Request for Comments on the Proposed Rules on Digital Asset Exchange

2019 SEC MSRD TO : Exchanges, Securities Clearing and Settlement, Securities Depository, Broker-Dealers, Government Securities Eligible Dealers, Industry Associations, Investment Company Advisers, Investment Houses, Law Offices, Mutual Fund Distributors, Underwriter of Securities, Members of the Academe, Investing Public and All Interested Parties FOR : Request for Comments on the Proposed Rules on Digital Asset Exchange NOTICE The Securities and Exchange Commission intends to issue Rules on Digital Asset Exchange . Hence, the Commission is inviting exchanges, broker-dealers, investment houses, investing public, and other interested parties to submit their views, comments, and inputs to the proposed rules. The draft SEC Memorandum Circular is attached herewith for your reference. Kindly address your comments to the Markets and Securities Regulation Department (MSRD) , Ground Floor Secretariat Building, PICC Complex, Roxas Boulevard, Pasay City, c/o Ms. Jessa Farra B. Patilleros and Ms. Varellie Vargas , not later than 14 August 2019 . You may also email your comments to [emailprotected] and [emailprotected] . ATTACHMENT SEC MEMORANDUM CIRCULAR NO. ____ Series of 2019 SUBJECT: RULES ON DIGITAL ASSET EXCHANGE (DAE) NOTICE In recognition of the recent advancements in the financial market, the Commission formulated the rules to govern Digital Asset Exchange in accordance with the Securities Regulation Code (SRC), its Implementing Rules and Regulations and international practice and standards. aScITE PREAMBLE WHEREAS, it is the policy of the Commission to encourage investments and active public participation in the capital market, foster good governance, and ensure protection of investors; WHEREAS, the Commission continuously keeps itself abreast with the latest advancements in information and communication technology, and the globalization of financial markets to facilitate innovative financial environment thru Digital Asset Exchange; WHEREAS, the Commission acknowledges that an orderly Digital Asset Exchange would work toward the development of the Philippine financial market by allowing access to it in a safe, transparent, reliable, and cost-effective manner, and ensuring reduced and managed counterparty and settlement risks and market price discovery; WHEREAS, Section 5 of the SRC provides the powers and functions of the Commission to supervise, monitor, suspend, or take over the activities of exchanges, clearing agencies, and other self-regulatory organizations (SROs); WHEREAS, Section 37 of the SRC promotes national economic development and competitiveness in the market and directs the Commission to promulgate rules for the registration and licensing of innovative and other trading markets for innovative securities, securities of small, medium, growth and venture enterprises, and technology-based ventures; WHEREAS, Section 39 of the SRC provides the power of the Commission to register as a self-regulatory organization or otherwise grant licenses, and to regulate, supervise, examine, suspend or discontinue operations of organizations related to or connected with the securities market, including associations of brokers and dealers, transfer agents, custodians, fiscal and paying agents, computer services, news disseminating services, proxy solicitors, statistical agencies, securities rating agencies, and securities information processor which are engaged in the business of collecting, processing, or preparing for distribution or publication, or assisting, participating in, or coordinating the distribution or publication of information with respect to transactions in or quotations for any security, or distributing or publishing information with respect to such transactions or quotations; WHEREAS, Section 39 of the SRC also provides for the power of the Commission to prescribe rules and regulations that will govern self-regulatory organizations and other licensed and regulated organizations under the SRC in the light of public interest and protection of investors; WHEREAS, Section 72 of the SRC authorizes the Commission to issue, amend, and rescind rules and regulations and orders that are necessary or appropriate, including those defining accounting, technical, and trade terms, and the prescribed information in the registration statements, applications and reports; WHEREAS, Section 72 of the SRC provides for the power of the Commission to classify persons, securities, and other matters within its jurisdiction and to prescribe different requirements for each class, including exemptions in favor of any person, security, or transaction, or class or classes from any or all provisions of the SRC; WHEREAS, the 2016 Revised Implementing Rules and Regulations of the Anti-Money Laundering (AML) and Combating the Financing of Terrorism (CFT) provide the state policy of ensuring that the Philippines shall not be used as a money laundering site for the proceeds of any unlawful activity; WHEREAS, it is essential to ensure that Digital Asset Exchange shall operate in a manner that is consistent with investor protection, and in the interest of the public, market integrity, and transparency; WHEREAS, it is the goal of the Commission to support the importance of meeting global transparency and beneficial ownership standards, and the need to have proper mechanisms to exchange information with other regulators and counterparties. NOW THEREFORE, the Commission hereby issues and promulgates the following rules governing Digital Asset Exchange and the transactions and persons involved therein. ARTICLE ONE General Provisions CHAPTER ONE Applicability and Coverage Section 1. Applicability and Coverage. These Rules shall be known as the "Rules on Digital Asset Exchange." These Rules shall primarily govern the registration and operations of Digital Asset Exchange wherein digital asset, are traded in an online exchange platform accessible in or from the Philippines. DAEs conducted through other means or media other than online electronic platform is outside the coverage of these Rules ; hence, the usual requirements under the SRC shall apply. Section 2. Suppletory Application of the 2015 SRC IRR. In the absence of applicable provisions in these Rules, the 2015 Implementing Rules and Regulations of the Securities Regulation Code and its amendments shall apply in a suppletory manner, unless otherwise stated herein. These Rules is not exhaustive source of the Commission's policy on the exercise of its regulatory functions and power. The Commission is not bound by the requirements set out and may impose additional requirements to address any specific risks posed by Digital Asset activities, and waive or modify any of these Rules at its discretion, where appropriate. CHAPTER TWO Definitions Section 3. Definition of Terms. For purposes of these Rules , the following definition of terms shall apply, unless the context otherwise requires: A. 2015 SRC Rules refers to the 2015 Implementing Rules and Regulations of the Securities Regulation Code. B. Application Programming Interface (API) refers to set of routines, protocols, and tools for building software applications. It specify how software components should interact, such as what data to use and what actions should be taken. C. Commission refers to the Securities and Exchange Commission. D. Customer Due Diligence (CDD) refers to the procedure of identifying and verifying the true identity, of customers, and their agents and beneficial owners, including understanding and monitoring of their transactions and activities. E. Cybersecurity is the practice of protecting systems, networks, and programs from digital attacks. F. Data Privacy Act refers to Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012; G. Digital Asset vests certain rights, including a digital representation of value that i. Used as a medium of exchange, unit of account, or store of value and is not legal tender, whether or not denominated in legal tender; ii. Intended to represent assets such as debt or equity in the promoter; iii. Otherwise intended to represent any assets or rights associated with such assets; or iv. Intended to provide access to an application or service or product by means of blockchain. The following are excluded from these rules: i. A transaction in which a person grants value as part of an affinity or rewards program, which value cannot be taken from or exchanged with the person for legal tender, bank credit or any digital asset; and which is not listed and/or planning to be listed in an exchange in whole or in part; ii. A digital representation of value issued by or on behalf of the publisher and used within an online game, game platform, or family of games sold by the same publisher or offered on the same game platform; iii. Nonconvertible Digital Asset which is intended to be specific to a particular virtual domain or world and under the rules governing its use, cannot be exchanged; iv. Electronic money as regulated by the Bangko Sentral ng Pilipinas. H. Digital Asset Exchange is an organized marketplace or facility that brings together buyers and sellers, and executes trades of securities. This includes buying/selling digital assets with fiat (fiat/digital asset pairing) as well as buying/selling digital assets with other digital asset (digital asset/digital asset pairing). They can be viewed as an online marketplace for the entire Digital Asset network. Digital Asset activity may include any the following involving the Philippines or a Philippine resident: i. Receiving Digital Asset for transmission or transmitting Digital Asset; ii. Storing, holding, or maintaining custody or control of digital asset on behalf of others; iii. Facilitating buying and selling of Digital Asset; iv. Performing Exchange Services as a customer business; or v. Controlling, administering, or issuing a Digital Asset. The development and dissemination of software in and of itself does not constitute digital asset business activity. I. Digital Asset Offerings (DAO) are distributed ledger technology fundraising operations involving the issuance of digital assets in return for cash, other digital assets or other assets. For purposes of DAO Rules, digital assets offering shall include follow-on offerings or issuance of digital assets, the previous issuance of which have been registered in accordance with these Rules. J. Commission refers to the Securities and Exchange Commission. K. Convertible digital asset refers to virtual asset that has an equivalent value in real currency and can be exchanged back-and-forth for real currency; if it does not fall with the foregoing, the same shall be deemed as nonconvertible digital asset . L. Evidence of financial capabilities are evidence of funds to conduct the proposed business of the Digital Asset Exchange which may include, but is not limited to, bank accounts, land titles, titles of properties, income tax returns, among others. M. Fiat currency is the coin and paper money of a country that is designated as its legal tender; circulates and is customarily used and accepted as a medium of exchange in the issuing country. N. Insider means (a) the issuer; (b) a director or officer (or any person performing similar functions) of, or a person controlling the issuer; gives or gave him access to material information about the issuer or the Digital Asset that is not generally available to the public; (d) a government employee, director, or officer of an exchange, clearing agency and/or self-regulatory organization who has access to material information about an issuer or a Digital Asset that is not generally available to the public; or (e) a person who learns such information by a communication from any forgoing insiders. O. Issuer-member refers to any issuer of Digital Asset who is a member of a Digital Asset Exchange duly registered with the Commission and is planning to list or has already listed their Digital Asset in the Digital Asset Exchange. P. Licensee/Applicant refers to the applicant companies applying for DAE under these Rules . Q. Multi-signature Wallets where multiple private keys are associated