FSC Guidance Notes - Security Token Offerings and Security Token Trading Systems

Fintech Series Guidance Notes No. 3 Security Token Offerings and Security Token Trading Systems 1. Background 1.1. The Financial Services Commission, Mauritius ("FSC"), the integrated regulator for the non-banking financial services and global business sectors, remains highly supportive of Fintech-related initiatives in Mauritius. 1.2. These Guidance Notes are issued by the FSC pursuant to its powers under section 7(1) (a) of the Financial Services Act 2007 (the "FSA"). 1.3. The objective of these Guidance Notes is to provide for the implementation of a common set of standards for Security Token Offerings ("STO") and the licensing of Security Token Trading Systems in Mauritius. 1.4. The Guidance Note neither derogates nor restricts the powers vested upon the FSC by statute, and should be read together with the relevant Acts as well as guidelines and Circulars issued by the FSC. 1.5. The Guidance Notes form part of 'guidelines' issued by the FSC pursuant to its powers under section 7(1) (a) of the FSA. Breaches of the Guidance Notes may entail regulatory sanctions. In addition, the FSC may direct any licensee to comply Page 2 of 15 Financial Services Commission FSC House, 54 Cybercity Ebene, 72201 Mauritius T: (+230) 403-7000 F: (+230) 467-7172 E: fscmauritius@intnet.mu www.fscmauritius.org with the Guidance Note or any part of thereof and failure to do so shall constitute a contravention of the law and may lead to prosecution. PART I – SECURITY TOKEN OFFERINGS 2. Definition of Security Token 2.1. "Security Tokens" are "securities" as defined in the Securities Act 2005 (the "SA"), represented in digital format. 2.2. By way of illustration, a Security Token may constitute: 2.2.1. a share, where it confers or represents ownership or economic rights of the holder of the security token in a corporation; 2.2.2. a debenture, where it constitutes or evidences the indebtedness of the issuer of the Security Token in respect of any money lent to the issuer by a holder of the Security Token; 2.2.3. a derivative, whether on securities or commodities; or 2.2.4. a unit in a collective investment scheme ("CIS"), where it represents a right or interest in a CIS including an option to acquire a right or interest in a CIS. Page 3 of 15 Financial Services Commission FSC House, 54 Cybercity Ebene, 72201 Mauritius T: (+230) 403-7000 F: (+230) 467-7172 E: fscmauritius@intnet.mu www.fscmauritius.org The list provided in paragraph 2.2 is not intended to be exhaustive. In determining whether a Digital Asset1 falls within the definition of "securities" under the SA, the FSC will be adopting a look through approach and consider the structure and characteristics of, including the rights attached to, the digital asset. 3. Security Token Offerings 3.1. An STO means the issue of Security Tokens, as a method of raising funds from investors, in exchange for the ownership or economic rights in relation to assets. 3.2. The offering of Security Tokens shall be subject to the SA and any Regulations or FSC Rules issued thereunder including the requirement for a prospectus, as may be applicable. 4. Issuers of Security Tokens 4.1. The following entities may issue Security Tokens – 4.1.1. Entities registered as Reporting Issuers defined under section 86(1) of the SA as an issuer- (a) who by way of a prospectus, has made an offer of securities either before or after the commencement of the SA; 1 For the purposes of these Guidance Notes, "Digital Assets" will have the same meaning as defined under rule 2 of the Financial Services (Custodian services (digital asset)) Rules 2019. This definition is aligned with the interpretation of the term "Virtual Asset" in The Financial Action Task Force (FATF) Recommendations as updated in October 2018. Page 4 of 15 Financial Services Commission FSC House, 54 Cybercity Ebene, 72201 Mauritius T: (+230) 403-7000 F: (+230) 467-7172 E: fscmauritius@intnet.mu www.fscmauritius.org (b) who has made a takeover offer by way of an exchange of securities or similar procedure; (c) whose securities are listed on a securities exchange in Mauritius; or (d) who has not less than 100 shareholders. 4.1.2. Collective Investment Schemes authorised as Expert Funds or Professional Collective Investment Schemes ("PCIS") as follows – (a) Pursuant to Regulation 78(a) of the Securities (Collective Investment Schemes and Closed-end Funds) Regulations 2008 ("CIS Regulations"), an expert investor means: i. an investor who makes an initial investment, for his own account, of no less than US$ 100 000; or ii. a sophisticated2 investor as defined in the SA or any similarly defined investor in any other securities legislation. (b) A PCIS means a collective investment scheme or a closed-end fund (as may be applicable) referred to in Regulation 75 of the CIS Regulations. 