Hong Kong strides towards a cashless society

The Hong Kong Payment Systems and Stored Value Facilities Ordinance (the Ordinance) came into effect on 13 November 2015. The Ordinance aims to minimise and manage the risks associated with payments through stored value facilities (SVFs). It does this by ensuring the safety and soundness of these emerging technologies insofar as they relate to financial stability. Following a 12-month transition period for applicants to get their house in order, the Hong Kong Monetary Authority (HKMA) has published on its website a register of 13 successful applicants for an SVF licence and 2 licensed banks who are regarded as SVF licensees. From 13 November 2016, existing SVF issuers and new entrants will need to have a licence before being able to launch SVF products (unless an exemption applies).

In this fourth installment of our Fintech e-bulletin series, we discuss the application of the Ordinance and what existing SVF issuers and new entrants should do to enter this emerging sector.

Background to, and application of, the Ordinance

The Ordinance establishes a mandatory licensing system which applies to issuers of multi-purpose SVFs and gives the HKMA the power to regulate the activities of SVF issuers.

Under the Ordinance, an SVF is a facility that is used for:

1. storing monetary value paid into it; and
2. making payments:(i) for goods or services, to the issuer of the facility (or their nominee); and/or (ii) to a person other than the issuer of the facility (or their nominee).

The Octopus Card and Alipay Wallet app are examples of device-based and non-device based SVFs, respectively. The Octopus Card is a physical card and is the primary payment system for public transport in Hong Kong. It is also commonly used as a method of payment in retail stores. The Alipay Wallet is a mobile app that links the user's Alipay account to their bank account. The app allows users to make payments from their smartphone by generating a QR (quick response) code from the app, and is accepted at a growing number of businesses in Hong Kong.

The Ordinance does not apply to a 'single-purpose' SVF, which is, broadly speaking, a facility used solely for enabling a person to pay for goods and services supplied by the issuer itself. An example is the Starbucks mobile app that allows users to load funds on their account and make payments at Starbucks stores while accumulating loyalty "stars". The Ordinance also sets out explicit exemptions for certain kinds of SVFs from the licensing regime. These include: SVFs used for cash reward schemes, purchases of digital products, bonus point schemes and SVFs used within a limited group of goods and services providers (e.g, a department store) or on certain premises (e.g. a restaurant located on the premises of a recreational club).

The Ordinance also permits the HKMA to grant an exemption to an SVF issuer if it is satisfied that the risks posed by the SVF to users and to Hong Kong's payment or financial system are 'immaterial'.

Licensing Criteria

With the exception of licensed banks, which are deemed under the Ordinance to be licensed as an issuer of SVFs, applicants will need to meet the criteria listed below in order to obtain a licence:

1. the applicant's principal business must be to issue, or to facilitate the issue of, SVFs;
2. the applicant's minimum on-going capital must be no less than HK$25 million (or an equivalent amount in any other currency approved by the HKMA);
3. the applicant's management must be 'fit and proper' persons, and officers responsible for implementing the SVF scheme or the day to day management of the scheme must have 'appropriate knowledge and experience';
4. the applicant must have in place appropriate risk management procedures and policies, including in relation to cybersecurity, float management, and preventing and combating possible money laundering or terrorist financing;
5. the applicant must allow users to redeem in cash and in full any outstanding stored value upon request; and
6. the operating rules of the SVF scheme must be 'prudent and sound', in that they should have a 'well-founded legal basis consistent with relevant law and regulations' and 'be enforceable'.

Extraterritorial application

The Ordinance purports to have extraterritorial effect on overseas SVF issuers. An overseas entity which issues (or appears to issue) an SVF in Hong Kong may fall within the scope of the Ordinance, and if so, would be required to hold an SVF licence. For example, if the SVF enables payments to be made in Hong Kong or is being provided to persons residing in Hong Kong, the SVF issuer is likely to need to obtain a licence. We also note that publication in Hong Kong or elsewhere of an invitation to the public relating to the issue of an SVF in Hong Kong could, in the absence of a licence, constitute a breach of the Ordinance.

Consequences of non-compliance

Any breach of the legislation may result in criminal and civil sanctions. Notably, a person who issues an SVF without a licence may be liable to 5 years imprisonment and a fine of HK$1 million. The HKMA is also empowered to impose civil sanctions, such as cautions and revocation or suspension of a licence, as well as pecuniary penalties of up to the greater of HK$10 million or three times the profit gained or loss avoided as a result of the breach.

What should existing SVF issuers and new entrants do?

With effect from 13 November 2016, existing SVF issuers will no longer be permitted to continue operating an SVF business unless they have obtained a licence (or an exemption applies).

Existing unlicensed SVF issuers which intend to continue their SVF business and any new players interested in moving into this space should consider the following before applying for a licence:

• Do we have legally binding and sound and prudent operating rules for our proposed SVF scheme?
• Do we have appropriate risk management policies and procedures in place in relation to cyber security, float management and the prevention of money laundering and terrorist financing?
• Do we need to review and update our personal data/privacy policies;
• What kind of IT controls should we implement?

Given the increasing attention Hong Kong's financial regulators have been giving to cyber security, and the fundamental importance of the successful take up of a SVF product, we consider that potential applicants should prioritise compliance with financial services regulatory requirements alongside the technological and security offerings of their products.

Promoting competition in the fintech sector

While there is a need to ensure that new forms of retail payment products and services in Hong Kong are regulated to ensure the security and integrity of payments for consumers and also for issuers, it is important to remember that technological advances are fast-paced and that developments in the law can often lag behind. There remains an impetus on Hong Kong's regulators to ensure that the legal and regulatory environment promotes the adoption of innovative technology so as to not hinder new competition from launching in Hong Kong, and ensuring Hong Kong keeps pace with other nations when it comes to developments and progress in fintech (see our e-bulletins of 30 September 2016 and 8 November 2016). Given the international nature of financial transactions, care also needs to be taken to avoid any unintended extraterritorial application of the legislation so as to not discourage new investment in Hong Kong.

Enhancing float protection measures and users' acceptance and confidence in SVF products and services is critical, but so is ensuring the law does not inhibit technological advancements. The current register of SVF licensees includes start-ups to later-stage companies, and suggests that the ground is ripe for Hong Kong's movement towards a cashless society.

Further help

If you would like to discuss the above further, please contact Damien Bailey, William Hallatt, Stella Loong, Siddhartha Sivaramakrishnan, Mark Robinson, Jy Millis, Grace Chong, or your usual Herbert Smith Freehills contact.