with a given public key and a subset of these private keys, sometimes held by different parties, are required to authorise transactions. R. Other market participants refer to any other person or entity, aside from issuers and users, who are involved in the Digital Asset market. S. Participation Agreement refers to contract between the Digital Asset Exchange and its users, and other market participants. T. Penetration Testing refers to security testing in which assessors mimic-rea-world attacks to identify methods for circumventing the security features of an application, system, or network. ATICcS U. Private Key is a string of data that allows you to access the tokens in a specific wallet. Functions as a secret password that allows the user to sign a transaction and transfer the Digital Asset to another address; using the private key proves ownership of the Digital Asset. V. Public Key/Address is a unique identifier that functions similarly to an e-mail address for the receipt of e-mail, and serves as an account for receiving Digital Asset. W. Qualified Buyers as defined in the Sec. 10.1.11 of the 2015 SRC IRR, both refers to a natural person and a juridical person subject to qualifications such as gross income/gross assets, among others. X. SRO refers to a Self-Regulatory Organization as defined under SRC and its Implementing Rules and Regulations . Y. User refers to any person or entity that holds an account with a registered Digital Asset Exchange. Z. Vulnerability Assessment refers to systematic examination of an information system or product to determine the adequacy of security measures, identify security deficiencies, provide data from which to predict the effectiveness of proposed security measures, and confirm the adequacy of such measures after implementation. AA. Whitepaper refers to a document prepared by a Digital Asset Exchange project team to interest the public. ARTICLE TWO Registration Requirements CHAPTER ONE Requirements Before Operating a Digital Asset Exchange Section 4. Prohibition on Unregistered Digital Asset Exchange. No person or entity shall form or operate, or enable another to form or operate a Digital Asset Exchange. Section 5. Requirement of Incorporation. All persons or entities that will form or operate as a Digital Asset Exchange should be duly incorporated under the SRC and its Implementing Rules and Regulations or under the laws of another jurisdiction. Section 6. Registration as Self-Regulatory Organization (SRO). No applicant for registration as a Digital Asset Exchange shall be approved, unless registered as a Self-Regulatory Organization under these Rules . In applying for registration as a Digital Asset Exchange, the Applicant shall specifically signify in the application his intention to conduct Digital Asset activities, as defined under these Rules , either singly or in concert with others, prior to engaging in said activities. Provided that , approved Applicants to operate a Digital Asset Exchange seeking to carry on additional regulated activities (such as engagement of intermediaries) will need to file the corresponding application to the Commission and pay the corresponding fees. Section 7. Registration of Foreign Digital Asset Exchange. Digital Asset Exchange that are registered as such in another jurisdiction may apply for license as a Digital Asset Exchange in accordance with these Rules, provided that there is an existing information sharing arrangement in place between the Commission and the competent regulator in the jurisdiction under the laws of which the foreign Digital Asset Exchange is organized or where it has its principal place of business, subject to reciprocity and upon approval of the Commission. Provided further that the DAE provide competent evidence to the Commission of such prior registration, and that there is a standing information sharing agreement between the Commission and the jurisdiction(s) where the foreign Digital Asset Exchange is registered. CHAPTER TWO Qualifications and Disqualifications of Digital Asset Exchange Section 8. Mandatory Provisions in Digital Asset Exchange Operational Framework. A corporation desiring to register as a Digital Asset Exchange under these Rules shall include the following provisions as a minimum in its Operational Framework: a. Provisions for anti-money laundering and countering terrorist financing in the reporting obligations; b. Appropriate disclosure of material risks associated with digital assets, monitored and updated on an ongoing basis; c. Provisions on the proper functioning of the market; d. Provisions on fairness and transparency; e. Management of any conflict of interest that may arise; f. Provisions on fraud risk reduction; g. Provisions on fair treatment of its users, issuer-members, potential issuer-members or any other person who subscribes to its services; h. Regulation and supervision of its users, or any person utilizing or accessing its exchange, including penalties such as suspension and expulsion; i. Appeal procedures against the decision of the Digital Asset Exchange operator; j. Sufficient financial, human, and other resources for the conduct of exchange activities at all times; k. Technology governance including systems and controls in relation to digital asset wallets, private keys, origin and destination of digital asset funds, security, and risk management and systems recovery; TIADCc l. Cybersecurity disclosures assessment of issuer-members; m. Provisions for activities including market surveillance, fair and orderly trading, settlement process, transaction recording, rulebook, transparency and public disclosure mechanisms, and exchange-like operational systems and controls; and, n. Provisions on the safe custody of digital assets with frequent reconciliations and reporting of digital assets versus client money and appropriate internal control procedures to safeguard funds. Section 9. Qualifications of Digital Asset Exchange. A corporation desiring to register as a Digital Asset Exchange in accordance with these Rules shall comply with the following: a. The applicant's board, chief executives, controller, and any other person who is primarily responsible for the operations of financial management of the body corporate, are fit and proper and duly informed about risks and incidents that the Exchange has and may face including cybersecurity risks and does not suffer from any of the disqualifications under these Rules ; b. Ability to operate an orderly, fair and transparent market in relation to the trading of cryptocurrencies on its exchange; c. Ability of the applicant's Board to ensure that the Digital Asset Exchange platform, and the issuer-members, users, and other market participants, comply with all the requirements under its own rules, the SRC and its Rules , including any direction or any term or condition imposed by the Commission; d. Ability to manage the risks associated with its business and operation, including demonstrating the processes and contingency arrangements in the event the applicant is unable to carry out its operations; e. Ability to manage and maintain policies and procedures to monitor the digital asset activities in its exchange and ensure compliance with these Rules ; and, f. Ability to take appropriate action against a person in breach of the Rules of the Digital Asset Exchange, including directing the person in breach to take any necessary remedial measure. Section 10. Disqualification of Digital Asset Exchange. A corporation whose Board, chief executives, controller, and any other person who is primarily responsible for the operations of financial management of the body corporate, had committed or is committing any of the following acts shall be disqualified from operating a DAE: a. willfully violated any provision of these Rules , the SRC and its implementing rules , any rule, regulation or order made hereunder, or any other law administered by the Commission, or in the case of a registered broker, dealer or associated persons, has failed to supervise, with a view to preventing such violation, another person who commits such violation; b. willfully made or caused to be made a materially false or misleading statement in any application for registration or report filed with the Commission or a self-regulatory organization, or has willfully omitted to state any material fact that is required to be stated therein; c. been convicted, by a competent judicial or administrative body of an offense involving moral turpitude, fraud, embezzlement, counterfeiting, theft, estafa, misappropriation, forgery, bribery, false oath, or perjury, or of a violation of securities, commodities, banking, real estate or insurance laws; d. been enjoined or restrained by a competent judicial or administrative body from engaging in securities, commodities, banking, real estate or insurance activities or from willfully violating laws governing such activities; AIDSTE e. been subject to an order of a competent judicial or administrative body refusing, revoking or suspending any registration, license or other permit under these Rules , the SRC and its rules, and any other law administered by the Commission; f. been subject to an order of a self-regulatory organization suspending or expelling him from membership or participating therein or from a market association with a member or participant thereof; g. been found by a competent judicial or administrative body to have willfully violated any provisions of securities, commodities, banking, real estate or insurance laws, or has willfully aided, abetted, counseled, commanded, induced or procured such violation; or h. been judicially declared insolvent. For purposes of this subsection, the term "competent judicial or administrative body" shall include a foreign court of competent jurisdiction and a foreign financial regulator. The same disqualifications shall apply against the corporation applying for registration as Digital Asset Exchange under these Rules . Section 11. Disallowed Digital Asset Exchange Activities. The Digital Asset Exchange shall not conduct any of the following activities: a. Offer investment advice or recommendations; b. Solicit purchases, sales, or offers to buy the digital assets offered on its exchange; c. Compensate employees, agents, or other persons for such solicitation or based on the sale of Digital Asset displayed or referenced on its exchange; d. Sell, transfer, assign, lend, hypothecate, pledge, or otherwise use or encumber assets, including digital assets, stored, held, or maintained by, or under the custody or control of, the Digital Asset Exchange on behalf of a customer except for the sale, transfer, or assignment of such assets at the direction of such customer; and e. Any other activity or arrangement that is deemed by the Commission to not constitute operating a digital asset business, where necessary and appropriate in order for the Commission to pursue its objectives. Section 12. Initial Capitalization Requirements. Applicants desiring to register as a Digital Asset Exchange in accordance with these Rules shall maintain in fiat form the an initial paid up capital of at least Php100,000,000 as a minimum. In addition to the above, the Digital Asset Exchange is required to hold regulatory capital equivalent to twelve months of operational expenses. For purposes of these Rules , operational expenses include all of the overhead, non-discretionary costs (excluding variable and exceptional items and development costs such as research and intellectual property patenting) incurred or forecasted. This shall also include technology-related operational expenses, such as the use of IT servers and technology platforms, storage and usage of IT equipment and technology services required for the overall operability of the Digital Asset Exchange platform. Section 13. Power of the Commission to Require Additional Capital Buffer. The initial capital requirements under the preceding Section does not remove the right of the Commission to require additional capital buffer on the basis of proportionality based on the size, scope, complexity and nature of the Digital Asset activities and operations