2 The term "Sophisticated Investor" is defined in section 2 of the SA. Page 5 of 15 Financial Services Commission FSC House, 54 Cybercity Ebene, 72201 Mauritius T: (+230) 403-7000 F: (+230) 467-7172 E: fscmauritius@intnet.mu www.fscmauritius.org 4.1.3. Any such other issuer as may be deemed appropriate by the FSC. 4.2. Issuers of Security Tokens, which are registered as Reporting Issuers, will be required to comply with the disclosure requirements that are provided under Part VI of the SA and the Securities (Disclosure Obligations of Reporting Issuers) Rules 2007. 5. Requirement for a prospectus 5.1. Offers of Security Tokens are subject to the same regulatory regime under Part V of the SA as offers of securities made through traditional means. 5.2. A person shall be deemed to make an offer or distribution of Security Tokens where that person invites or solicits another person – (a) to purchase or subscribe to Security Tokens that have never been issued; (b) to enter into an agreement for the underwriting of Security Tokens; (c) to purchase Security Tokens underwritten; (d) to distribute Security Tokens previously offered without a prospectus; or (e) to purchase Security Tokens, other than Security Tokens acquired on a securities exchange or a trading securities system in normal market operations, previously issued and held by a person, including an issuer, and where the offer or distribution is made from Mauritius, or received in Mauritius. Page 6 of 15 Financial Services Commission FSC House, 54 Cybercity Ebene, 72201 Mauritius T: (+230) 403-7000 F: (+230) 467-7172 E: fscmauritius@intnet.mu www.fscmauritius.org 5.3. Pursuant to Section 68(1) (b) of the SA, no person shall make an offer of Security Tokens to the public unless the offer is made in a prospectus. The procedures for the registration of a prospectus are provided for in the Circular Letter (CL240915) issued by the FSC on 24 September 2015. 5.4. Circumstances where a prospectus will not be required are provided under section 70 of the SA. PART II – SECURITY TOKEN TRADING SYSTEMS 6. Security Token trading systems 6.1. Security Token trading systems are trading systems which are designed to allow for the trading of Security Tokens. 6.2. Security Token trading systems are different from traditional securities exchanges inasmuch as they do not require clearing and settlement facilities. They are usually pre-funded allowing transactions to be cleared automatically on the systems on a T+0 basis. 6.3. Moreover, such systems may be accessed directly by clients to execute their trade without the requirement for a third-party intermediary to place the orders on their behalf. Page 7 of 15 Financial Services Commission FSC House, 54 Cybercity Ebene, 72201 Mauritius T: (+230) 403-7000 F: (+230) 467-7172 E: fscmauritius@intnet.mu www.fscmauritius.org 7. Licensing of Security Token trading systems 7.1. The FSC shall license Security Token trading systems under section 11 of the SA. Hence, any person wishing to establish, maintain or operate a system for the trading of Security Tokens in Mauritius shall apply for a Trading Securities System licence. 7.2. According to section 15 of the SA, a Trading Securities System ("TSS") may make rules, not inconsistent with the SA, any regulations made under the SA or any FSC Rules, for or with respect to the operation of the TSS. 7.3. Prior to the granting of the licence, the FSC shall ensure that the rules of the TSS include the following – 7.3.1.1. The types of Security Tokens that will be traded on the TSS; 7.3.1.2. The client on boarding process including customer due diligence checks, admission criteria and other procedures to trade on the TSS; 7.3.1.3. The listing process and the minimum listing requirements; 7.3.1.4. The order execution rules; 7.3.1.5. The arrangements put in place for the safekeeping of the Security Tokens and fiat currency; 7.3.1.6. Details regarding whether access to trading information is equitable for all investors; Page 8 of 15 Financial Services Commission FSC House, 54 Cybercity Ebene, 72201 Mauritius T: (+230) 403-7000 F: (+230) 467-7172 E: fscmauritius@intnet.mu www.fscmauritius.org 7.3.1.7. Post trade reporting and publication; 7.3.1.8. Compliance with prudential and other requirements designed to support the operations of the TSS and reduce the risk of non- completion of transactions; 7.3.1.9. Procedures in cases of trading disruptions; 7.3.1.10. The arrangements made by the TSS for the monitoring, surveillance and supervision of the TSS to ensure fairness, efficiency, transparency and investor protection as well as compliance with the SA; 7.3.1.11. Governance, internal controls and risk management procedures put in place; 7.3.1.12. Cybersecurity measures put in place; 7.3.1.13. AML/CTF systems in place; and 7.3.1.14. Arrangements to ensure compliance with applicable laws and regulations of the jurisdiction in which the Security Tokens will be offered for trading, where appropriate. 