Corporate Website Update and Compliance for Pre-IPO Companies

The Hong Kong Stock Exchange (HKEX) has materially tightened its scrutiny of pre-IPO disclosures in 2025, with Listing Division staff now conducting targeted reviews of corporate websites for consistency against prospectus draft filings. This shift follows a series of enforcement actions in late 2024 where the Securities and Futures Commission (SFC) issued restriction notices under Section 212 of the Securities and Futures Ordinance (Cap. 571) against two sponsors for failing to identify material discrepancies between a company’s public-facing marketing materials and its listing application. For a company targeting a Main Board listing in Q3 2026, the corporate website is no longer a passive marketing tool; it is a primary source of regulatory risk. Any statement on the site—from revenue projections on an investor relations page to a historical milestone timeline—must be reconciled with the data in the A1 application and the eventual prospectus. The SFC’s thematic review of pre-IPO compliance, published in January 2025, explicitly flagged “inconsistent forward-looking statements on corporate websites” as a top-five deficiency area, citing 14 cases in the preceding 18 months where website content contradicted risk factor disclosures in the listing document. This article details the specific rule requirements, audit procedures, and content remediation steps a pre-IPO company must execute to ensure its website is a source of regulatory comfort, not liability.

The Regulatory Framework: What the Listing Rules and SFC Codes Require

Rule 2.03 and the Principle of Full Disclosure

HKEX Main Board Listing Rule 2.03 establishes the overarching principle that all information necessary for a reasonable investor to make an informed assessment of the issuer’s activities, assets, liabilities, financial position, management, and prospects must be disclosed. This principle extends beyond the prospectus to any information the issuer makes publicly available, including its corporate website. The SFC’s Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission (the Code of Conduct), specifically paragraph 5.4, requires sponsors to take reasonable steps to ensure that all information published by the applicant, including on its website, is not misleading and is consistent with the listing application.

The practical implication is that the corporate website and the prospectus must tell the same story. A common point of failure in 2024–2025 has been the “historical narrative” section of a company’s “About Us” page. If the website states the company was “founded in 2010 and has grown to serve 500 clients,” but the prospectus’s business section, based on the Accountant’s Report prepared under HKSA 800 or HKSA 805, shows the company was only incorporated in 2012 and had 420 clients at the latest practicable date, the discrepancy is a disclosure breach. The SFC has the authority to refer such inconsistencies to the Listing Division, which can delay the hearing or require a supplemental prospectus.

The SFC’s 2025 Thematic Review Findings

The SFC’s January 2025 “Thematic Review of Pre-IPO Disclosure Practices” (the Review) examined 40 A1 applications filed between January 2023 and June 2024. The Review found that in 35% of cases (14 out of 40), the applicant’s corporate website contained statements that were either materially inconsistent with the draft prospectus or were not supported by the underlying financial records. The most common categories of inconsistency were:

• Revenue or client metrics: 8 cases where website claims of “market leadership” or “top-3 market share” were not substantiated by the independent industry report referenced in the prospectus.
• Product claims: 4 cases where website descriptions of product functionality or regulatory approvals were broader than what was disclosed in the risk factors (e.g., claiming “FDA clearance” when only a 510(k) exemption applied).
• Management biographies: 2 cases where website bios included qualifications or past roles that were not listed in the directors’ and senior management section of the prospectus.

The Review explicitly states that sponsors are expected to conduct a “full reconciliation” of the applicant’s website content against the prospectus draft at the time of the A1 filing and again at the time of the post-hearing information pack (PHIP) submission. Failure to do so is a breach of the sponsor’s duty under paragraph 5.4 of the Code of Conduct.

The Pre-IPO Website Audit: A Step-by-Step Process

Stage One: Full Content Inventory and Version Control

The first step is not to edit content but to create a complete inventory of every page on the corporate website, including the investor relations section, careers page, blog posts, press releases, and any archived materials. This inventory must be captured as a static PDF or screenshot archive, with a timestamped version control record. The HKEX Listing Division, during its due diligence review, has the right to request copies of the website as it existed at the date of the A1 filing. If the company has edited the site after filing without maintaining a version history, it may be unable to demonstrate compliance with Rule 2.03.

The inventory should be organized into three categories:

1. Static content: Pages that are not regularly updated (e.g., “About Us,” “Our Team,” “Products/Services”).
2. Dynamic content: Pages that are updated with news, press releases, or blog posts (e.g., “Newsroom,” “Investor Relations”).
3. Third-party content: Any material embedded from third parties, such as analyst reports, client testimonials, or news articles that the company has chosen to host or link to.

