Establishing an Anti-Corruption Compliance Programme Before Your Hong Kong IPO

The Hong Kong market has entered a period of heightened anti-corruption enforcement that directly impacts IPO applicants. In 2024, the Independent Commission Against Corruption (ICAC) recorded 1,832 corruption reports, a 7% increase year-on-year, and the Securities and Futures Commission (SFC) has increasingly pursued enforcement actions against listed companies for historical compliance failures. The SFC’s 2024-2026 strategic plan explicitly prioritises “enhancing market integrity” through rigorous scrutiny of sponsor due diligence, with a specific focus on anti-bribery controls under the Prevention of Bribery Ordinance (Cap. 201). For companies targeting a Hong Kong Exchange (HKEX) Main Board or GEM listing, the window for establishing a robust anti-corruption compliance programme is now. The Listing Rules require sponsors to conduct reasonable due diligence on an applicant’s internal controls, and any gap in a pre-IPO compliance framework can delay the submission of Form A1, trigger additional SFC enquiries, or—in the worst case—lead to a rejection or a post-listing enforcement action. This article outlines the structural components, regulatory benchmarks, and practical steps an issuer must take to build a defensible anti-corruption programme before filing its listing application.

Why Pre-IPO Anti-Corruption Compliance Is Non-Negotiable

The HKEX Listing Rules impose a clear, non-delegable obligation on listing applicants. Under Main Board Rule 3.08 and GEM Rule 5.01, every director must satisfy the Exchange that they have “the character, experience and integrity” to act as a director of a listed issuer. This character assessment extends to the company’s own compliance history. The Listing Decision LD43-3 (2013), which remains the Exchange’s published guidance on suitability, explicitly states that a listing applicant must demonstrate “a system of internal controls adequate for the business” and that any “history of non-compliance with laws and regulations” will be a material factor in the suitability assessment.

The SFC’s enforcement record in 2023-2024 underscores the cost of failure. In June 2024, the SFC reprimanded and fined a sponsor firm HKD 13.5 million for failing to conduct adequate due diligence on an IPO applicant’s anti-bribery controls, specifically regarding payments to third-party agents in a high-risk jurisdiction. The SFC’s Statement of Disciplinary Action (24 June 2024) noted that the sponsor had not “identified or tested the effectiveness of the issuer’s anti-corruption policies” during the listing process. This enforcement action directly references the SFC’s Code of Conduct for Persons Licensed by or Registered with the SFC, paragraph 17.6, which requires sponsors to “take reasonable steps to satisfy themselves that the listing applicant has in place adequate systems and internal controls.”

For the applicant company, the cost of non-compliance is not merely reputational. A delayed listing timeline—often six to twelve months if the SFC requires additional remediation—can erode the valuation window, increase underwriting fees, and create uncertainty for cornerstone investors.

Core Components of an Effective Programme

An anti-corruption compliance programme for a Hong Kong IPO must be structured to satisfy three distinct audiences: the HKEX Listing Division, the SFC’s intermediary supervision team, and the sponsor’s own internal compliance and legal teams. The programme should be designed to withstand the sponsor’s due diligence testing, not merely to exist on paper.

Written Policies and Codes of Conduct

The foundation is a written Anti-Corruption Policy and a Code of Conduct. These documents must be board-approved and tailored to the issuer’s specific business model, not generic templates. The policy should explicitly prohibit bribery of public officials (defined broadly under Cap. 201, Section 4) and commercial bribery (Section 9). It must cover all forms of inducement: cash, gifts, entertainment, travel, political contributions, charitable donations, and facilitation payments.

The policy should also address the issuer’s operations in jurisdictions with a higher corruption risk. The HKEX Listing Decision LD143-2023, concerning a company with operations in Southeast Asia, required the applicant to demonstrate “specific controls over payments to government intermediaries and agents in those jurisdictions.” The policy should therefore include a zero-tolerance clause for any payment to a foreign public official, aligning with the UK Bribery Act 2010 and the U.S. Foreign Corrupt Practices Act (FCPA) if the issuer has cross-border operations.

Third-Party Due Diligence and Agent Management

The single highest-risk area for a pre-IPO company is its network of third-party intermediaries—agents, consultants, distributors, and joint venture partners. The SFC’s enforcement action in 2024 specifically cited a failure to conduct due diligence on third-party agents as a key deficiency. The programme must include a formal Third-Party Due Diligence (TPDD) process.