of the Digital Asset Exchange. Section 14. Capital Requirement in Case the Digital Asset Exchange Carries One or More Regulated Activities. If the Digital Asset Exchange carries one or more regulated activities, the Commission may apply higher capital requirements than that required under the preceding Rules. ARTICLE THREE Anti-Money Laundering (AML) and Countering Financing of Terrorism (CF) CHAPTER ONE Anti-Money Laundering and Countering Financing of Terrorism Section 15. Anti-Money Laundering/Countering Financing of Terrorism Comprehensive Application. A Digital Asset Exchange shall be required to develop and maintain comprehensive Anti-Money Laundering/Countering Financing of Terrorism framework, including full compliance with, among others: a. 2018 Implementing Rules and Regulations of Republic Act No. 9160; b. SEC Memorandum Circular No. 16 Series of 2018; and, c. International best practices including FATF Recommendations. Section 16. Key Considerations for AML/CFT Compliance. The following key principles should also be considered in developing a comprehensive Anti-Money Laundering/Countering Financing of Terrorisms: a. Risk Based Approach. The Digital Asset Exchange is expected to understand the risks associated with their activities and allocate proper resources to mitigate those risks. Processes should be in place to identify, assess, monitor, manage and mitigate money laundering risks. The framework should include robust processes to carry out Customer Due Diligence on clients and beneficial owners, to monitor transactions for these risks, and the willingness and ability of the Digital Asset Exchange to provide complete transparency to its financial institution(s) and foreign correspondent financial institution(s) if and when required. AaCTcI b. Business Risk Assessment. The Digital Asset Exchange must identify and assess the money laundering or terrorist financing risks that may arise in relation to (i) the development of new products and new business practices, including new delivery mechanisms, and (ii) the use of new or developing technologies for both new and pre-existing products. The Digital Asset Exchange and their management and staff should be aware of the possible misuse of Digital Assets in criminal activities, as well as the technical and complicated nature of Digital Assets and the platforms they operate on. c. Customer Risk Assessment and Customer Due Diligence should be implemented. A Digital Asset Exchange should have a process to assess and rate all their Clients according to that Client's risk profile. d. Governance, Systems and Controls. The Digital Asset Exchange should implement an appropriate governance structure, particularly Information Technology governance, and provide for the development and maintenance of all necessary systems and controls to ensure appropriate Anti-Money Laundering and Countering Terrorist Financing compliance. The Digital Asset Exchange should develop, implement and adhere to a Digital Asset Compliance Policy, tailored to meet specific digital asset business compliance requirements, and reflecting a clear comprehension of the Board of Directors and higher management understanding of its compliance responsibilities. The Digital Asset Exchange compliance officers are expected to establish a Digital Asset compliance monitoring program including regular internal reviews. A Digital Asset Exchange must appoint an independent Money Laundering Reporting Officer (MLRO) who will be responsible for the compliance of the Digital Asset Exchange with its Anti-Money Laundering Rules. e. Suspicious Activity Reporting obligation. The Digital Asset Exchange should establish an appropriate transaction monitoring systems to detect possible money laundering and terrorist financing activities. Systems should also be implemented to effectively identify any attempt to breach domestic and international sanctions. f. Record keeping. The Digital Asset Exchange should establish policies and procedures for proper record keeping. The Digital Asset Exchange should maintain up to date records in accordance with its Customer Due Diligence obligations and be prepared to submit said records upon request from the Commission. ARTICLE FOUR Technology Governance and Controls CHAPTER ONE Technology Governance and Controls Section 17. Technology Governance and Controls Approach. The Digital Asset Exchange should establish systems and controls to ensure affairs are managed effectively and responsibly, subject to regular reviews. The Digital Asset Exchange should focus on technology governance and controls for: a. Digital Asset Wallets; b. Private Keys; c. Origin and destination of Digital Asset funds; d. Security; and e. Risk Management. In addition, due regard to the following key areas from a technology perspective: a. Careful maintenance and development of systems and architecture (including code version control, implementation of updates, issue resolution, and regular internal and third party testing); b. Security measures and procedures for the safe storage and transmission of data; c. Business continuity and client engagement planning in the event of both planned and unplanned system outages; d. Processes and procedures specifying management of personnel and decision making by qualified staff; and e. Procedures for the creation and management of services, interfaces and channels provided by or to third parties (as recipients and providers of data or services). Section 18. Maintenance and Development of Systems. The Digital Asset Exchange should have a well defined, documented and deliberate approach for the implementation and upgrade of systems and software, including policies and procedures for the regular and thorough testing of any system currently implemented or being considered for use. The following items should also be considered in implementation and upgrading of systems and software: a. All changes made to the code base in use should be tracked and recorded, with a clear audit trail for appropriate internal checks and sign-offs. The use of version control system which allows for the accurate timestamping and identification of the user responsible for relevant changes should be considered. b. A clear and comprehensive audit trail for system issues internally, including security issues and those with third parties, their resolution and implementation of fixes, should be maintained. c. The updated system should be tested for technical, operational and security vulnerabilities including but not limited to functional, penetration and stress testing. Third-party verification or audit of core systems being used (including, if relevant, custody arrangements and amounts of the Digital Asset Exchange's purported holdings of Digital Assets and Client Money) should be conducted at least annually. The Digital Asset Exchange should have an annual review of their infrastructure undertaken by reputable third party cyber security consultants, producing a list of recommendations and areas of concern. Section 19. Security Measures and Procedures. The Digital Asset Exchange should implement measures and procedures for network security which comply with industry best practices. EcTCAD For purposes of these Rules , the following key areas should be considered for IT infrastructure security: a. IT infrastructures should provide strong layered security and seek the elimination of "single points of failure." IT infrastructure security policies should be maintained, describing in particular the strength of the layered security and how "single points of failure" are eliminated. IT infrastructure security policies should also include limiting the access of a single user to private and confidential information of Clients and to privileged or sensitive information critical to the Digital Asset Exchange operations. Protective measures should be implemented to restrict access to critical and/or sensitive data to key personnel only. b. IT infrastructures should be strong enough to resist, without significant loss to clients, scenarios such as accidental destruction or breach of data, collusion or leakage of information by employees or former employees, successful hack of a cryptographic and hardware security module or server, or access by hackers of any single set of encryption and decryption keys that could result in a complete system breach. c. The Digital Asset Exchange should implement policies and procedures that address information security for all personnel. The security policy should set the security tone for the whole entity. All personnel should be aware of the sensitivity of data and their responsibilities for protecting it. d. Strong encryption of data, both at rest and in transit, should be made part of the security policy. Encryption and decryption of Digital Asset private keys should utilize strong encryption protocols and algorithms that comply with internationally recognized applicable security standards. e. All security incidents and breaches should be logged and documented in detail as soon as practicable, including their resolution and implementation details. Use of open source software should be governed by clear, well documented and transparent rules and procedures on the software's stability, security and fitness for purpose. Any open source software should be thoroughly tested for security and operational vulnerabilities and signed off by the responsible executives of the Digital Asset Exchange before it is used for processing or storing of operational and client information. f. All Application Programming Interface should be secured by strict access management procedures and systems, including encryption of the information. All API access activity should be logged and scanned for security breaches on an ongoing basis. g. All access management and credential changes for employees, third-party service providers and Clients should be governed and monitored by strict and well documented rules and procedures. Section 20. Updating of Systems. Updates and patches to all systems should be performed as soon as safely feasible after such updates and patches have been released, whether these systems have been developed internally or developed by a third-party. Section 21. Cryptographic Keys and Wallet Storage. The Digital Asset Exchange should have robust procedures and protective measures to ensure the secure offline generation, storage, backup and destruction of both public and private keys for their own wallets and their client wallets, if they offer wallet services to clients. The Digital Asset Exchange should establish policies and procedures to ensure that the private keys, whether stored online or offline, are not compromised by malicious actors. Section 22. Password Protection and Encryption. The Digital Asset Exchange should have clear policies and procedures for recovery in the event that a Client loses access to his/her account. These policies and procedures should also cover the recovery or re-generation of lost private keys. In addition, DAE should also have policies and procedures in place that set out actions and responsibilities in the event of a breach of private and public keys, as well as Client user access credentials. Section 23. Multi-Signature Wallets. The Digital Asset Exchange should consider the use of multi-signature wallets if feasible. Otherwise, the Digital Asset may explore similar mechanism or procedure should be for the purpose of wallet security. Section 24. Origin and Destination of Digital Asset Funds. The Digital Asset Exchange should have clear policies and procedures to identify the source of funds and to ensure compliance with the applicable Anti-Money Laundering Rules and other rules and regulations. These policies and procedures should also cover due diligence on deposits and withdrawals by legal persons that represent multiple deposit-holders or withdrawal recipients of the Digital Assets. Section 25. Process for Planned and Unplanned System Outages. The Digital Asset Exchange should implement a program of planned systems outages updates and testing, with multiple communication channels to ensure that its participants are informed