Circular on staking services provided by virtual asset trading platforms

This circular sets out the Securities and Futures Commission's (SFC) regulatory approach and expected standards in respect of SFC-licensed virtual asset trading platforms (VATPs) that wish to provide staking as a service to its clients.

A VATP which provides staking services to its clients should ensure that it and its associated entity observe the expected standards in this circular and as imposed by way of licensing conditions.

In the Guidelines for Virtual Asset Trading Platform Operators published on 1 June 2023 (VATP Guidelines), paragraph 7.26(b) provides that VATPs should not make any arrangements with their clients on using the client virtual assets (VAs) held by the VATPs or their associated entities with the effect of generating returns for the clients or any other parties.

We have noted investors' demand for staking services, and the potential for staking activities to contribute to the security of the blockchain network. The SFC is now prepared to allow VATPs to provide staking services to clients by modifying the conditions imposed on the VATP licence, in order to meet investors' demand and support the development of the virtual asset ecosystem in Hong Kong.

In this circular, staking services refer to any arrangements which involve the process of committing or locking client VAs for a validator to participate in a blockchain protocol's validation process based on a proof-of-stake consensus mechanism, with returns generated and distributed for that participation (Staking Services).

A VATP should maintain possession or control of all mediums through which the client VAs may be withdrawn from the Staking Services¹. In this connection, VATPs should bear in mind that custody of client VAs by third party service providers is not permitted.

A VATP should maintain effective policies to prevent or detect errors and other improper activities associated with its Staking Services and ensure the 'staked' client VAs are adequately safeguarded. It should also implement internal controls to manage operational risks and address conflicts of interest that may arise. Operational rules governing the provision of Staking Services should be in place.

VATPs should provide the SFC with any information in relation to its Staking Services as requested from time to time.

A VATP should disclose on its website and mobile application (if applicable) general information about its Staking Services. This includes the specific VAs for which the VATP provides Staking Services, any third parties involved in providing such services, fees and charges, minimum lock-up periods, unstaking process and its length, arrangements during outages, business resumption arrangements and custodial arrangements.

A VATP should disclose the risks that clients may be exposed to in using its Staking Services, including the types and nature of additional risks that the 'staked' client VAs may be subject to, and the manner in which losses relating to such risks would be dealt with. Examples of these additional risks are: slashing risk, lock-up risk, blockchain technical error/bug risk, hacking risk and inactivity risk relating to the validators, and the legal uncertainty relating to staking which may affect the nature and enforceability of a client's interest in the 'staked' client VAs.

A VATP should act with due skill, care and diligence when including a blockchain protocol for providing Staking Services. It must perform all reasonable due diligence and ensure that its internal controls and systems, technology and infrastructure can support the provision of Staking Services in that blockchain protocol and manage any risks arising from it.

Where the provision of Staking Services involves outsourcing to a third party service provider, a VATP should perform proper due diligence and conduct ongoing monitoring on the third party. For example, the VATP should look into the third party service provider's experience and track record in participating in the validation process of a particular blockchain protocol, its technology infrastructure and risk mitigation measures, and its security measures including security controls.

VATPs interested in providing Staking Services should obtain the SFC's prior written approval. The SFC will impose specific conditions (Terms and conditions for providing staking services) (see the Appendix to this circular) on a VATP's licence before it may provide Staking Services.

For enquiries relating to this circular, please contact the SFC Fintech unit at fintech@sfc.hk.