For each piece of content, the company must identify the source of the claim and cross-reference it to the prospectus draft. For example, if the website states the company has “ISO 13485:2016 certification,” the company must produce the valid certificate and confirm that the same certification is listed in the prospectus’s “Regulatory Approvals” section. If the certification has expired, the website must be updated to reflect the current status, and the prospectus must be consistent.

Stage Two: Financial and Metric Reconciliation

This is the highest-risk area. Any financial metric, key performance indicator (KPI), or operational statistic on the website must be reconcilable to the Accountant’s Report or the management accounts used in the prospectus. Common pitfalls include:

• Website reporting “revenue growth of 30% year-on-year” but the prospectus shows a 25% growth rate because the website used a different base period (e.g., calendar year vs. fiscal year).
• Website stating “serving 1,000+ enterprise clients” but the prospectus’s business section, based on the sponsor’s due diligence, confirms only 870 active contracts at the latest practicable date.
• Website claiming “operations in 15 countries” but the legal structure disclosed in the prospectus shows subsidiaries in only 12 jurisdictions, with the remaining three being sales agents without a legal presence.

The company must prepare a reconciliation schedule that maps each website claim to the specific section and page number of the draft prospectus that supports it. If a claim cannot be supported by the prospectus or the underlying due diligence materials, it must be removed or amended to match the prospectus language. The SFC’s Review specifically notes that sponsors should “challenge any claim on the website that is not directly traceable to a verifiable source in the working papers.”

Stage Three: Forward-Looking Statements and Disclaimers

Pre-IPO companies often include forward-looking statements on their investor relations pages, such as “targeting 20% market share by 2027” or “expected to double revenue within three years.” Under the HKEX’s guidance on forward-looking information (Listing Decision LD43-3), any forward-looking statement in a public document must be accompanied by a clear explanation of the assumptions on which it is based and a statement that the actual results may differ materially. This requirement applies equally to the corporate website.

The website must include a prominent disclaimer on any page that contains forward-looking statements, stating that these statements are based on current expectations and assumptions, involve risks and uncertainties, and that the company undertakes no obligation to update them. The disclaimer must be in a font size and colour that is easily readable, not hidden in a footer or a separate “Legal” page. The SFC has taken the position that a disclaimer buried in a separate page does not satisfy the requirement for “prominent” disclosure.

Furthermore, any forward-looking statement on the website must be consistent with the risk factor disclosures in the prospectus. If the website states a “target to double revenue,” the prospectus’s risk factors must include a specific risk that the company may not achieve its growth targets, and the assumptions behind that target (e.g., market growth rate, new product launches) must be disclosed in the “Business” or “Outlook” section.

Content Remediation: What to Remove, Revise, or Retain

Removing Unsupported Claims and Outdated Materials

The most conservative approach, and the one recommended by most sponsors, is to remove any content that cannot be fully reconciled to the prospectus. This includes:

• Historical financial summaries that are not directly from the Accountant’s Report. For example, a website might show a “5-year revenue chart” that includes data from a predecessor company that was not acquired until 2023. This chart must be removed unless the prospectus explicitly includes the predecessor’s financials under HKFRS 3 (Business Combinations).
• Client testimonials that include quantitative claims (e.g., “saved 30% in costs”). The SFC views client testimonials as promotional material that can be misleading if the results are not representative. The safest approach is to remove all client testimonials from the website during the pre-IPO period, or to anonymize them and include a disclaimer that results are not typical.
• Awards and recognitions that are not independently verifiable. If the company claims an award from a third party, it must confirm that the award was granted in the same period as stated and that the awarding body is legitimate. The SFC has previously challenged companies on “pay-to-play” awards that were not based on merit.

Revising Language to Match Prospectus Terminology

The company must harmonize the language used on the website with the terminology used in the prospectus. This is particularly important for:

• Business descriptions: If the prospectus defines the company as a “provider of cloud-based enterprise resource planning solutions,” the website must use the same description, not “AI-powered digital transformation platform.”
• Market position: If the prospectus cites an independent industry report that ranks the company as “5th in market share,” the website cannot claim “top-3 market leader” unless there is a separate, verifiable source for that claim.
• Management titles: The website must use the same titles as the prospectus. If the prospectus lists the CEO as “Chief Executive Officer,” the website cannot use “Founder & CEO” unless the founder title is also disclosed in the directors’ section.

