APAC Crypto Regulators Move on Licensing and AML
Several Asia-Pacific regulators acted in the same short window, tightening crypto licensing requirements, publishing new anti-money laundering rules, and kicking off a live central bank digital currency trial. For accounting firms, auditors, and CFOs with any exposure to digital assets in the region, the combined effect is a sharply higher compliance baseline across multiple jurisdictions at once. Here is what happened and what it means for your practice.
Hong Kong: Mandatory Licensing Replaces the Opt-In Regime
The Hong Kong Securities and Futures Commission ended its voluntary "opt-in" approach to crypto exchange regulation. Under the previous framework, platforms could choose whether to seek SFC oversight. That choice no longer exists. The SFC's chief executive announced that all operators running crypto exchange services in Hong Kong must apply for a licence under a new mandatory licensing system.
What the change covers
The shift is designed to close the gap that allowed exchanges to operate in Hong Kong without meaningful regulatory visibility. The SFC's stated aim is to eliminate regulatory arbitrage, ensuring that no platform profits from a Hong Kong nexus while avoiding the standards that licensed entities must meet. Mandatory licensing also means mandatory AML and KYC obligations, conduct requirements, and ongoing supervisory reporting.
Accounting and audit implications
For accounting firms advising crypto businesses in Hong Kong, the licensing requirement triggers several workstreams immediately. Clients that previously sat outside the opt-in regime now face a formal application process, which will typically require audited financial statements, documented internal controls, and evidence of adequate AML procedures. Auditors should expect their crypto-exchange clients to request agreed-upon procedures engagements or readiness reviews ahead of submission. CFOs at those businesses need to ensure their crypto compliance reporting infrastructure can produce the data regulators will want to see on an ongoing basis. For a deeper look at what Hong Kong's 2026 crypto licensing deadline means in practice, including the specific bill provisions, see our earlier coverage.
South Korea: Privacy Coins Out, Bank AML Checks In
South Korea's financial intelligence unit published amendments expected to take effect in March 2021, building on the landmark AML legislation passed by the National Assembly the previous November. Two specific requirements stand out.
Privacy coin delisting requirement
The revised rules will prohibit exchanges from listing or trading privacy-enhancing coins. The rationale is straightforward: anonymity-enhancing technologies are incompatible with the transaction monitoring and suspicious activity reporting that AML regimes require. The practical market impact appears limited, since the last domestic exchange holding a Monero listing had already delisted it before the rules were finalised. Still, the prohibition signals that the Financial Intelligence Unit intends to eliminate the category entirely from the regulated market, not merely discourage it.
Bank due diligence on exchanges
Banks operating in South Korea will be required to conduct AML risk assessments and customer due diligence on the crypto exchanges they bank. This is a significant structural shift. It means that a bank's exposure to a crypto exchange is no longer simply a credit or operational risk question; it is now a formal AML supervisory obligation. Exchanges that cannot satisfy a bank's risk assessment will lose access to banking services, which is an existential commercial risk. For accounting firms, this creates advisory demand: exchange clients will need help structuring their AML documentation to survive bank scrutiny, and the banks themselves will need methodologies for assessing exchange risk.
Singapore: FATF-Aligned AML Proposals Published
The Monetary Authority of Singapore published its response to a public consultation that ran from late December 2019 through late January 2020, setting out proposed enhancements to Singapore's crypto AML regime. The proposals are explicitly designed to align with the Financial Action Task Force's global standards for virtual asset service providers.
Key direction of travel
The MAS consultation response strengthens the framework's tools for identifying and managing the risks that digital assets present. While the source document does not itemise every specific provision, the published direction aligns with FATF Recommendation 15, which requires countries to apply AML and counter-terrorism financing obligations to virtual asset service providers in a manner consistent with those applied to traditional financial institutions. For firms operating in Singapore, this means travel rule compliance, enhanced customer due diligence for higher-risk relationships, and transaction monitoring calibrated to crypto-specific red flags.
What compliance teams should do now
Any business that provides crypto services under a MAS licence or exemption should map its current procedures against the proposed enhancements and identify gaps. The alignment with FATF standards also matters for group-level compliance: if a firm's parent or affiliates operate under FATF-member jurisdictions elsewhere, the Singapore framework is now converging toward the same baseline. That simplifies group policy design but raises the bar for local implementation. For context on how AML red flags from crypto bridge hacks illustrate the kind of risk these frameworks are designed to catch, our earlier piece is worth reviewing.
Australia: Wholesale CBDC Proof-of-Concept Launches
The Reserve Bank of Australia announced a partnership with Commonwealth Bank, National Australia Bank, Perpetual, and ConsenSys Software to develop a proof-of-concept for a wholesale central bank digital currency. The project will use an Ethereum-based distributed ledger platform.
Scope of the pilot
According to the Reserve Bank's project description, the proof-of-concept will explore issuing a tokenised form of CBDC that wholesale market participants can use for funding, settling, and repaying a tokenised syndicated loan. This is a narrow but technically meaningful scope: it targets interbank and institutional settlement, not retail payments. The choice of Ethereum-based infrastructure is notable because it suggests the RBA is evaluating public or permissioned blockchain architecture rather than a fully proprietary system.
Accounting treatment questions raised by tokenised CBDC
A tokenised wholesale CBDC used in syndicated loan settlement raises accounting questions that practitioners should begin thinking about now, even at proof-of-concept stage. If a tokenised CBDC is legally a claim on the central bank, its accounting treatment under IFRS 9 should mirror that of a cash equivalent or central bank deposit. However, the settlement mechanics, especially if the token is locked in a smart contract during the loan lifecycle, may create timing differences between legal transfer and the accounting derecognition of a financial asset. Auditors and CFOs at participating institutions should document their treatment assumptions before the pilot reaches any live transaction stage.