8. Minimum Capital Requirements 8.1. A TSS shall, at all times, be required to have and maintain a minimum stated unimpaired capital of 35 million rupees or an equivalent amount. Page 9 of 15 Financial Services Commission FSC House, 54 Cybercity Ebene, 72201 Mauritius T: (+230) 403-7000 F: (+230) 467-7172 E: fscmauritius@intnet.mu www.fscmauritius.org 8.2. Capital must be held in fiat currency. 9. Professional Indemnity Insurance The holder of a TSS licence shall subscribe to an adequate professional indemnity insurance policy which shall indemnify the TSS, its employees and any person acting on its behalf against liability for any act, error or omission in the conduct of its operations. 10. Management and Control 10.1. The TSS shall comply with all requirements applicable under the relevant Acts. 10.2. The TSS shall — (a) perform its functions so as to ensure fairness, efficiency and transparency of transactions effected through the TSS; (b) publish daily and periodic information, indices and averages on its activities in order to ensure transparency and equity to investors; (c) submit to the FSC its trading logs and the information at sub-paragraph (b) at such intervals as the FSC may request. 10.3. The TSS shall also comply with the relevant and applicable Principles for Financial Market Infrastructures (FMIs) issued by the Committee on Payments and Market Infrastructures (CPMI) of the International Organization of Securities Commissions (IOSCO). Page 10 of 15 Financial Services Commission FSC House, 54 Cybercity Ebene, 72201 Mauritius T: (+230) 403-7000 F: (+230) 467-7172 E: fscmauritius@intnet.mu www.fscmauritius.org 10.4. A TSS shall, at all times: (a) be controlled and managed from Mauritius; (b) demonstrate adequate office premises and IT infrastructure from which it shall perform its core functions in Mauritius; and (c) be managed by a board composed of a minimum of 3 directors, of which at least – (i) 30 per cent shall be independent directors; and (ii) one shall be resident in Mauritius. 10.5. The Board of a TSS shall, at all times, consist of adequate number of directors having experience in the operations of such TSS. 10.6. A director of a TSS has a duty to act in the best interests of investors and, where there is a conflict between the interests of the investors and the interests of the TSS, the director shall give priority to the interests of the investors. 11. IT Audit 11.1. The TSS shall be required to appoint an external and independent third party to undertake an audit of its IT systems and processes at least once every year. 11.2. The external and independent third party shall be required to have the appropriate competence in line with best industry standards and practices. Page 11 of 15 Financial Services Commission FSC House, 54 Cybercity Ebene, 72201 Mauritius T: (+230) 403-7000 F: (+230) 467-7172 E: fscmauritius@intnet.mu www.fscmauritius.org 11.3. The TSS shall notify the FSC of the identity of the external and independent third party, and shall submit to the FSC – (a) full particulars of the external and independent third party; and (b) an undertaking that the external independent third party is fit and proper to undertake the IT audit. The FSC may object to the appointment of the external and independent third party if it considers that the external independent third party is not fit and proper to undertake the IT audit. 11.4. The TSS shall submit the report of the external and independent third party for the consideration of its board and shall address any shortcomings identified in the report. 11.5. Records of such audits and any remedial actions implemented shall be maintained by the TSS and made available to the FSC for inspection, upon request. 12. Cybersecurity 12.1. The TSS shall be required to develop and apply proper safeguards to ensure that its systems and networks are fully protected, consequently limiting or containing the impact of a possible cybersecurity breach. 12.2. The TSS shall be required to identify a person to act as Chief Technology Officer ("CTO") or any other relevant designation and who shall be responsible for Page 12 of 15 Financial Services Commission FSC House, 54 Cybercity Ebene, 72201 Mauritius T: (+230) 403-7000 F: (+230) 467-7172 E: fscmauritius@intnet.mu www.fscmauritius.org establishing, maintaining and overseeing the internal cybersecurity architecture of the TSS. 12.3. The CTO shall carry out a self-assessment, at least once every year, to examine the probability of a cyber-attack, and other threats affecting the cyber security of the TSS as well as the impact or magnitude of such attack. 