ahead of time of any outages which may affect them. In case of unplanned outages, the Digital Asset Exchange should have clear and publicly available procedures, including rapid and frequent distribution of key information and updates on the outages. HSAcaE Section 26. Management Decision Making Procedures. The Digital Asset Exchange should implement processes and procedures concerning decision making, including a clear audit log of decision making process. The Digital Asset Exchange should ensure that its officers and employees with decision-making responsibilities have the adequate expertise, including technological capabilities, in decision making. Section 27. Third Party Outsourcing. Except for core processes of the Digital Asset Exchange, the Digital Asset Exchange may opt to outsource activities to third parties, Provided that the Digital Asset Exchange retains full responsibility for any issues that may result from the outsourcing, including the failure of the outsourcing company to meet its obligations. In its assessment of a potential third party service provider, the Digital Asset Exchange must satisfy itself that the service provider maintains robust processes and procedures for the specific services it requires. In all circumstances, the Digital Asset Exchange is expected to maintain a strong understanding of the services being provided by the third party service provider, especially for critical services. Section 28. Processes and Procedures in Case of Forks. The Digital Asset Exchange should ensure that changes in the underlying protocol of a Crypto Asset that result in a fork are managed and tested proactively. Except during go-live, the Digital Asset Exchange should ensure that their clients will be able to deposit and withdraw Accepted Crypto Assets to and from the Digital Asset Exchange as and when requested before and after a fork. In any case, the Digital Asset Exchange clients should be notified in advance of any periods of time when deposits and withdrawals are not feasible. CHAPTER TWO Cybersecurity Program Section 29. Cybersecurity Policies and Procedures. The Digital Asset Exchange should implement a written cyber security policy giving due consideration to the frequency, magnitude and cost of cybersecurity incidents. The Digital Asset Exchange and its Issuer-members should inform investors about material cybersecurity risks and incidents in a timely manner, including those subject to material cybersecurity risks but may not yet have been the target of a cyber-attack. The cybersecurity policy should include the following as a minimum: a. Policies guarding against directors, officers and other corporate insiders taking advantage of the period between the company's discovery of a cybersecurity incident and public disclosure of the incident to trade on material nonpublic information; b. Policies that ensure the timely disclosure of any related material nonpublic information on cybersecurity; c. Appropriate disclosure controls and procedures for discerning the impact of cybersecurity risks to the company and its business, financial condition, and results of operations, including the potential materiality of such risks and incidents; and, d. Include written procedures, guidelines, and standards reasonably designed to ensure the security of all applications utilized by the Digital Asset Exchange. The Digital Asset Exchange should have processes in place that enable them to disclose, prior to entering into an initial transaction, all material risks to their clients in a clear, fair and not misleading manner. The Digital Asset Exchange should conduct a detailed analysis of the risks in connection with its products, services and activities and to continuously update this analysis and the resultant disclosures. Section 30. Determination of Materiality. For purposes of determining materiality of information under the immediately preceding Section , an information is considered material if the disclosure is necessary to make the required statements, in light of the circumstances under which they are made, not misleading. In determining their disclosure obligations regarding cybersecurity risks and incidents, the Digital Asset Exchange and its Issuer-members generally should weigh, among others, the potential materiality of any identified risk and, in the case of incidents, the importance of any compromised information and of the impact of the incident on the operations. Section 31. Cybersecurity Personnel. The licensed Digital Asset Exchange shall: a. Employ competent cyber security personnel to manage cyber security risks and perform the core cyber security functions under this Article ; b. Provide for regular cyber security update and training sessions of its cybersecurity personnel; and c. Encourage continuous learning for its cybersecurity personnel, particularly on emerging cybersecurity threats and countermeasures. HESIcT CHAPTER THREE Chief Information Security Officer Section 32. Chief Information Security Officer. A licensed Digital Asset Exchange should designate a Chief Information Security Officer (CISO) responsible for overseeing and implementing the Digital Asset Exchange cyber security program and enforce its cyber security policy. The duly appointed CISO should be a senior level executive with sufficient authority within the institution to effectively perform the following functions and responsibilities: a. Formulate the policies to implement the Sections on Cybersecurity including the Information Security Strategic Plan (ISSP) and Information Security Program (ISP) in accordance with these Rules , rules and regulations promulgated by the Commission and the rules of the Digital Asset Exchange, subject to approval by the Board; b. Implement and manage the duly-approved ISSP and ISP; c. Coordinate and work with business process owners and executives across different departments to ensure that the information security requirements support business needs, and that the security systems and processes are working as intended; d. Enforce compliance with the ISP and the corresponding policies, standards and procedures across the organization and conduct security awareness and training programs catered to different sets of stakeholders; e. Educate, inform, and report to the Board and Senior Management relevant information security issues and concerns; f. Study emerging security control technologies, products, and arrangements for implementation in the Digital Asset Exchange, subject to approval of the Board and Senior Management; g. Ensure that security controls and processes are embedded throughout the life cycle of information, systems, applications, products and services; h. Assist in the effective implementation of information security incident response plan; and i. Assist in ensuring regulatory compliance and adherence to information security-related laws, rules and regulations. The CISO should have sufficient knowledge, technical background, skills and training to enable him to perform his tasks under this Section . The CISO should report directly to the Board, designated Board committee or to Senior Management and have sufficient independence, particularly from the Information Technology Department, to allow him to perform to perform his mandate. Section 33. Annual Report of the Chief Information Security Officer. The Chief Information Security Officer of the Digital Asset Exchange shall submit to the Commission an annual report, containing the assessment of the availability, functionality, and integrity of the Digital Asset Exchange electronic systems, identification of relevant cyber risks, assessment of the cyber security program, and proposing steps to redress the identified inadequacies. The report shall be subjected to approval of the Board of Directors or equivalent governing body. CHAPTER FOUR Audit Section 34. Audit Function. A licensed Digital Asset Exchange's cyber security program shall, at a minimum, include audit functions discussed under this Section . a. Annual penetration testing of its electronic systems and quarterly vulnerability assessment; b. Audit trail that will: i. Track and maintain data and allow the complete and accurate reconstruction of all financial transactions and accounting entries; ii. Protect the integrity of stored data free from alteration or tampering; iii. Protect the integrity of hardware from alterations or tampering; log system events, including authorized access and alterations made to the audit trail systems and system administrator functions performed on the systems; and iv. Maintain records produced as part of the audit trail in accordance with the recordkeeping requirements under these Rules . CHAPTER FIVE Business Continuity and Disaster Recovery Section 35. Business Continuity and Disaster Recovery Plan. The licensed Digital Asset Exchange shall establish and maintain a written Business Continuity and Disaster Recovery (BCDR) Plan designed to ensure the availability and functionality of Digital Asset Exchange services in the event of an emergency or other disruption to the Licensee's normal business activities. The BCDR plan, at a minimum, should: a. identify documents, data, facilities, infrastructure, personnel and competencies essential to the continued operations of the Digital Asset Exchange business; b. identify the supervisory personnel responsible for implementing each aspect of the BCDR plan, and third parties necessary to the continuous operation of the Digital Asset Exchange business; c. include a plan to communicate with employees, counterparties, regulatory authorities, data and communication providers, disaster recovery specialists, and any other persons essential to the recovery of documentation and data and the resumption of operations; caITAC d. include procedures for the maintenance of back-up facilities, systems and infrastructure, and as alternative staffing and other resources to enable the timely recovery of data and documentation and to resume operations as soon as reasonably possible following a disruption to normal business activities; e. include procedures for the back-up or copying, with sufficient frequency, of documents and data essential to the operations of the Digital Asset Exchange and offsite information storage; and, f. provide for notification to the Commission of the emergency or disruption to the Digital Asset Exchange business that may affect its ability to fulfill regulatory obligations or that may have a significant adverse effect on the Digital Asset Exchange, its counterparties or the market. Copies of the BCDR plan, including any revisions thereto, shall be stored in one or more accessible offsite locations and distributed to all relevant employees. The Digital Asset Exchange shall provide for relevant training on the Business Continuity and Disaster Recovery plan to responsible employees. Section 36. Testing of the Business Continuity and Disaster Recovery Plan. The BCDR plan shall be tested at least annually by qualified, independent internal personnel or third party, and revised accordingly. ARTICLE FIVE Registration Proper CHAPTER ONE Application for Registration Section 37. Contents of Application. An applicant for Digital Asset Exchange shall submit the following not later than ninety (90) days before the Digital Asset Exchange commences operation: a. Cover Sheet b. Duly filed and executed SEC Form 33-DAE, together with the following exhibits in chronological order : i. Board Resolution attesting to the particulars in the Application; ii. Copies of identity cards and/or passports of the directors and persons who control, directly or indirectly, more than 5% voting rights of the applicant; iii. Copy of the Articles of Incorporation with all amendments thereto, and of existing by-laws or instruments corresponding thereto, whatever the name, of the Exchange; iv. Copy of the latest Whitepaper of the Digital Asset Exchange; v. Copy of proposed Digital Asset Exchange Rules to be submitted for approval of the Commission pursuant to the procedures set forth in these Rules and Sections 33 and 40 of the SRC , including but not limited to the following items: (a) Organization and