CGj looks at the lessons to be learned from the collapse of the FTX and JPEX cryptocurrency exchanges – what went wrong and how can Hong Kong defend itself from these types of scenarios in the future.

Last year, advertisements for the JPEX cryptocurrency exchange were hard to miss in Hong Kong. They started appearing in MTR stations, on buses, trams and in the media, often with high profile influencers and celebrities recommending the high returns and low risks of trading on JPEX. 

That message was highly successful and JPEX grew rapidly, but its fall, like that of its larger and more infamous precursor FTX, was as swift as its ascent. FTX, which was valued at an estimated US$32 billion at its zenith, collapsed in the space of five days – its rival exchange Binance started selling its stake on 6 November 2022 and FTX filed for bankruptcy on 11 November. 

Similarly, the warning issued by the Securities and Futures Commission (SFC) on 12 September 2023 that JPEX was not licensed and was under investigation for possible fraud prompted a race to the exit by investors. On 14 September, JPEX raised withdrawal fees to the point where it effectively blocked certain withdrawals. Within a week, police had raided the exchange’s premises and started to arrest those involved in promoting the exchange.  

Both JPEX and FTX have since been high profile news stories. Sam Bankman-Fried (SBF), co-founder of FTX, has now been convicted of fraud in a US court. But what lessons should we learn from the demise of these trading platforms? Is this just another example of the high-risk nature of investing in crypto? Is this just another case of flagrant financial fraud?  

The answer to both questions, respondents interviewed by CGj suggest, is yes, but there are also deeper lessons for Hong Kong. 

Is Hong Kong’s VATP regulatory regime fit for purpose?

Once the JPEX case was referred to the police, questions started to be asked about whether the new virtual asset trading platform (VATP) regulatory regime in place since June 2023 is working. Moreover, did the SFC, as the primary regulator of VATPs, fail to move fast enough to protect investors? 

‘I have sympathy with the regulator,’ says Hannah Cassidy, Partner, Head of Financial Services Regulatory, Asia, Herbert Smith Freehills. ‘The SFC has done a huge amount since 2016 to acknowledge the rise in virtual asset related activity and has sought to grapple with that using the existing securities legislation.’ 

Jill Wong FCG HKFCG, Partner, Reed Smith Richards Butler LLP, is similarly minded. In a recent Institute seminar,  Corporate Governance: Lessons from FTX, JPEX and the Crypto World, she said that she did not agree with the suggestions that the SFC had been too slow to shut JPEX down. 

‘Personally, that is not my view,’ she said. ‘I think that the SFC acted quickly when it realised there was a problem in Hong Kong.’  

The SFC started investigating JPEX in March 2022 for suspected false and misleading representations and unlicensed activities. The notion that JPEX was a regulated exchange was one of the main reasons it was able to generate strong demand for its tokens. The SFC placed JPEX on its Alert List in July 2022 and made it clear that the exchange had not applied for a licence under Hong Kong’s VATP licensing regime.

Nevertheless, investors in JPEX are estimated to have lost in the region of US$1.5 billion – no small consideration. Does this not in itself point to a failure of Hong Kong’s VATP regulatory regime? Ms Cassidy doesn’t think so. She points out that the regime ‘wasn’t a case of just issuing more guidance’. It required the SFC to go back to basics and amend the Anti–Money Laundering and Counter–Terrorist Financing Ordinance (AMLO) to create a brand new regulatory framework. Moreover, Hong Kong already had in place measures to prevent false or misleading advertising of securities-type instruments under the Securities and Futures Ordinance (SFO).  

‘This regime has teeth,’ Ms Cassidy says. ‘It empowers the SFC to take disciplinary or even criminal action against wrongdoing, but it is difficult to enforce if the individuals involved are offshore.’  

Ms Wong agrees. She points out that the JPEX case is more about the difficulties any regulator would have when dealing with an operation that doesn’t have much of a presence on the ground locally.  

‘The law is extraterritorial and allows local authorities to catch malicious actors from overseas who actively market to the Hong Kong public, but it can be a challenge to enforce the law quickly and effectively. Overall, the SFC and police did a pretty good job,’ she says.  She adds that, while the SFC does have agreements and arrangements in place with offshore regulators, seeking their cooperation when pursuing cross-border investigations can slow the process down. Sometimes it is a balance – which case to pursue and how much time and resources to commit?

Investor education

Given the difficulty of regulating VATPs based overseas, effective investor education, particularly about the dangers of trading on an unlicensed exchange, becomes all the more important. Ms Cassidy points out that this is one of the main lessons that the SFC has learned from the JPEX case.  

The SFC now publishes lists clarifying the status of VATPs – whether they are licensed or ‘deemed licensed’, in the process of applying for a licence or being closed down. It has also made a dedicated list of suspicious VATPs easily accessible on its website. 

But will Hong Kong’s retail investing public be looking at these lists, and, even if they do, what will the names in those lists tell them? The licence applicant might well have a different name from the organisation behind the application. In this context, Ms Cassidy thinks that what is really needed is better targeted investor education beyond the regulator’s website. But she adds that this is certainly recognised by the SFC. Together with the Investor and Financial Education Council, the regulator intends to launch a public campaign to enhance investor education through mass media, social media and education talks. The campaign will focus on raising public understanding and awareness of the risks associated with virtual assets and potential fraud. 

‘I think the SFC and the government have recognised that this is an opportunity to enhance their investor communications. What the SFC needs to do, and what it has committed to do, is to provide more investor-facing education. So whether that’s through TV commercials, media articles or podcasts, they need to engage with investors in a way that is going to be meaningful to them,’ Ms Cassidy says.

