a stance on treating security tokens as “complex products”, was intended to alert companies or individuals engaged in security token offerings to the relevant applicable laws and regulatory requirements. For the avoidance of doubt, this Tokenization Circular will now supersede that statement.

According to the current Tokenised Circular, tokenised securities are basically traditional securities wrapped in tokenization. In addition, intermediaries need to ensure that the new risks arising from the use of new technologies are effectively mitigated and do not affect investors. Therefore, in this context, tokenization should not change the complexity of the underlying security, and it is still a security.

4.2 Complex Product Classification

In the 2019 Statement on Security Token Offerings, the SFC reminded intermediaries that they must ensure compliance with all existing legal and regulatory requirements in relation to “complex products” if they promote or distribute security tokens, and that intermediaries need to take additional investor protection measures.

Although the Tokenization Circular considers tokenized securities to be essentially traditional securities, intermediaries should still take a “perspective” approach to assess the complexity of the underlying traditional securities related to tokenized securities. Intermediaries distributing tokenised securities that are “complex products” should comply with the requirements governing the sale of “complex products”, including ensuring the suitability of the relevant products (whether or not there is any solicitation or recommendation).

Intermediaries should therefore make reference to the factors set out in Chapter 6 of the Guidelines on Online Distribution and Advisory Platforms and paragraph 5.5 of the Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission to assess the relevant conventional securities of tokenised securities in order to determine whether tokenised securities are “complex products”. Intermediaries should also take into account the guidelines issued by the SFC from time to time.

4.3 Removal of Professional Investor Only Restrictions

In the 2019 Statement on Security Token Offerings, the SFC also imposed “professional investor only” restrictions on the distribution and promotion of security tokens. At the time, security tokens were still an innovative asset class and had not yet entered the market as tokenized securities as they do today.

As tokenised securities are identified as securities in the Tokenised Circular, the CSRC does not consider it necessary to impose a mandatory requirement of “professional investors only”.

However, intermediaries should note that the prospectus regime under the Companies Winding-up Ordinance and the investment offer regime under Part IV of the Securities and Futures Ordinance still apply to tokenised securities offerings to the public in Hong Kong (the public offer regime). This means that an offer of tokenised securities that is not authorized under Part IV of the SFO or is not in compliance with the prospectus regime may only be made to professional investors or under any other applicable exemption under the public offer regime.

4.4 Digital Securities-related Activities

Tokenized securities are a broader set of digital securities, there is no universal definition or classification of “digital securities”, and there may be many different structures in the market.

Digital securities that are not tokenized securities may have special natures, terms and characteristics, in more special, innovative or complex structures, and are subject to greater legal uncertainty. Retail investors are not reasonably likely to understand that these digital securities may exist only on a DLT-based network and are not linked to external rights or underlying assets, and there are no controls in place to mitigate the risk that such ownership may not be accurately recorded. Digital securities that are not tokenised securities are likely to be considered “complex products” and some may fall within the definition of interests in collective investment schemes.

For example, digital securities that are not tokenised securities may include the tokenisation of subdivided interests in real-world assets or digital assets (e.g. works of art or land) in which the arrangement is a collective investment scheme in a different way than that of a traditional fund, or the tokenisation of a profit-sharing arrangement in a form that is not a traditional security.

Intermediaries should note that digital securities should not be offered to retail investors in a manner inconsistent with the public offering regime, and intermediaries distributing such digital securities should comply with the requirements governing the sale of complex products, including ensuring their suitability (whether or not involved in any solicitation or recommendation). Where digital securities are distributed on an online platform, the platform must be properly designed with appropriate access rights and controls in place to ensure compliance with restrictions on the sale of such digital securities that may apply.

Intermediaries should take care to implement adequate systems and controls to ensure compliance with applicable legal and regulatory requirements before engaging in digital securities-related activities. In addition to the requirements relating to tokenised securities as set out in this circular, intermediaries should use professional judgment to assess each digital security that they handle but are not tokenised securities and separately implement appropriate internal controls to address the specific risks and unique nature of digital securities in order to protect the interests of their clients.

5. Notification and Provision of Information to the SFC

Intermediaries who intend to carry out any activities involving any digital securities (including tokenised securities) should inform the relevant case officers of the SFC of their business plans in advance and discuss this with them. The intermediary should provide any information that the SFC may require from time to time in relation to such services.

6. Practice of Tokenized Securities Offering (STO)**

On September 10, 2023, Ta Kung Pao reported that Tai Chi Capital announced the launch of PRINCE Token (PRINCE Token), the first real estate fund security token offering (STO) for “professional investors” in Hong Kong. The STO is the first SFC-approved fund tokenisation fundraising model with a target fundraising size of about $100 million, and the proceeds will be used to acquire five retail properties located in the tourist hotspot of Prince Edward, Kowloon, but the details of the target properties have not been disclosed. Subject to regulatory approval, the plan seeks to list the PRINCE token on the HKbitEX platform to realise greater liquidity potential.

(Hong Kong’s first real estate STO was approved to raise $100 million)

According to the data, the PRINCE token is issued by a closed-end fund managed by Vanguard under Taiji Capital. The entrance fee is HK$1,000, which is much lower than the $1 million typically required to invest in a private real estate fund. By holding PRINCE tokens, investors can earn the rental income generated by the property each year and benefit from the future appreciation of the property.

Upon completion of the subscription agreement, Vanguard will arrange for the relevant investors to open a digital wallet account with ON1 ON Custody for the distribution and storage of PRINCE tokens. ON1 ON Custody, another subsidiary of Taiji Capital, is a Hong Kong Trust or Company Service Provider Licensee and a SOC 2 certified virtual asset custodian by the American Institute of Certified Public Accountants (AICPA). PRINCE tokens stored in ON1 ON Custody can be protected by virtual assets by a local insurance company. The final settlement of the PRINCE token on the public Ethereum blockchain allows investors to access the secondary market in the form of an over-the-counter transaction immediately after subscribing to the token.

VII. Thoughts on the Tokenization Circular

The Tokenization Circular clarifies that the essence of tokenized securities is that tokenised securities are traditional securities (Tokenised Securities) wrapped in tokenization, which are still regulated according to the positioning of the underlying assets of the securities, and are applicable to the current laws and regulations of the traditional securities market.

The characterization of tokenised securities, although the threshold is lowered considerably, indicates that the market is still a market for licensed institutions, such as licensed institutions providing Schedule 5 regulated activities under the Securities and Futures Ordinance – and third-party providers related to the technology of tokenised securities. After all, for real-world asset tokenization (RWA) in a broad sense, both the asset side and the capital side are in the hands of regulated traditional financial institutions.

What is imaginative is that comparing the qualitative nature of tokenized securities can bring imagination to the vast number of assets in China. The path of securitization of Chinese domestic assets to Hong Kong is feasible, so there are no obstacles to the subsequent tokenization path, and further discussion will be made in the future.

However, if tokenized securities are treated as securities, it will be very challenging for the current Hong Kong financial market to support a new funding market.

Our digital technology team continues to pay close attention to the regulatory rules and guidelines related to the virtual asset industry in major jurisdictions around the world, and has a deep industry understanding and rich legal compliance experience in the Web3 virtual asset industry, providing project compliance guidance and legal advice to many licensed institutions, fintech companies, investment funds, start-ups, etc. engaged in the virtual asset industry. Welcome to engage in the virtual asset industry related to real asset tokenization (RWA), STO, Fintech and other related projects to exchange and discuss.