governance; (b) Trading; (c) Price discovery mechanism; (d) Clearing and settlement; (e) Money laundering and terrorist financing prevention, in accordance with Article Three of these Rules ; (f) Technological Governance and Controls; and Cybersecurity policy setting forth the protection of its electronic systems and customer and counterparty data stored on those systems, and address the following areas: (1) information security; (2) access controls; (3) business continuity and disaster recovery planning and resources; in accordance with Article Four of these Rules ; (g) Customer data privacy and compliance with the Data Privacy Act of 2012; (h) Listing requirements for Digital Assets; (i) Qualification and rights of issuer-members; (j) Qualifications and rights of users, and other market participants; ICHDca (k) KYC process for issuer-members, users, and other market participants; (l) Code of Ethics for issuer-members, users, and other market participants; (m) Supervision, monitoring, control and discipline of issuer-members, users, and other market participants; (n) Financial and operation responsibilities of issuer-members, users, and other market participants; (o) Information dissemination process for the users and other market participants; (p) Identification and description of procedures and systems to be used to prevent, mitigate and/or detect fraudulent and manipulative acts and practices; (q) Appeal procedures; and, (r) Corporate governance framework. vi. Original signed copy of the applicant's audited financial statements, including all notes and schedules thereto, as of the end of the last fiscal year, in case the corporation registrant has been doing business for at least one fiscal year ; Otherwise , other adequate evidence of financial capabilities; vii. Projected (1) statements of financial position and (2) statements of income and expenses or financial performance for the first five years in its capacity as a Digital Asset Exchange, including a comprehensive discussion of the assumptions and basis of projections; viii. Complete set of all forms and the complete procedures pertaining to application for listing in the Exchange, and a complete schedule and explanation of all listing fees, dues and charges, if applicable , or the complete set of procedures employed in determining whether to list a particular Digital Asset; ix. A complete set of all forms and the complete procedures pertaining to application for approval as a user of the Digital Asset Exchange platform, and a complete schedule and explanation of all listing fees, dues and charges; x. A complete set of all forms of financial statements, reports or questionnaires required of Issuer-members; xi. Study of the comparative fees and charges imposed by other Digital Asset Exchanges; xii. The organizational chart of the Digital Asset Exchange, including the standing committees, and indicating the filled and unfilled positions and the identity of persons presently occupying the title or position, with corresponding list of qualifications/requirements and Statement of Duties and Responsibilities for each position/item; xiii. List of the issuer-members and the current applicants to the same; xiv. Complete set of all forms and copies of all proposed participation agreement/s, if any; xv. Detailed plan of operation and economic justification for operating an exchange with description and analysis of the industry and the market environment from which the Exchange expects to draw majority of its business and establish a strategy for its ongoing operation; xvi. Comprehensive Information Technology Plan; xvii. Source Code Audit Report issued by a third party information technology audit provider; xviii. Source Code of the Digital Asset Exchange systems, including security protocols and AML/KYC procedures and operations; xix. Business Continuity and Disaster Recovery Plan; xx. Risk Management Manual and Internal Control Procedures; xxi. Insurance plan to cover any operational risks, technology risks and other risks; xxii. Copies of service contracts/proposed contract of any activities or services that will be outsourced, if any ; xxiii. Comprehensive curriculum vitae of all directors, executive officers and heads of standing committees; xxiv. Brief description as to any material pending legal proceeding affecting the applicant directly or to which any of its properties or assets, directors, or officers is part of; xxv. Legal opinion issued by a third-party counsel or certified public accountant on the tax implications of the Digital Asset Exchange operations; xxvi. Legal opinion issued by a third-party counsel that all applicable permits and licenses required for the Digital Asset Exchange has been secured, including copies of such permits and licenses; xxvii. Undertakings executed by the President or equivalent executive officer of the Exchange as to the following: (a) That the Digital Asset Exchange will comply and enforce compliance by its users, listed tokens and coins, other participants, employees and officers with the provisions of the Securities Regulation Code, its implementing rules and regulations and any amendments thereto, the provisions of the Rules for Digital Asset Exchange, and the rules duly implemented by the Digital Asset Exchange, and with any terms and conditions imposed by the Securities Regulation Commission in connection with registration; TCAScE (b) Undertaking to subject the information technology, trading, business continuity and disaster recovery, and risk management systems to regular review and security code audit by independent firm at least annually and such other frequency that the Commission may deem necessary; (c) In case the wallet service provider and the keeper of the private keys of the user wallets is an entity other than the Digital Asset Exchange , that the third party wallet service provider and the keeper of the private keys has sufficient internal control and security systems to protect the wallets and/or the private keys, that the Digital Asset Exchange has determined the sufficiency of such internal control and security systems before entering into agreement for the wallet and private key depository service, and that, to the best of his knowledge, there is no showing of insufficiency and lapses in the internal control system which will reasonably or tend to reasonably put into question the reliability of the wallet service provider and the private key depository; (d) That the Digital Asset Exchange will allow the Commission or any of its authorized representatives access to the system and to all reports, documents and books it may request within reasonable hours and in accordance with its powers and duties under the Securities Regulation Code and its implementing rules and regulations; and, (e) Statement of Readiness and Undertaking to link the proposed system with other capital market participants, within and outside of the Philippines; and, xxviii. Undertaking by the Applicant's Internal Auditor confirming that the applicant has, in relation to the Digital Asset Exchange business: (a) Sufficient human, financial and other resources to carry out operations; (b) Adequate security measures, system capacity, business continuity plan and procedures, risk management, data integrity and confidentiality, record-keeping and audit trail, for purposes of daily operations and emergencies; and, (c) Sufficient IT and technical support agreements. c. Payment of the appropriate registration fees as determined by the Commission under these Rules ; and d. Duly executed request for the conduct of an on-site visit of the facilities and/or operations by the Commission or its authorized representatives, including location(s) and tentative date(s) and time, and signed by the President or his equivalent. Section 38. Management Presentation. Upon substantial compliance of the application requirements under the immediately preceding Section , but not later than ninety (90) days from filing of the application unless the Digital Asset Exchange applicant consents in writing to the Commission's deferring action on its application for a stated longer period, the applicant must present its business model and answer the queries and clarifications of the Commission or its duly authorized representative in a management presentation, including a comprehensive walkthrough of the system. Section 39. Registration Fees. No application for registration as a Digital Asset Exchange shall be processed except upon payment of the registration fees of Php50,000.00 plus a Legal Research Fee (LRF) of Php500.00. CHAPTER TWO Amendments to the Application Section 40. Amendments to the Digital Asset Exchange Registration. No later than seven (7) days after the discovery that any information in the application form, or any exhibit attached thereto, or any amendment was inaccurate when filed, a Digital Asset Exchange shall file with the Commission an amendment correcting such inaccuracy. An amendment to such application shall be made in duplicate on SEC Form 33-DAE-A , at least one (1) copy of which signed and attested, in the same manner as required in the case of the original registration. Each amendment shall be dated and numbered accordingly in the order of the filing. One amendment may include a number of changes. Section 41. Filing of Notices, Reports, etc. to the Commission. In addition to the formal filing of amendments in accordance with the immediately preceding Section , every registered Digital Asset Exchange shall send to the Commission copies of any notices, reports, circulars, loose leaf instructions, riders, new additions, lists, or other records of changes covered by amendments or supplements when, as, and if such records are made available to members and/or participants in the Digital Asset Exchange. Section 42. Amendments Required by the Commission. The Commission and its duly authorized representatives reserve the right to require amendments to the Digital Asset Exchange Application or any of the exhibits and documents annexed thereto at any time in order to keep the information thereof complete, timely and accurate. CHAPTER THREE Actions to be Taken on the Digital Asset Exchange Application Section 43. Withdrawal of Digital Asset Exchange Registration. Upon appropriate application in accordance with the rules and regulations of the Commission and upon such terms as the Commission may deem necessary for the protection of investors, a Digital Asset Exchange may withdraw its registration or suspend its operations or resume the same. cTDaEH Section 44. Approval/Disapproval of Application of Digital Asset Exchange Registration. Within ninety (90) days upon filing of the complete application in accordance with these Rules , the Commission shall issue an order in writing granting or denying registration for the Digital Asset Exchange, unless the Digital Asset Exchange application have been previously withdrawn with approval of such withdrawal by the Commission or unless the Digital Asset Exchange consents in writing to the Commission's deferring action on its application for a stated longer period after the date of complete filing. Section 45. Grounds for Denial of Application. After review of the application for registration as Digital Asset Exchange, the Commission may reject the application if it finds that any of the following grounds exists: a. The Applicant fails to demonstrate its stable financial condition and prospects for continuing growth; b. Any material representation or warranty made by the Applicant in its submission, and other related documents submitted in relation thereto, is proven to have been incomplete, incorrect or misleading at the time it was made or deemed to have been made; and, c. Any other grounds as determined by the Commission as material for purposes of public policy and investor protection. ARTICLE SIX Powers of the Digital Asset Exchange CHAPTER ONE Power to Implement Rules Section 46. Power to Implement Rules and Regulations. The Digital Asset Exchange, acting as an SRO and subject to approval by the Commission, has the power to implement its own rules and regulations, including but not