12.4. The CTO shall assess the cyber risk appetite of the TSS and its capabilities (including strong and weak points). 12.5. The CTO shall determine weakest links within the TSS and its surroundings and shall perform a cost-benefit analysis of aspects relating to the cybersecurity architecture. 12.6. In order to manage possible threats, the TSS shall be required to consider various threat scenarios to determine its state of security and have adequate 'situational awareness' to differentiate between normal and abnormal or irregular activities. 12.7. The cyber security architecture of the TSS shall be based on, or at least take into account, internationally and/or nationally recognised standards on cybersecurity and related risk and data management requirements. 12.8. The TSS shall be required to develop and implement suitable activities for the appropriate identification and minimisation of loss in the occurrence of a cybersecurity event. Page 13 of 15 Financial Services Commission FSC House, 54 Cybercity Ebene, 72201 Mauritius T: (+230) 403-7000 F: (+230) 467-7172 E: fscmauritius@intnet.mu www.fscmauritius.org 13. Custody Services 13.1. The TSS has to make use of custodians to hold both the Security Tokens and fiat currency. 13.2. The custody of Security Tokens shall be held with a custodian licensed by the FSC in accordance with the Financial Services (Custodian services (digital assets)) Rules 2019 or such other custodian of digital assets regulated in jurisdictions which are signatories to the IOSCO MMOU and acceptable to the FSC. 13.3. On the other hand, the custody of fiat currency shall be held with a bank licensed as a custodian in Mauritius. 14. Clearing and Settlement facilities 14.1. Since most TSS will make use of Distributed Ledger Technology (DLT), which enables instantaneous settlement of transactions, it is not mandatory to appoint a clearing and settlement facility. 14.2. If no clearing and settlement facility is used, the TSS shall ensure that adequate systems and controls are in place for the transfer of Security Tokens and/or fiat currency between participants on the TSS, for instance by using a pre-funded model. 14.3. In a pre-funded model, the accounts of the participants are pre-loaded with Security Tokens and/or fiat currency, which are respectively kept with Custodians for digital assets in accordance with paragraph 13.2. above or a bank licensed as Page 14 of 15 Financial Services Commission FSC House, 54 Cybercity Ebene, 72201 Mauritius T: (+230) 403-7000 F: (+230) 467-7172 E: fscmauritius@intnet.mu www.fscmauritius.org a custodian in Mauritius in accordance with paragraph 13.3. above. Once the transaction is effected on the TSS, instructions are given to the custodians to transfer the Security Tokens and/or fiat currency to the participants'accounts on a T+0 basis. 14.4. Should the TSS opt to use the services of a clearing and settlement facility, the latter shall be licensed by the FSC under section 10 of the SA. PART III – CONDUCT OF BUSINESS 15. Market Conduct 15.1. All licensees involved in Security Token offerings and trading shall maintain good market conduct, safeguarding market integrity which is an essential prerequisite for an efficient, transparent and integrated financial market. 15.2. Any market abuses including but not limited to insider dealing, fraudulent behaviours, false trading or market rigging shall be prohibited. 15.3. The TSS shall investigate misconduct or apparent misconduct that could affect investors or other participants. Where an investigation is initiated, the TSS shall promptly report to the FSC the details of such investigations and of the persons involved. Page 15 of 15 Financial Services Commission FSC House, 54 Cybercity Ebene, 72201 Mauritius T: (+230) 403-7000 F: (+230) 467-7172 E: fscmauritius@intnet.mu www.fscmauritius.org 16. Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) Obligations All licensees involved in Security Token offerings and trading shall be required to ensure strict adherence to the applicable laws, regulations and codes relating to AML/CFT in Mauritius (including the FSC Code on the Prevention of Money Laundering and Terrorist Financing). 17. Data Protection All licensees involved in Security Token offerings and trading shall comply with the Data Protection Laws applicable in Mauritius, including seeking the approval of the data subject prior to sending personal data outside Mauritius or keeping personal data on servers outside Mauritius. 18. Cautionary note to investors 18.1. The FSC urges all prospective investors to fully ascertain the related risks prior to committing any funds for investment in Security Tokens. 18.2. In addition, the FSC reiterates that any investment in Digital Assets is at the investors own risks and that they are not protected by any statutory compensation arrangements in Mauritius. 15 June 2020