Key considerations for the future

In recent years, Hong Kong has been keen to promote itself as a virtual assets hub – will that change in the wake of JPEX? Ms Cassidy thinks not. ‘JPEX has been a high-profile enforcement matter, but I think ultimately it’s probably a positive step for Hong Kong and for the SFC because it shows that Hong Kong needs a comprehensive licensing regime for crypto platforms,’ she says. 

While the aspiration to be a virtual assets hub is unlikely to change, there is likely to be more focus on maintaining high standards of investor protection in Hong Kong. Ms Cassidy highlights two core components of VATP regulatory regimes that are critical to ensuring investor protection.  

1. Custody arrangements

The governance failings of both JPEX and FTX are classic demonstrations of the need to keep client assets segregated from the exchange, and from any intermediaries trading on behalf of those clients. It emerged in the trial of SBF that customer funds on FTX were used to plug losses at Alameda Research, the hedge fund set up by SBF. 

‘If you use customer funds that are entrusted to you for specific purposes for your own personal purposes, then that’s just plain old-fashioned fraud and dishonesty,’ says Ms Wong.  

In addition to this segregation of customer assets, a good regulatory regime will also ensure that the beneficial title of those assets remains with the investors. This should mean that if the exchange or other intermediaries go insolvent, the clients still have access to their assets.  

‘Hong Kong’s regime is very clear around the types of custody arrangements that are permissible,’ Ms Cassidy says. ‘Effectively, you can only custody the virtual assets with a 100% owned subsidiary.’ 

In other words, if Company A is the applicant for a licence, it can’t self custody its client’s assets. Those assets needs to be parked with Company B, which needs to be a company within the same group. The SFC wants Company A to have an element of control, but there also needs to be a degree of separation so that, if Company A goes down, client assets don’t go down with it because they are separately held by Company B. 

Segregation of client assets and custody arrangements are an important part of the securities licensing regime, Ms Cassidy points out, and the SFC has imported a lot of similar concepts into Hong Kong’s VATP regime. 

2. Onboarding and suitability

Making sure that investors are aware of the risks they are taking on is not only the responsibility of regulators and a good VATP regime will also want to ensure that licence applicants have effective onboarding and suitability processes. This is not necessarily a question of limiting trading services to professional investors. It’s more a matter of having onboarding processes in place to ensure that anyone intending to trade on the platform understands the risks involved and has the funds and a risk profile suitable for such trading. 

Where do we go from here?

Ms Cassidy points out that the JPEX case demonstrates that jurisdictions, no matter how robust their legislation and regulatory regimes, cannot guarantee that investors will not get burned. ‘I suspect that JPEX won’t be the last bad actor out there,’ she says. 

On a more positive note, it also demonstrates that the new licensing regime in place in Hong Kong is there for a reason. Will licences be harder to come by in the wake of JPEX? Ms Cassidy expects to see, from February 2024, which is the deadline for applications to be submitted under the transitional arrangements, an increasing number of entities whose applications have been rejected because they were not able to meet the stringent standards that the SFC expects. Nevertheless, this is good for the companies who do attain the necessary standards to get a licence, she points out, as they are then clearly set apart from the bad actors.  

The seminar mentioned in this article – Corporate Governance: Lessons from FTX, JPEX and the Crypto World – was held in October 2023. More information about the Institute’s ECPD seminars is available on the Institute’s website: www.hkcgi.org.hk.  

SIDEBAR: Case studies in bad governance? 

The warning signs, in retrospect, were clearly visible in both the JPEX and FTX cases since key governance principles and controls were noticeably absent at both of the exchanges. Of particular relevance to readers of this journal was the absence of checks and balances on the power of the decision-makers. Creating an environment where there can be a constructive challenge of management is a key part of the work of governance professionals, but such an environment did not exist in JPEX or FTX.  

Ms Wong points out that all of the senior players in FTX and Alameda Research were close friends. While this in itself may not have been a problem, she adds, the fact that power and control was concentrated in the hands of SBF and his coterie of friends meant that no one else was in a position to effectively challenge their decisions and actions. 

Checks and balances on executive management are usually provided by the independent non-executive directors (INEDs) on the board. They are supposed to bring independent judgement to bear on the issues on the board’s agenda. They also take the lead where there are conflicts of interest and they sit on governance committees such as the audit committee, the remuneration committee and the nomination committee.  

‘In the FTX case, board oversight was effectively non-existent,’ Ms Wong points out.  

Reports show that when some brave individuals did come forward to highlight problems, they were pushed aside, she adds. A lawyer within the FTX group was sacked after expressing concerns about the lack of governance and risk management controls at Alameda Research. Moreover, when the president of FTX US spoke out about the lack of appropriate delegation of authority or formal management structure, his bonus was drastically reduced and he was instructed to apologise for raising such concerns.

Transparency was another key governance principle flouted by JPEX and FTX. Ms Cassidy points out that we still don’t know a huge amount about who was behind JPEX and what sort of governance structure they had in place. This in itself is a red flag, she says, and it is also the type of issue that would have had to have been addressed should JPEX have applied for a licence. 

‘We don’t know if they had the traditional board and executive management structure that most organisations have,’ Ms Cassidy says. ‘If they had intended to get a licence, the first questions they would have been asked by compliance specialists would be – how is the entity structured? Who is making decisions? Are there checks and balances on the decision-makers? Do you have a risk committee? Do you have a compliance person?’