limited to defining its organizational structure, trading in its platform, price discovery, clearing and settlement procedures, privacy policies, security protocols, qualifications and disqualifications of issuer-members, users and other market participants, listing requirements and procedures, KYC process, ethical conduct of its participants, supervision, control and disciplinary procedures and sanctions, fees, and appeal procedures. Section 47. Power to Amend Rules and Regulations. The Digital Asset Exchange, acting as an SRO and subject to approval by the Commission, has the power to amend as it sees fit its own rules and regulations, Provided that it shows the Commission the propriety and justification for such amendment. CHAPTER TWO Power to Collect Fees Section 48. Power to Impose and Collect Fees. The Digital Asset Exchange, acting as an SRO and subject to approval by the Commission, has the power to impose or amend its fees collectible from the issuer-members, users and other market participants, Provided that it include in its rules and regulations the detailed fee schedule, Provided, further that any imposition or amendment to its fee schedule should include a reasonable justification acceptable to the Commission. Section 49. Power to Require Trust Fund. The Digital Asset Exchange shall collect as part of its fees from issuer-members a trust fund in an amount as the Digital Asset Exchange may find acceptable as a requisite for listing, Provided that the amount and computations of the trust fund requirement be included in its Fee Schedule requiring the approval of the Commission. The trust fund shall be applied solely as settlement to investors in case the issuer-member becomes insolvent or the financial condition of such becomes so deteriorated that it cannot readily meet the demands of the customers for the delivery of securities and/or payment of proceeds. CHAPTER THREE Supervisory Powers Over Market Participants Section 50. Power to List a Digital Asset. The Digital Asset Exchange has the power to list a Digital Asset to be traded in its exchange platform, Provided the listing is in accordance with its Rules implemented under its rule-making power, Provided further that the Digital Asset Exchange must deny an application for listing of a Digital Asset in cases where the Digital Asset Exchange has reasonable basis to believe that the issuer or any of its officers, directors (or any person occupying a similar status or performing a similar function) or beneficial owners of 20 percent or more of the issuer's outstanding voting equity securities, calculated on the basis of voting power, is subject to disqualifications in accordance with its own rules or the disqualification under the Rules on Digital Asset Offering , or where the Digital Asset Exchange has reasonable basis for believing that the issuer of the offering presents the potential for fraud or otherwise raises concerns about investor protection, or where the Digital Asset Exchange has reasonable basis to believe that an issuer seeking to offer and sell securities in violation of these Rules or Market Manipulation and Fraud and related provision in the SRC . Section 51. Power of the Commission to Review Listing of Digital Asset in a Digital Asset Exchange Platform. Notwithstanding the above Section, no digital asset may be listed in a Digital Asset Exchange without the Digital Asset Exchange securing the review of the Commission to such listing, among others. Section 52. Minimum Considerations for Digital Asset Listing in a Digital Asset Exchange. A Digital Asset Exchange desiring to register in accordance with these Rules shall consider the following requirements as minimum consideration in addition to its own listing requirements in assessing whether or not to accept a particular digital asset for listing: a. Registration of the Digital Asset with the Commission pursuant to the Rules on Digital Asset Offering and/or has registered under the rules and regulations of another jurisdiction, unless otherwise allowed by the Commission; b. Maturity or the market capitalization of the Digital Asset, the sufficiency, depth and breadth of Client demand, the proportion of the Digital Asset that is in free float, and the controls and processes to manage volatility of a particular Digital Asset; c. Security considerations whether a specific Digital Asset is able to withstand, adapt, respond to, and improve on its specific risks and vulnerabilities, including relevant factors and risks relating to the on-boarding or use of new Digital Assets (including size, testing, maturity, and ability to allow the appropriate safeguarding of secure private keys); cSaATC d. Traceability or whether the holders are able to demonstrate the origin and destination of the specific Digital Asset, identification of counterparties to each transaction and on-chain transactions in the Digital Asset can be adequately monitored; e. Exchange connectivity or whether there are other exchanges that support the Digital Asset, including the jurisdictions of these exchanges and whether or not these exchanges are suitably regulated; f. Type of Distributed Ledger Technology (DLT) and existence of issues relating to the security or usability of a DLT, whether or not the Asset leverages an existing DLT for network and other synergies, and whether or not a new DLT has been subjected to stress testing; and, g. Practical application and functionality or whether the Crypto Asset possesses real world and quantifiable functionality. An Accepted Digital Asset may be deemed suitable for use by more than one Digital Asset Exchange, subject to each Digital Asset Exchange satisfying the Commission that it can meet the regulatory requirements in respect of the specific Accepted Digital Asset. The Digital Asset Exchange should also be able to demonstrate its controls and processes relating to identity and transaction monitoring of certain distributed ledger. No Digital Asset Exchange can commence trading operations until the suitable controls have been developed and implemented. Section 53. Trading Board for Qualified Buyers. A Digital Asset Exchange that allow the listing and trading of digital assets that are not covered by a registration statement shall provide a trading board exclusive for investors who have been determined as qualified buyers. Section 54. Power to Approve or Deny Application of Issuer-Members, Users and Other Market Participants. The Digital Asset Exchange has the power to approve or deny applications for membership in the Digital Asset Exchange platform by issuer-, user- or market participant-applicants in accordance with its own rules , Provided that any denial shall be made known to the applicant in writing stating the reason for such denial, Provided further that the approval or denial shall not be held unreasonably. Section 55. Finality of Approval or Denial of Application. The decision of the Digital Asset Exchange approving or denying application for membership of any issuer, user or other market participant shall be final, except only if the same is due to improper or inconsistent application of its own rules . In such case , any aggrieved party may file an appeal to the Commission in accordance with the SRC , its Implementing Rules and Regulations and the 2016 SEC Rules of Procedure or its amendments . Section 56. Terms and Conditions of Membership. No user application shall be approved by the Digital Asset Exchange, unless the user expressly agrees to the Terms and Conditions of the Digital Asset Exchange. The Terms and Conditions, as used in this Section , shall include the following information as a minimum: a. The type of Digital Asset Exchange activities available in the Digital Asset Exchange, including information on how the Digital Asset Exchange facilitates the user investments, any restrictions on any of such activities and on the amount an investor may invest pursuant to these Rules , or any limitations on an investor's right to cancel investment commitment; b. The risks in participating in the Digital Asset activities, including, but not limited to, volatility, business risks, technological risks, cybersecurity risks, data privacy risks, risks of losses, among others; c. The rights of users relating to participation in the Digital Asset Exchange activities; d. Details on the complaints handling or dispute resolution; e. Fees, charges and other expenses that it may charge against a user; f. Contingency arrangement in the event the Digital Asset Exchange is unable to carry out its operations or ceases its business; g. Ground for suspension, fines, removal and other penalties that may be imposed against the user; and, h. Any other information the Digital Asset Exchange or the Commission may deem necessary for investor education in light of investor protection and public policy. CHAPTER FOUR Disciplinary Powers Section 57. Power to Discipline Issuer-Members, Users and Other Market Participant Members. The Digital Asset Exchange has the power to penalize its issuer-members, users or other market participants in the Digital Asset Exchange platform in any of the following forms, including but not limited to delisting, suspension, fines, removal, dismissal, or a combination of penalties, in accordance with due process, Provided that the procedures followed in the disciplinary proceedings be in accordance with its Rules, Provided further that any aggrieved party be allowed to appeal to the Digital Asset Exchange in accordance with its appeal procedures. Section 58. Power to Delist the Digital Asset in Case of Fraud or Possible Damage to Users. In case the Digital Asset Exchange becomes aware of information that causes it to reasonably believe that the issuer or the Digital Asset offering presents the potential for fraud or otherwise raises concerns about investor protection, the Digital Asset Exchange must promptly remove the Digital Asset from its platform, cancel the offering, and return any funds that have been committed by issuer in the Digital Asset, Provided that the procedures for determination of fraud or possible damage be part of its rules and regulations . Section 59. Appeal to the Commission. Any aggrieved party penalized by the Digital Asset Exchange in accordance with its disciplinary powers under this Chapter may appeal the same to the Commission in accordance with the SRC , its Implementing Rules and Regulations and the 2016 SEC Rules of Procedure or its amendments . CHAPTER FIVE Power to Halt Trading Section 60. Power to Halt Trading. The Digital Asset Exchange may halt trading of any or all digital assets in the Digital Asset Exchange platform for specified reasons, including but not limited to cybersecurity threats, maintenance and patches, and for specified and reasonable durations, Provided that the justifications and the duration for the halt be included in its rules and regulations , and that the halt mechanisms be made part of the terms and conditions to be consented by the users, Provided further that the Digital Asset Exchange shall immediately notify the Commission of any such halts. cHDAIS ARTICLE SEVEN Responsibilities of the Digital Asset Exchange CHAPTER ONE Responsibilities to the Commission Section 61. Capitalization Maintenance Requirements. The Digital Asset Exchange shall maintain the unimpaired paid up capital of One Hundred Million pesos (Php100,000,000.00) at all times such capital in a form, and amount as the Commission determines is sufficient to ensure the financial integrity of the Digital Asset Exchange and its operations. In determining the additional amount of capital that must be maintained, the Commission may consider a variety of factors, including, but not limited, to the following: a. The composition of the total assets of the Digital Asset Exchange, including the position, size, liquidity, risk exposure and price volatility of each type of asset; b. The composition of the total liabilities of the Digital Asset Exchange, including the size and repayment timing of each type of liability; c. Comparative Risk per industry assessment; d. The actual and expected volume of the Digital Asset business activity; e. Existing