Cayman Islands: Phase One AML Registration Live
The Cayman Islands Ministry of Financial Services activated Phase One of its crypto AML and counter-terrorism financing framework. From 31 October, all crypto businesses operating in the Territory are required to register with the Cayman Islands Monetary Authority and comply with the new rules. Phase Two, covering a full licensing regime and prudential supervision, is expected to follow in June 2021.
Context: CFATF re-rating pressure
The Cayman Islands is implementing this framework partly to improve its effectiveness ratings under the Caribbean Financial Action Task Force mutual evaluation process. That context matters for firms with Cayman-domiciled fund structures holding digital assets. A stronger AML regime in the Cayman Islands increases the credibility of those structures in the eyes of counterparties and correspondent banks globally, but it also means that fund administrators and GPs will face registration obligations and ongoing AML compliance requirements they may not have planned for.
Cross-Border Enforcement: Brazil and the US DoJ Seizure
A large Brazilian crypto fraud investigation resulted in the US Department of Justice assisting Brazilian authorities under a mutual legal assistance request. Brazilian law enforcement estimated that the scheme defrauded tens of thousands of Brazilian citizens, with losses exceeding $200 million in total. The US DoJ's Money Laundering and Asset Recovery Section and Office of International Affairs, working alongside an FBI legal attaché in Brasilia, coordinated the seizure of approximately $24 million in crypto assets held at exchanges. Those exchanges cooperated with law enforcement and assisted in executing the seizure.
KYC and record-keeping lessons
The cooperative response from the exchanges involved underlines a point that compliance teams sometimes underestimate: thorough KYC records and transaction histories are not only a regulatory obligation, they are the operational foundation for responding to law enforcement requests quickly. Firms that maintain clean, auditable records can cooperate efficiently and protect their own reputation. Those that cannot risk being seen as obstructive, even when they are not. For digital asset accounting software to be useful in an enforcement context, it needs to produce records that are traceable, timestamped, and complete, not just adequate for the year-end close.
Venezuela and Sanctions Risk
Venezuela's government-linked Patria exchange announced plans to integrate Bitcoin and Litecoin wallets fully into its remittance platform, alongside the state-issued Petro. A Bitcoin-Petro trading pair is also planned. US authorities have flagged these developments as a potential sanctions evasion mechanism.
Sanctions screening obligations
For compliance teams, the Venezuela situation is a clear reminder that sanctions risk in crypto does not require direct dealing with a sanctioned entity. Correspondent-style exposure, where a platform facilitates transactions that ultimately benefit sanctioned parties or jurisdictions, can be enough to trigger liability. Any firm using crypto bookkeeping software or digital asset accounting software should confirm that its transaction screening covers counterparty wallet addresses and that the underlying data is refreshed against current sanctions lists, not a static snapshot.
UK Registration Deadline Approaching
The source notes that crypto businesses operating in the UK faced a registration deadline of 10 January 2021 under the Financial Conduct Authority's AML registration regime. While that specific deadline has passed, the underlying principle is live: firms operating in the UK without FCA registration are in breach of the Money Laundering Regulations. Any firm with UK operations that has not confirmed its registration status should do so immediately.
Frequently Asked Questions
Does Hong Kong's mandatory licensing apply to exchanges incorporated outside Hong Kong?
The SFC's position is that any platform operating exchange services in or from Hong Kong requires a licence. The relevant test is not only where the entity is incorporated but where it conducts business and who its customers are. Firms with any Hong Kong nexus, including marketing or client onboarding directed at Hong Kong users, should take legal advice on whether the requirement applies to them.
How should banks approach AML risk assessments on crypto exchanges under the South Korean framework?
The South Korean amendments require banks to conduct AML risk assessments and due diligence on exchange clients. In practice, this is likely to mirror correspondent banking due diligence: reviewing the exchange's own AML policies, transaction monitoring capabilities, KYC procedures, and ownership structure. Exchanges should prepare a compliance pack covering these areas proactively, rather than waiting for a bank request.
What accounting treatment applies to a tokenised wholesale CBDC under IFRS?
A tokenised CBDC that represents a direct claim on a central bank would generally be classified as cash or a cash equivalent under IAS 7, provided it meets the standard's criteria. However, if the token is held in a smart contract with restricted transferability during a settlement process, the locked position may need to be reclassified as a receivable or other financial asset until the restriction lifts. Practitioners should document the legal and contractual terms carefully before settling on a treatment.
Does cooperation with law enforcement in a crypto seizure create accounting or tax consequences for the exchange?
Generally, an exchange that holds customer assets subject to a law enforcement seizure order is acting as a custodian and transferring assets it does not own. That transfer should not give rise to a gain or loss in the exchange's own financial statements. However, the exchange may face costs related to the cooperation process, such as legal fees, which should be expensed as incurred. Tax treatment will depend on jurisdiction-specific rules and the precise structure of the custodial arrangement.
How should firms screen for Venezuela-related sanctions risk in crypto transactions?
Firms should maintain real-time or near-real-time screening of wallet addresses against OFAC's Specially Designated Nationals list and equivalent lists in their own jurisdictions. The Petro has been subject to US executive order restrictions. Any transaction that touches a wallet associated with Venezuelan government entities or the Petro ecosystem should be escalated for enhanced review before processing. Static, periodic screening is not sufficient for high-volume transaction environments.
Source: Elliptic