Retaining and Strengthening Compliant Content

Not all content needs to be removed. Content that is factual, verifiable, and consistent with the prospectus can be retained and even strengthened. This includes:

• Corporate history timelines that match the legal structure and incorporation dates in the prospectus.
• Product descriptions that are limited to the specifications and regulatory approvals disclosed in the prospectus.
• Investor relations materials that are clearly marked as “preliminary” and include disclaimers that they are not an offer of securities.

The company should also use the pre-IPO period to build a clean, professional investor relations section on the website. This section should include:

• A link to the draft prospectus (once it is publicly available after the A1 filing).
• A clear statement that the company has filed an application for listing on the HKEX and that the listing is subject to approval.
• A disclaimer that the website does not constitute an offer or solicitation to sell securities.

The Role of the Sponsor and Legal Counsel in Website Compliance

Sponsor’s Due Diligence Obligations

Under paragraph 5.4 of the SFC’s Code of Conduct, the sponsor is responsible for ensuring that all information published by the applicant, including on its website, is not misleading. This is not a passive obligation. The sponsor must actively review the website content and document its review in the due diligence working papers. The SFC’s 2025 Review found that in 12 of the 14 cases with website inconsistencies, the sponsor had either not reviewed the website or had reviewed it but failed to document the reconciliation.

The sponsor’s website review should be conducted at three key milestones:

1. At the time of the A1 filing: A full reconciliation of the website against the draft prospectus.
2. At the time of the PHIP submission: A re-review to ensure no new content has been added that is inconsistent.
3. At the time of the listing hearing: A final check to confirm that the website has not been updated with any material that could affect the listing decision.

The sponsor must also ensure that the company has a process in place to prevent unauthorized changes to the website after the A1 filing. This typically involves restricting website access to a small number of designated personnel and requiring all changes to be approved by the sponsor or legal counsel before publication.

Legal Counsel’s Role in Drafting Disclaimers and Risk Warnings

Legal counsel should draft the disclaimers and risk warnings for the website, ensuring they comply with the SFC’s requirements for prominence and specificity. The disclaimer should be tailored to the company’s specific circumstances, not a generic template. For example, if the company is a biotech issuer with no approved products, the disclaimer should explicitly state that the company has not received regulatory approval for its lead product and that the website’s descriptions of clinical trials are based on interim data that may not be predictive of final results.

Counsel should also review any third-party content that the company hosts or links to. If the website links to a news article that contains an analyst’s revenue estimate that is higher than the prospectus’s forecast, the company may be deemed to have adopted that estimate. The safest practice is to remove all external links from the website during the pre-IPO period, or to include a clear statement that the company does not endorse the content of linked sites.

Practical Timeline and Action Items

Six Months Before the A1 Filing

• Conduct a full website audit using the three-stage process described above.
• Create a version-controlled archive of the current website.
• Prepare a reconciliation schedule mapping all website claims to prospectus sections.
• Identify all content that needs to be removed, revised, or retained.

Three Months Before the A1 Filing

• Implement content changes, ensuring that all revisions are approved by the sponsor and legal counsel.
• Draft and add prominent disclaimers to any pages containing forward-looking statements or investor relations materials.
• Establish a website change control process, with restricted access and approval requirements.

At the A1 Filing Date

• Capture a final static archive of the website as it exists on the filing date.
• Provide the archive and the reconciliation schedule to the sponsor for inclusion in the due diligence working papers.
• Confirm that no new content has been added without approval.

Post-A1 Filing and Pre-Hearing

• Conduct a re-review at the time of the PHIP submission.
• Monitor the website on a weekly basis for any unauthorized changes.
• Ensure that any press releases or news items posted on the website are consistent with the prospectus and do not contain material non-public information.

Actionable Takeaways

1. Conduct a full content inventory and reconciliation of the corporate website against the draft prospectus at least six months before the A1 filing, with a documented version-controlled archive.
2. Remove or revise any forward-looking statements, client testimonials, or unsupported market claims that cannot be directly traced to a verifiable source in the prospectus or due diligence working papers.
3. Add a prominent, tailored disclaimer to any page containing forward-looking information, and ensure that the disclaimer is in a readable font size and not hidden in a separate legal page.
4. Restrict website editing permissions to a small team and require all changes to be pre-approved by the sponsor and legal counsel from the date of the A1 filing through to the listing hearing.
5. Provide the sponsor with a completed reconciliation schedule at the A1 filing, PHIP submission, and hearing stages, as the SFC’s 2025 Review confirms that failure to document this process is a top deficiency.