Q1. What is the statutory liability for transmitting specified information on behalf of another person without authorisation?
A VASP must first obtain written authorisation from the person concerned in respect of the relevant specified information. A VASP that transmits specified information on behalf of another person without authorisation commits an offence and is liable on conviction to a fine at level 3.
In accordance with the applicable Practice Guidelines and system arrangements, written authorisation may be given electronically through the TSW system, on paper or in another written form.
Q2. Must a VASP continue to provide transmission services for every approved class of specified information?
A VASP may apply under the Practice Guidelines to add or remove classes of specified information. It must retain at least one class in its scope at all times and should actively use each approved class in accordance with its actual business needs.
If a VASP does not transmit any specified information on behalf of any trader for a continuous period of two years and the Commissioner is satisfied that it is no longer fit to provide VASes, the Commissioner may revoke its approval without prior notice in accordance with the Governing Ordinances. If the inactivity relates only to a particular class for a continuous period of two years, the Commissioner may remove that class from the VASP’s scope of services. Such removal does not of itself constitute suspension or revocation of approval.
Q3. Must a VASP notify C&ED if it intends to cease carrying on business as a VASP or stop providing VASes?
Yes. As a general rule, a VASP must give the Commissioner not less than 60 calendar days’ prior written notice and submit a transition plan proportionate to the scale of its business. If giving 60 calendar days’ prior written notice is not practicable, the VASP must notify C&ED as soon as practicable and provide the required information.
The transition plan should cover notifying affected traders, helping them migrate to direct submissions or another approved VASP, following up outstanding government queries, and properly handling outstanding payments or client monies. Once the cessation notice has been given, the VASP must not accept new clients. On or after the effective date of cessation, it must not accept new authorisations, submission requests or payments.
Q4. How does C&ED monitor VASPs, and what action may it take in cases of non-compliance?
C&ED monitors compliance by VASPs with the Governing Ordinances, the Practice Guidelines and the Terms and Conditions on a risk basis. This may include:
- assessing their performance having regard to information and intelligence obtained;
- conducting inspections where necessary; and
- carrying out sampling checks on documents and records relating to transmissions and, where necessary, requiring supporting records to be produced.
Where non-compliance is identified and the statutory grounds for regulatory action are met, the Commissioner may, having regard to the nature, seriousness and frequency of the non-compliance, take action including issuing a warning letter or suspending or revoking the VASP’s approval.