Digital Asset Exchange license, permit or regulation by the Commission, or by other agencies under Banking Law, or Insurance Law, or otherwise subject to such laws as a provider of a financial product or service, and whether the DAE is in good standing in such capacity; f. The amount of leverage employed by the Digital Asset Exchange; g. The liquidity position of the Digital Asset Exchange; h. The financial protection that the Digital Asset Exchange provides for its customers through its trust account or sub-portfolio; i. The types of entities to be serviced by the Digital Asset Exchange; and j. The types of products or services to be offered by the Digital Asset Exchange. Each Digital Asset Exchange shall hold capital required to be maintained in such proportions as are acceptable to the Commission. Section 62. Continuous Reporting Requirements. The Digital Asset Exchange shall submit the following reports and/or disclosures to the Commission in a timely manner: a. Monthly reports on dockets of examinations and investigations being conducted to be submitted on or before the 15th of the following month, containing the docket number, name of examiner/investigator, how audit/examination originated (complaint, examination, surveillance), name of the issuer-member being audited/investigated, nature of the violations alleged, status, findings, sanctions imposed and other courses of action taken; b. Monthly reports on risk-based capital adequacy requirements; c. Monthly reports on its periodic examinations started and completed during the month, within ten (10) days after the end of each month, together with a summary of findings for audits completed; d. Quarterly reports on the result of investigations conducted with respect to the trading of issuer-member to be submitted on or before the 15th of the month after each quarter; e. Annual report to be submitted on or before the 30th of every January or 30 days after the end of fiscal year containing information on the number of newly listed Digital Asset; delisted/suspended Digital Asset and reasons therefor; the number, type of Digital Asset; and issuer-members of current listed Digital Asset. The report shall also include profile of users and other market participants and their investments such as estimate of number of users in the market by type (retail, institutional, qualified buyer, etc.), investment portfolio, amount of investment, mode of access (traditional or online), geographical location of users, and other relevant market data; f. The reports on examination and investigation being conducted, the results thereof, and the cases resolved, including the following information: (1) Names and designations of the persons allegedly responsible for the violations; (2) Description of the nature of the violations with brief narration of the participation of the persons allegedly responsible for such violations; and (3) Supporting documents; g. If the persons allegedly responsible for the violations have existing registration with the Commission ( e.g ., salesman, associated persons), such fact shall be indicated in the report. If the persons allegedly responsible for the violations are not registered with the Commission, such fact shall be indicated in the report; h. Digital Asset Exchange Audit Calendar on or before 15th day of January of every year; i. General Information Sheet within 30 calendar days following the date of the stockholder's meeting per by-laws. If no meeting was held on the calendar year , on or before the 30th day of January of the following year; j. Audited Financial Statements not later than 135 days from the end of the fiscal year; k. Source code audit report not later than 135 days from the end of the fiscal year; and l. Other reports, documents and/or disclosures as may be required from time to time by the Commission. Section 63. Maintenance of Books and Records and Power of Review by the Commission. The Digital Asset Exchange shall make, keep and preserve all of its books and records in their original form or native file format for a period of at least seven (7) years from the date of their creation and in a condition that will allow the Commission to determine whether the Digital Asset Exchange is complying with all applicable laws, rules, and regulations. The books and records maintained by the Digital Asset Exchange shall include the following: ISHCcT a. For each transaction, the amount, date, and precise time of the transaction, any payment instructions, the total amount of fees and charges received and paid to, by, or on behalf of the Digital Asset Exchange, and the names, account numbers, and physical addresses of (i) the party or parties to the transaction that are users or other market participants of the Digital Asset Exchange; and (ii) to the extent practicable , any other parties to the transaction; b. General ledger containing all asset, liability, ownership equity, income and expense accounts; c. Bank statements and bank reconciliation records; d. Any statements or valuations sent or provided to issuer-members, users and other market participants; e. Records or minutes of meetings of the board of directors or an equivalent governing body of the Digital Asset Exchange; f. Records demonstrating compliance with applicable anti-money laundering laws, rules and regulations, including customer identification and verification documents, records linking customers to their respective accounts and balances, and a record of all compliance breaches; g. Communications and documentation related to investigations of complaints of issuer-members, users or other market participants, and transaction error resolution or concerning facts giving rise to possible violations of laws, rules or regulations; and, h. All other records as the Commission may hereinafter require. Section 64. Additional Fees. In addition to the registration fee prescribed herein , every Digital Asset Exchange shall pay to the Commission, on a semestral basis on or before the tenth (10th) day from the end of every semester of the calendar year, a fee amounting to one-hundredth (1/100) of one per centum (1%) of the aggregate amount of the sales of cryptocurrencies transacted on such Digital Asset Exchange during the preceding calendar year. Section 65. Immediate Notification Requirements. The Digital Asset Exchange must immediately notify the Commission, not later than one day after occurrence, of any of the following: a. Any irregularity or breach of any provision of these Rules , the SRC and its Implementing Rules and Regulations , and all other laws, rules and regulations administered by the Commission, including any alleged or suspected violations of any law or guidelines in relation to money laundering and terrorism financing by its users, issuer-members and/or other market participants; b. Any investigation which involves suspected violations of these Rules , the SRC and its Implementing Rules and Regulations , and all other laws, rules and regulations administered by the Commission, involving persons not subject to the Digital Asset Exchange jurisdiction, concerning the disclosure obligations of listed companies, and/or involving fraud or manipulation. c. Any disciplinary sanction imposed on any issuer-member or other market participants. d. Any hacking and/or cybersecurity attacks to the Digital Asset Exchange system, including attempts to do the same, and the actions taken or to be taken to counter, minimize or reduce the damage and the progress of such actions; e. Details of any halt of any or all Digital Asset trading, for any reason and for any duration; f. Any material change in the information submitted to the Commission; and g. Any matter which adversely affects or is likely to adversely affect its ability to meet its obligations or to carry out its functions under these Rules . CHAPTER TWO Responsibilities to the Members of the Digital Asset Exchange Platform Section 66. Maintenance of Surety Bond or Trust Account. The Digital Asset Exchange shall maintain a surety bond or trust account in Philippine Pesos for the benefit of its users in such form and amount as is acceptable to the Commission for the purpose of indemnifying the users in case of damages due to the fault or negligence of the Digital Asset Exchange or any member of its management or its agents. In case the Digital Asset Exchange chooses to maintain a trust account , such trust account must be maintained with a Qualified Custodian. Section 67. Duty to Ensure Accuracy of Disclosures. The Digital Asset Exchange must ensure the accuracy of all the disclosures and documents submitted by its issuer-members. Section 68. Disclosures to Members of the Exchange and Investor Education. A Digital Asset Exchange must disclose and display prominently on its platform any relevant information relating to its Digital Asset Exchange activities, including, but not limited to, the following: a. Information relating to the listed digital assets, including their whitepapers, and other disclosures required for issuers by the Commission in accordance with the Rules on Digital Asset Offering , the SRC and its Implementing Rules and Regulations , the Rules of the Digital Asset Exchange or any other laws, rules or regulations administered by the Commission or the Digital Asset Exchange; CAacTH b. Information on the type of Digital Asset Exchange activities conducted, and how the Digital Asset Exchange facilitates the user investments, including any restrictions on any of such activities, any limitations on the amount an investor may invest pursuant to these Rules , or any limitations on an investor's right to cancel investment commitment; c. Information on the risks in participating in the Digital Asset activities, including, but not limited to, volatility, business risks, technological risks, cybersecurity risks, data privacy risks, among others; d. Information on the rights of issuers, users and other market participants relating to participation in the Digital Asset Exchange activities; e. Information about complaints handling or dispute resolution and its procedures; f. Fees, charges and other expenses that it may charge to, impose on an issuer or user or other market participants; g. Information on processes and contingency arrangement in the event the Digital Asset Exchange is unable to carry out its operations or ceases its business; and h. Any other information the Digital Asset Exchange or the Commission may deem necessary for investor education in light of investor protection and public policy. Section 69. Accessibility and Timeliness of Information. A Digital Asset Exchange must keep the disclosures and information under this Chapter updated at all times and accessible to the users, other members, and the public if applicable , Provided that if at any time, the Digital Asset Exchange makes a material revision to its education materials, it must make the revised educational materials available to all investors before continuing its operations in reliance to these Rules . Section 70. Limitations on User Purchase. No user shall be allowed to purchase Digital Assets through the Digital Asset Exchange exceeding in aggregate an amount equivalent to fifty thousand pesos (Php50,000) during any 12-month period, unless the user executes a waiver, in written or electronic form, of the investment limitation. ARTICLE EIGHT Market Manipulation and Fraud CHAPTER ONE Prohibited Market Manipulation Activities, Representation and Conduct SECTION 71. Market Manipulation. The following acts committed by the Digital Asset Exchange or any of the issuer-members, users or market participants, shall be considered as prohibited manipulative practices: a. To create or to induce another to create a false or misleading appearance of active trading in any listed Digital Asset traded in the Digital Asset Exchange or any other trading market, including the act of making a bid or offer or deal in Digital Assets which has the effect or is likely to have the effect of creating a false or misleading appearance of active trading of the Digital Asset or manipulation of prices; b. By entering an order or orders for the purchase