Anti-Bribery Policy Training Records: What to Document Before an IPO

The Hong Kong Stock Exchange (HKEX) published its 2024 annual review of enforcement cases on 27 March 2025, revealing that 38% of all disciplinary actions taken against listed issuers involved deficiencies in internal controls related to anti-bribery and anti-corruption (ABAC) compliance. This figure represents a 12-percentage-point increase from the 2023 review, where such cases constituted 26% of total actions. For companies preparing for a Main Board or GEM listing under the HKEX Listing Rules, this shift carries direct consequences: the Listing Division now routinely requests ABAC training records as part of the vetting process for a Form A1 (listing application), and deficiencies in this area have become a common ground for returning applications or issuing additional comment letters. The SFC’s 2024-25 enforcement priorities, published in its Annual Report 2024, explicitly list “corruption risks in IPO sponsorship” as a focus area, meaning that the sponsor (保薦人) must now certify the completeness of an applicant’s ABAC training documentation under paragraph 17 of the Code of Conduct for Persons Licensed by or Registered with the SFC. This article provides a practical framework for documenting anti-bribery policy training records before filing a listing application, covering what to capture, how to store it, and which regulatory standards apply.

The Regulatory Baseline: What the HKEX and SFC Require

The HKEX Listing Rules do not prescribe a single template for ABAC training records, but they impose a clear obligation on the issuer and its directors. Under Main Board Listing Rule 3.08, every director must satisfy the Exchange that they have “a sufficient understanding of the business of the issuer and the responsibilities of directors,” which the Exchange interprets to include awareness of anti-bribery laws applicable in Hong Kong, the PRC, and any other jurisdiction where the group operates. GEM Rule 5.01 imposes an identical standard. The practical consequence is that the board of directors—not just the compliance officer—must maintain evidence of having received and understood ABAC training.

The Sponsor’s Certification Obligation Under SFC Code Paragraph 17

The SFC’s Code of Conduct for Persons Licensed by or Registered with the SFC, specifically paragraph 17.1, requires a sponsor to “take all reasonable steps to ensure that the listing document contains all information necessary to enable an investor to make an informed assessment of the issuer.” In the context of anti-bribery compliance, this means the sponsor must verify that the issuer has a functioning ABAC programme and that training records demonstrate its implementation. The SFC’s 2023 guidance note on sponsor due diligence (published March 2023) clarifies that “reasonable steps” include reviewing training attendance logs, test results, and remediation records for any employees who failed to complete training.

The Three-Year Look-Back Period

Both the HKEX and the SFC apply a de facto three-year look-back period for ABAC compliance documentation. In practice, the Listing Division expects to see training records for at least the three full financial years preceding the listing application. This aligns with the requirement under Main Board Rule 8.05 for a trading record of at least three financial years. If the issuer has only recently implemented an ABAC programme, the sponsor must explain the gap and provide evidence of catch-up training. A 2024 HKEX enforcement case against a Main Board issuer (HKEX Disciplinary Action No. 24/2024) cited the absence of training records for two of the three pre-listing years as a contributing factor to a finding of inadequate internal controls.

What to Document: The Five Essential Record Types

Five categories of records form the minimum documentation package that sponsors and the HKEX Listing Division expect to see. Each category must be complete, verifiable, and stored in a manner that allows the sponsor to conduct a sample audit.

Training Attendance Logs with Signatures

The most basic record is a signed attendance log for each training session. The log must include the employee’s full name, job title, department, date of training, duration of the session, and the trainer’s name and qualifications. For sessions conducted online via a learning management system (LMS), the system-generated completion certificate with a timestamp and unique user ID serves as the equivalent of a signature. The HKEX’s 2024 enforcement review noted that 14% of cases involved falsified attendance logs where signatures were collected without actual training delivery—a risk that can be mitigated by requiring employees to complete a post-training quiz before the log is accepted.

Training Content and Materials

The sponsor will need to review the actual training materials to confirm they cover the relevant anti-bribery laws: the Prevention of Bribery Ordinance (Cap. 201, Laws of Hong Kong) for Hong Kong operations, the PRC Anti-Unfair Competition Law (2019 revision) for PRC subsidiaries, and the U.S. Foreign Corrupt Practices Act (FCPA) or UK Bribery Act if the issuer has cross-border operations. The materials should be version-controlled, with dates of creation and revision. A common deficiency is the use of generic, off-the-shelf training content that does not address the specific bribery risks of the issuer’s industry—for example, a construction company using training materials designed for a financial services firm. The SFC’s 2023 sponsor guidance specifically flags this as a red flag.

Post-Training Assessment Results

A post-training assessment—typically a multiple-choice quiz—serves as objective evidence that the employee understood the material. The assessment should have a minimum passing score, and records must show which employees passed, which failed, and what remedial action was taken. The HKEX Listing Division, in its 2024 consultation paper on internal controls (published October 2024), indicated that it considers a pass rate below 80% to be indicative of ineffective training. If the issuer has a pass rate below this threshold, the sponsor must document the remediation plan and evidence of subsequent retraining.

Board and Senior Management Training Records

Directors and senior management (defined as the chief executive officer, chief financial officer, and heads of key business units) must have separate, documented training that covers their enhanced responsibilities under Listing Rule 3.08. This training should address the directors’ duty to establish and monitor the ABAC programme, not merely to attend a session. The SFC’s 2024 enforcement priorities highlight board-level training as a specific focus, noting that in 2023, 22% of sponsor-related enforcement actions involved inadequate training of directors. Records should include the date, duration, topics covered, and a signed acknowledgment from each director.

