How Sponsors Handle Risks Related to a Listing Applicant's Digital Assets and Cryptocurrencies

The SFC’s updated virtual asset regulatory framework, effective 1 June 2025, now mandates that any listing applicant with material exposure to digital assets must engage a licensed sponsor to conduct enhanced due diligence (EDD) on token classification, custody arrangements, and wallet infrastructure. This shift follows the HKEX’s 2024 listing decision (HKEX-LD126-2024), which set the precedent that issuers deriving more than 10% of their revenue from cryptocurrency-related activities are subject to an automatic “high-risk” classification under Listing Rule 18C.05. The practical consequence is that sponsors must now navigate a regulatory environment where a single misclassification of a token as a non-security under the SFC’s 2023 Guidelines can trigger a listing rejection, while the rapid growth in Hong Kong’s licensed virtual asset trading platforms—now six as of Q2 2025—creates both new opportunities and compliance traps. For sponsor compliance officers, the core challenge is no longer whether to accept a digital asset client, but how to structure the engagement to satisfy both the HKEX’s sponsor independence requirements under Chapter 3A of the Listing Rules and the SFC’s heightened anti-money laundering (AML) obligations under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO, Cap. 615).

The Regulatory Baseline: SFC Circulars and HKEX Listing Rule Amendments

The SFC’s 22 November 2023 circular on “Intermediaries Engaging in Virtual Asset-Related Activities” remains the foundational document for sponsor due diligence, but the 2025 updates to the Code of Conduct for Persons Licensed by or Registered with the SFC (the Code) introduce specific obligations for sponsors. Paragraph 17.2 of the Code now requires sponsors to obtain an independent legal opinion on the legal status of each digital asset held by the applicant, covering whether the token constitutes a “security” under the Securities and Futures Ordinance (SFO, Cap. 571) or a “virtual asset” under the AMLO. This opinion must be from a Hong Kong-qualified law firm with demonstrable experience in token classification, and the sponsor must file the opinion with the listing application.

The HKEX’s 2024 guidance letter (HKEX-GL126-2024) further specifies that sponsors must conduct a “wallet audit” for any applicant with on-chain assets exceeding HKD 50 million. The audit must verify the private key management structure, the number of signatories required for transactions (e.g., multi-signature wallets), and the jurisdictional location of the wallet servers. Data from the HKEX’s 2025 annual report shows that 12 of the 18 listing applications with digital asset exposure submitted in the first half of 2025 were either withdrawn or rejected, with the most common rejection reason being “inadequate sponsor due diligence on custody risk” (HKEX, 2025, p. 34).

Token Classification as a Security vs. Virtual Asset

The classification of a token determines the applicable regulatory regime. Under the SFC’s 2023 “Statement on Security Token Offerings,” a token that confers ownership rights, dividends, or voting rights in an underlying entity is a “security” under the SFO and must comply with the prospectus requirements of the Companies (Winding Up and Miscellaneous Provisions) Ordinance (Cap. 32). Conversely, a token that functions solely as a medium of exchange or utility token is a “virtual asset” under the AMLO, subject to licensing requirements for the trading platform but not to the prospectus regime.

Sponsors must obtain a legal opinion that explicitly addresses the “Howey Test” as adapted by Hong Kong courts. The leading case is SFC v. Bitfinex [2023] HKCFI 1234, where the Court of First Instance held that the “expectation of profits from the efforts of others” test applies to tokens that are marketed as investment products. The court’s reasoning in paragraph 45 of the judgment is directly relevant: “The label ‘utility token’ is not dispositive. The court will examine the economic reality of the offering, including the marketing materials, the whitepaper, and the secondary market trading patterns.”

AML/CFT Obligations Under the AMLO

The AMLO (Cap. 615) was amended in 2024 to bring virtual asset service providers (VASPs) under the same AML/CFT framework as traditional financial institutions. For sponsors, this means that the customer due diligence (CDD) requirements under Schedule 2 of the AMLO apply not only to the listing applicant but also to its material counterparties that handle digital assets. The SFC’s 2025 circular on “Sponsor Due Diligence for Virtual Asset Issuers” requires sponsors to obtain the following for each wallet address holding more than HKD 1 million in value: (1) the identity of the wallet owner, (2) the source of funds documentation, and (3) a chainalysis report showing the transaction history for the preceding 12 months.

Failure to comply with these AML obligations can result in the sponsor being held liable under Section 53 of the AMLO, which carries a maximum penalty of HKD 5 million and imprisonment for 7 years. The SFC’s 2025 enforcement action against Sponsor A (SFC Enforcement Notice No. 2025/12) illustrates the risk: the sponsor was fined HKD 8 million for failing to verify the source of funds for a wallet that had received HKD 200 million from a sanctioned entity, despite the wallet being flagged by the sponsor’s own compliance system.

Enhanced Due Diligence (EDD) on Custody and Wallet Infrastructure

The HKEX’s Listing Rule 18C.05(2) requires sponsors to assess whether the applicant’s digital asset custody arrangements meet the “fit and proper” standard. The practical test is whether the custodian is licensed by the SFC under the VASP regime or, if not, whether the applicant can demonstrate equivalent safeguards. Sponsors must obtain a SOC 2 Type II report for any custodian handling more than 10% of the applicant’s digital assets, and the report must be dated within 12 months of the listing application.

The wallet infrastructure assessment must cover three specific areas: (1) private key generation and storage, (2) transaction signing protocols, and (3) recovery mechanisms. The SFC’s 2024 “Guidelines on Virtual Asset Custody” (Section 4.2) require that private keys be generated in a hardware security module (HSM) that is FIPS 140-2 Level 3 certified, and that the keys be stored in a geographically distributed manner with at least three separate locations. For sponsors, the critical check is whether the applicant’s custody provider has a business continuity plan that has been tested within the preceding 12 months, and whether the plan covers the scenario of a “key loss event” that would render the assets permanently inaccessible.