or sale of Digital Asset with the knowledge that a simultaneous order or orders of substantially the same size, time and price for the sale or purchase of any such Digital Asset has or will be entered by or for the same or different parties; c. By, directly or indirectly, to effect, either alone or with others, any series of transactions for the purchase and/or sale of any Digital Asset traded in the Digital Asset Exchange for the purpose of pegging, fixing or stabilizing the price of such security, unless otherwise allowed by these Rules . Section 72. Prohibited Representations, Dealings and Solicitations. It shall be unlawful for any Digital Asset Exchange, or members or its board or management, or any issuer-member, user or market participant, to, directly or indirectly, in connection with the purchase or sale of any Digital Asset: a. To represent that he has been registered as a securities intermediary with the Commission, unless such person is registered under these Rules , the SRC or any other laws, rules or regulations administered by the Commission; b. To represent that his/its registration under these Rules , the SRC or any other laws, rules or regulations administered by the Commission, or the failure of the Commission to deny, suspend, or revoke such registration indicates in any way that the Commission has passed upon or approved the financial standing, business or conduct in any way of such person, or the merits of any Digital Asset or transaction conducted thereby; c. To represent that a Digital Asset of a particular type of Digital Asset when such representation is inconsistent with a stated definition under these Rules , the SRC or any other laws, rules or regulations administered by the Commission; and, d. To represent that a Digital Asset to be sold, transferred, pledged, mortgaged, encumbered, used for delivery, or any other purpose to another entity or itself has been legally authorized by the registered owner when such representation is not true and documented in writing at the time and date it was used. Section 73. Prohibited Conduct. The following acts committed by the Digital Asset Exchange or any of the issuer-members, users or market participants, shall be considered as engaging in prohibited conduct: IAETDc a. Engaging in a series of transactions in digital asset that are reported publicly to give the impression of activity or price movement in the Digital Asset; b. Engaging in transactions where both the buy and sell orders are entered at the same time with the same price and quantity by different but colluding parties; c. Engaging in buying activity at increasingly higher prices and then selling securities in the market at the higher prices, or vice versa; d. Taking advantage of a shortage of the Digital Asset in the market by controlling the demand side and exploring market congestion during such shortages in a way to create artificial prices; and, e. Other types of prohibited conduct and/or manipulative practices which include, among others, the creation of temporary funds for the purpose of engaging in other manipulative practices. CHAPTER TWO Fraudulent Activities Section 74. Fraudulent Transactions. It shall be unlawful for any Digital Asset Exchange, or members or its board or management, or any issuer-member, user or market participant, to, directly or indirectly, in connection with the purchase or sale of any Digital Asset to: a. Employ any device, scheme or artifice to defraud; b. Obtain money or property by means of any untrue statement of a material fact or any omission to state a material fact necessary in order to make the statements made, in the light of the circumstances under which they were made, not misleading; or, c. Engage in any act, transport or practice a course of business which operates or would operate as fraud or deceit upon any person. CHAPTER THREE Insider Trading Section 75. Prohibited Buying or Selling of Digital Asset. It shall be unlawful for any insider to sell or buy a Digital Asset of the issuer, while in the possession of material information with respect to the issuer or the Digital Asset that is generally not available to the public, unless : (a) The insider proves that the information was not gained from such relationship; or (b) If the other party selling or buying from the insider (or his agent) is identified, the insider proves that he disclose the information to the other party, or that he had reasons to believe that the other party otherwise is also in possession of the information. For purposes of this Section , information is considered material non-public if: (a) it has not been generally disclosed to the public and would likely affect the market price of the security after being disseminated to the public and the lapse of a reasonable time to absorb the information; or (b) would be considered in determining his course of action whether to buy, sell or hold a Digital Asset. ARTICLE NINE Advertising and Marketing CHAPTER ONE Advertising Requirements Section 76. Minimum Advertising Requirements. The Digital Asset Exchange shall not advertise in any form its products, services, or activities in the Philippines or to Philippine residents without including the name of the Digital Asset Exchange and the statement that "the Digital Asset Exchange is licensed to engage in Digital Asset Business Activity by the Philippines Securities and Exchange Commission." Section 77. Prohibition against False Advertising. The Digital Asset Exchange and any person or entity acting on its behalf, shall not, directly or by implication, make any false, misleading, or deceptive representations or omissions. CHAPTER TWO Disclosures on Advertising Process Section 78. Maintenance of Advertising Materials. The Digital Asset Exchange shall maintain, for examination by the Commission, all advertising and marketing materials for a period of at least seven (7) years from the date of their creation, including but not limited to print media, internet media (including websites), radio and television advertising, road show materials, presentations, and brochures. In case of changes in the electronic advertising materials , the Digital Asset Exchange shall maintain in hard copy format copies of website captures of material changes to internet advertising and marketing, and audio and video scripts of its advertising and marketing materials, as applicable . Section 79. Disclosure Requirements on Advertising and Marketing Materials. The Digital Asset Exchange shall comply with all disclosure requirements under existing national laws, rules and regulations governing advertising and marketing. DcHSEa ARTICLE TEN Miscellaneous Provisions CHAPTER ONE Transitory Provisions Section 80. Registration of Existing Digital Asset Exchange. Any unregistered Digital Asset Exchange existing immediately prior to the effectivity of these Rules shall file an application for registration in accordance with these Rules within forty-five (45) days from effectivity, unless falling under any of the exemptions provided under these Rules . Section 81. Status of Digital Asset Exchange Operating Prior to Effectivity. Any unregistered Digital Asset Exchange who files an application for registration in accordance with the immediately preceding Section may continue with its Digital Asset Exchange business until the application has been determined and, in so doing, is not regarded as carrying on an unregistered Digital Asset Exchange business in contravention with these Rules . CHAPTER TWO Penalty Clause Section 82. Prohibited Acts. Any person, entity, group or corporation who commits any of the following prohibited acts shall be held liable and be subjected to the penalties as prescribed in Sections 54 and 73 of this R.A. 8799: a. Operating or enabling another to form or operate a Digital Asset Exchange in violation of Sec. 32 of the SRC; b. Commission of any of the disallowed digital asset exchange activities under Section 11 of these Rules; c. Manipulation, directly or indirectly, of the exchange price of Digital Assets in violation of Sec. 24 of the SRC; d. Engaging in any act which constitutes securities fraud using Digital Assets in violation of Sec. 26 of the SRC; e. Engaging in the business of buying or selling of Digital Assets as a broker or dealer, or acting as a salesman, or an associated person of any broker or dealer without being registered with the Commission in violation of Sec. 28 of the SRC; f. Any other acts committed in violation of the provision of the Securities Regulation Code. SaCIDT Section 83. Penalty Clause. If the Commission finds that there is a violation of any provision of these Rules or any applicable rules under the SRC, or that any person, in a registration statement or its supporting papers and the prospectus, as well as in the periodic reports required to be filed with the Commission has made any untrue statement of a material fact or omitted to state any material fact required to be stated therein or necessary to make the statements therein not misleading or refuses to permit any lawful examination into its corporate affairs, the Commission shall, in its discretion impose additional sanctions in addition to the existing sanctions and/or penalty fees approved and published by the Commission through its official publications such as the SRC Section 54, memorandum circulars, resolutions, website and other issuances. Furthermore, any individual, corporation, partnership, association, or other juridical entity that commits any of the prohibited acts provided for in preceding section of this Rule shall be prosecuted and upon conviction shall suffer a fine of not less than Fifty thousand pesos (Php50,000.00) or any amount not to exceed Five hundred thousand pesos (Php5,000,000.00) n or imprisonment of not less than six (7) n years or more than twelve (21) n years, or both, at the discretion of the court, including confiscation or forfeiture in favor of the government of the objects and the instrumentalities used in committing any of herein prohibited acts. If the offender is a corporation, partnership or association, or other juridical entity, the penalty shall be imposed upon the officer or officers of the corporation, partnership, association or entity responsible for the violation without prejudice to the cancellation or revocation of these entities license or accreditation issued to them by any licensing or accredited body of the government. If such offender is an alien, he or she shall, in addition to the penalties prescribed in this Act, be deported without further proceedings after service of the sentence. The prosecution for offenses set forth in these Rules shall be without prejudice to any liability for violation of Republic Act No. 3185, n as amended, otherwise known as the Revised Penal Code, and other civil liabilities. CHAPTER THREE Repealing Clause Section 84. Repealing Clause. All rules and regulations, circulars, orders, memoranda, or any part thereof and the rules and regulations previously promulgated by the Commission and/or by persons required to be registered under the Code or any part thereof, in conflict with or contrary to these Rules , are deemed repealed. CHAPTER FOUR Separability Clause Section 85. Separability Clause. If any portion or provision of these Rules is declared unconstitutional or invalid, the other portions or provisions hereof, which are not affected shall thereby continue in full force and effect. CHAPTER FIVE Effectivity Clause Section 86. Effectivity Clause. These Rules shall take effect fifteen (15) days after the date of the last publication in two (2) newspapers of general circulation. _______ July 2019, Pasay City Philippines. cHECAS EMILIO B. AQUINO Chairperson n Note from the Publisher: Copied verbatim from official copy. Discrepancy between amount in words and in figures. n Note from the Publisher: Copied verbatim from official copy. Discrepancy between amount in words and in figures. n Note from the Publisher: Copied verbatim from official copy. Discrepancy between amount in words and in figures. n Note from the Publisher: Copied verbatim from official copy. "Republic Act No. 3185" should be "Act No. 3815