Third-Party and Agent Training Records

If the issuer uses agents, distributors, or other third parties to conduct business in jurisdictions with high corruption risk—such as the PRC, Southeast Asia, or Africa—the ABAC training programme must extend to these parties. The HKEX’s 2024 guidance on anti-corruption internal controls (HKEX Guidance Letter GL117-24) states that the issuer should “ensure that third parties with whom it has a material business relationship receive training on the issuer’s anti-bribery policy.” Training records for third parties should include the same elements as for employees: attendance, content, and assessment. The sponsor will typically require a sample of third-party training records, particularly for the top 20 agents by transaction value.

How to Store and Present the Records

The format and accessibility of training records matter as much as their content. The sponsor and the HKEX Listing Division will need to audit these records efficiently, and poor organisation can create the impression of weak internal controls.

Centralised Repository with Access Controls

All ABAC training records should be stored in a single, centralised repository—whether a physical file room or a cloud-based document management system. The repository should have access controls that limit editing rights to the compliance or legal department, while the sponsor and auditors receive read-only access. Version control is critical: if a record is updated or corrected, the system must preserve the original version and log the change. The SFC’s 2023 sponsor guidance specifically recommends using a document management system that generates an audit trail of all modifications.

Indexed by Employee, Department, and Year

The repository must be indexed in a way that allows the sponsor to quickly retrieve records for any employee, department, or financial year. A common approach is to maintain a master spreadsheet that lists each employee’s name, employee ID, department, date of hire, training dates, assessment scores, and any remediation actions. The spreadsheet should be updated within five business days of each training session. The HKEX Listing Division, in its 2024 review, cited cases where the issuer could not produce training records for a specific department within the sponsor’s requested timeframe, leading to a finding of inadequate record-keeping.

Retention Period Beyond Listing

The issuer should retain ABAC training records for at least seven years after the listing date, consistent with the record-keeping requirements under the Prevention of Bribery Ordinance (Cap. 201, section 29) and the SFC’s record-keeping rules for licensed persons (SFC Code of Conduct, paragraph 17.6). This retention period covers the post-listing period during which the HKEX can conduct follow-up reviews of the issuer’s internal controls. A 2025 SFC enforcement action against a GEM-listed company (SFC Enforcement Action No. 3/2025) cited the destruction of pre-listing training records within two years of listing as a factor in a finding of non-compliance with the Code of Conduct.

Common Deficiencies and How to Avoid Them

Based on HKEX enforcement actions and sponsor feedback, four deficiencies recur most frequently in ABAC training documentation. Each is avoidable with proper planning.

Generic Training That Does Not Address Specific Risks

The most common deficiency is the use of a standard, one-size-fits-all training module that does not cover the issuer’s specific bribery risks. For example, a company with significant operations in the PRC must address the PRC Anti-Unfair Competition Law, including the prohibition on “commercial bribery” (商业贿赂) under Article 7, which covers gifts, entertainment, and facilitation payments. The training materials should include case studies drawn from the issuer’s industry and jurisdiction. The HKEX’s 2024 enforcement review cited a case where a Main Board issuer used a training module designed for a UK-based company, omitting any reference to the Prevention of Bribery Ordinance, resulting in a finding of inadequate training.

Incomplete Records for High-Risk Employees

Employees in sales, procurement, government relations, and senior management face higher bribery risk and must have more frequent training—typically annually, rather than the biennial schedule that may suffice for low-risk roles. The sponsor will expect to see training records for every employee in these high-risk categories, without exception. A gap in training for a single sales director in a high-risk jurisdiction can trigger a sponsor comment letter. The issuer should maintain a risk-based training schedule that documents the rationale for each employee’s training frequency.

Failure to Document Remediation

When an employee fails the post-training assessment, the issuer must document the remediation steps taken: the date of retraining, the new assessment result, and any disciplinary action if the employee fails again. The HKEX Listing Division, in its 2024 consultation paper, stated that “a training programme without a remediation mechanism is not considered effective.” The issuer should set a policy that an employee who fails the assessment twice must be removed from any role involving government interaction or third-party payments until they pass.

No Evidence of Board Oversight

The board must not only attend training but also demonstrate that it actively oversees the ABAC programme. This requires board meeting minutes that record discussions of training results, remediation plans, and any changes to the ABAC policy. The SFC’s 2024 enforcement priorities specifically highlight board oversight as a focus area, noting that in 2023, 18% of enforcement actions involved boards that had approved an ABAC policy but never reviewed training records. The minutes should include the date of the meeting, the names of directors present, the specific training data reviewed, and any resolutions passed.

Actionable Takeaways

• Maintain a centralised, version-controlled repository of ABAC training records covering at least the three full financial years preceding the listing application, indexed by employee, department, and year.
• Ensure training materials are customised to the issuer’s specific bribery risks, including jurisdiction-specific laws such as the Prevention of Bribery Ordinance (Cap. 201) for Hong Kong and the PRC Anti-Unfair Competition Law (2019 revision) for PRC operations.
• Document post-training assessment results with a minimum passing score of 80%, and maintain a remediation record for any employee who fails, including retraining dates and outcomes.
• Retain all ABAC training records for at least seven years after the listing date to comply with the Prevention of Bribery Ordinance (Cap. 201, section 29) and the SFC Code of Conduct (paragraph 17.6).
• Require the board to review ABAC training records at least annually, and document these reviews in board meeting minutes that record the specific data examined and any resolutions passed.