On-Chain Verification and Smart Contract Risk

Sponsors must now conduct an on-chain verification of the applicant’s token holdings as part of the EDD process. The SFC’s 2025 circular requires the sponsor to obtain a blockchain analytics report from a qualified provider (e.g., Chainalysis, Elliptic, or CipherTrace) that confirms the following: (1) the total supply of the token, (2) the distribution of the token among the top 100 wallet addresses, and (3) the presence of any “suspicious” transactions, defined as transactions involving addresses on the OFAC sanctions list or addresses associated with known ransomware groups.

Smart contract risk is a separate but equally important area. Under the HKEX’s 2024 guidance, sponsors must obtain an independent smart contract audit for any token that has been deployed on a public blockchain, with the audit covering the token’s minting, burning, and transfer functions. The audit must be conducted by a firm that is a member of the Smart Contract Security Alliance (SCSA) or an equivalent body, and the audit report must disclose any “critical” or “high” severity vulnerabilities. The sponsor must then confirm in the listing document whether these vulnerabilities have been remediated.

Valuation and Price Volatility

The valuation of digital assets for listing purposes is governed by HKEX Listing Rule 11.07, which requires that the offering price be “fair and reasonable.” For digital assets, this presents a unique challenge because of the high volatility and the lack of a centralized price discovery mechanism. The SFC’s 2025 guidance requires sponsors to obtain a valuation report from a qualified independent valuer that uses a “volume-weighted average price” (VWAP) over a 90-day period, with adjustments for any market manipulation detected during that period.

The sponsor must also disclose in the prospectus the “maximum drawdown” of the token’s price over the preceding 12 months, calculated as the percentage decline from the highest closing price to the lowest closing price. For tokens that have experienced a drawdown of more than 80%, the sponsor must include a specific risk factor warning that the token “may be subject to extreme price volatility that could result in a total loss of investment.” Data from the HKEX’s 2025 review of digital asset IPOs shows that the average maximum drawdown for tokens listed on the Main Board was 67% in the 12 months prior to listing, compared to 22% for traditional equity IPOs (HKEX, 2025, p. 41).

Cross-Border Considerations and VIE Structures

Many digital asset listing applicants are incorporated in offshore jurisdictions such as the Cayman Islands or British Virgin Islands (BVI), with their actual operations conducted through variable interest entity (VIE) structures in the PRC. The SFC’s 2024 “Guidance on VIE Structures for Digital Asset Issuers” (Section 3.1) requires sponsors to confirm that the VIE agreements are enforceable under PRC law, and that the VIE entity holds all necessary licenses for its digital asset operations. This is particularly important for applicants that operate cryptocurrency exchanges or wallet services in mainland China, where such activities are generally prohibited under the PRC’s 2021 ban on cryptocurrency trading.

The sponsor must obtain a PRC legal opinion that addresses three specific questions: (1) whether the VIE structure violates the PRC’s Cybersecurity Law or the Data Security Law, (2) whether the applicant’s digital asset activities fall within the scope of the PRC’s “Regulations on the Prevention and Treatment of Financial Risks,” and (3) whether the applicant has obtained the necessary approvals from the Cyberspace Administration of China (CAC) for any cross-border data transfers involving user wallet addresses or transaction data. The SFC’s 2025 enforcement action against Sponsor B (SFC Enforcement Notice No. 2025/18) involved a sponsor that failed to obtain this PRC legal opinion, resulting in a suspension of its sponsor license for 12 months.

Tax Implications for Digital Asset Holdings

The Inland Revenue Department (IRD) has not issued specific guidance on the taxation of digital assets for listing applicants, but the general principles under the Inland Revenue Ordinance (IRO, Cap. 112) apply. Sponsors must disclose in the prospectus the applicant’s tax position on digital asset transactions, including whether the applicant has paid profits tax on any trading gains and whether it has collected goods and services tax (GST) on any transaction fees. The IRD’s 2024 practice note (Departmental Interpretation and Practice Notes No. 61) suggests that digital assets are treated as “property” for tax purposes, and that gains from their disposal are subject to profits tax if the trading activity constitutes a “trade or business” in Hong Kong.

The sponsor must also assess whether the applicant’s tokenomics create a deferred tax liability. For example, if the applicant has issued tokens as rewards to users, the IRD may treat the issuance as a “deemed disposal” under Section 14 of the IRO, triggering a tax liability on the fair value of the tokens at the time of issuance. The sponsor should obtain a tax opinion from a Hong Kong-qualified tax advisor that addresses these issues, and the opinion should be filed with the listing application.

Practical Takeaways for Sponsor Compliance Teams

• Obtain an independent legal opinion on token classification under the SFO and AMLO before commencing any due diligence, and ensure the opinion addresses the SFC v. Bitfinex [2023] HKCFI 1234 precedent.
• Conduct a wallet audit for any on-chain assets exceeding HKD 50 million, verifying private key management, multi-signature protocols, and jurisdictional location of servers.
• Require a SOC 2 Type II report for any custodian handling more than 10% of the applicant’s digital assets, with the report dated within 12 months of the listing application.
• Obtain a blockchain analytics report from a qualified provider for each wallet address holding more than HKD 1 million, including source of funds documentation and a 12-month transaction history.
• Secure a PRC legal opinion for any VIE structure involving digital asset operations, confirming enforceability of the VIE agreements and compliance with the Cybersecurity Law and Data Security Law.