This process should be risk-tiered. For high-risk intermediaries (those in jurisdictions with a Transparency International Corruption Perceptions Index score below 50, or those with a direct interface with government officials), the due diligence must include beneficial ownership verification, a sanctions screening against the UN, US OFAC, and EU lists, and a review of the agent’s own anti-corruption policies. The issuer must maintain a centralised register of all third-party agreements, with copies of the due diligence reports and the signed anti-corruption representations.

The contractual terms with each agent must include a specific anti-corruption clause, a right to audit the agent’s books and records, and a termination right for any breach of anti-corruption laws. The sponsor will test these agreements during its due diligence, and any missing or inadequate clause will be flagged in the sponsor’s legal due diligence report.

Gift, Entertainment, and Hospitality Controls

The HKEX and SFC place significant weight on the issuer’s controls over gifts and entertainment. The Listing Rules do not prescribe a specific monetary threshold, but the SFC’s Code of Conduct (paragraph 16.2) expects sponsors to assess whether the issuer’s policies are “commensurate with the size and nature of its business.”

A practical benchmark is the ICAC’s guideline that any gift exceeding HKD 500 in value should require prior written approval from a compliance officer. The policy should also prohibit the giving or receiving of any cash or cash-equivalent gifts (e.g., gift cards, vouchers). Entertainment expenses should be subject to a per-head limit (e.g., HKD 800 per person per event) and must be pre-approved and recorded in the company’s expense management system. All entertainment must have a documented business purpose.

For companies in sectors with a high degree of government interaction—such as infrastructure, logistics, or pharmaceuticals—the policy should further require that any entertainment of a public official must be approved by the board or a designated compliance committee.

Implementation and Operational Integration

A policy that exists only in a board binder is a liability. The sponsor will test whether the policy is actually operationalised. The programme must be embedded into the issuer’s day-to-day operations through training, monitoring, and a whistleblowing channel.

Training and Certification

The HKEX’s Corporate Governance Code (Appendix 14, Code Provision D.2.7) recommends that all directors receive “continuous professional development” on governance matters. An anti-corruption training programme must be mandatory for all directors, senior management, and any employee with a role in procurement, sales, or government relations. The training should cover the specific provisions of Cap. 201, the issuer’s own policy, and the consequences of non-compliance (including personal criminal liability under Section 9 of Cap. 201, which carries a maximum penalty of HKD 500,000 and seven years’ imprisonment).

The training must be documented. Each participant should sign an attendance record and a certification that they have read and understood the policy. The issuer should maintain a central training register, which the sponsor will review during its due diligence.

Whistleblowing and Investigation Procedures

The Corporate Governance Code (Code Provision D.2.6) requires a listed issuer to have a “whistleblowing policy” that allows employees to raise concerns in confidence. For a pre-IPO company, this requirement should be implemented before the listing application. The policy must provide for an independent channel—typically an external hotline or an email address managed by the audit committee or a designated compliance officer—that allows anonymous reporting.

The policy must also specify the investigation procedures. The issuer should designate a qualified internal investigator (or engage an external law firm) to handle all whistleblowing reports. The investigation must be documented, and any substantiated allegation must result in appropriate disciplinary action, up to and including termination of employment and referral to the ICAC.

Continuous Monitoring and Auditing

The programme must include a monitoring component. The internal audit function—or an outsourced internal audit provider—should conduct periodic testing of the anti-corruption controls. The audit scope should include a review of a sample of gift and entertainment expenses, a review of a sample of third-party agent files, and a test of the whistleblowing channel’s effectiveness. The audit results must be reported to the audit committee quarterly.

For the sponsor’s due diligence, the issuer should prepare a compliance dashboard that summarises the following data for the three years preceding the listing application: number of whistleblowing reports received, number of investigations opened and closed, total value of gifts and entertainment given and received, and any instances of non-compliance with the anti-corruption policy. This dashboard will be a key document in the sponsor’s workpapers.

The Sponsor’s Due Diligence Perspective

The issuer’s compliance programme will be tested through the sponsor’s due diligence, which is governed by the SFC’s Code of Conduct and the HKEX’s Listing Rules. The sponsor is required to “take reasonable steps to satisfy themselves that the listing applicant has in place adequate systems and internal controls” (SFC Code of Conduct, paragraph 17.6). This is not a tick-box exercise.

Document Review and Interviews

The sponsor’s legal team will request a complete set of the issuer’s compliance policies, training records, third-party agent files, and whistleblowing reports. They will also conduct interviews with the compliance officer, the CFO, and the CEO. The sponsor will test whether the policy is understood and followed. A common deficiency is a policy that is well-written but not operationally embedded—for example, a policy that prohibits gifts over HKD 500 but where the expense management system does not require any approval for gifts.

Red Flags and Remediation

The sponsor will identify any red flags during its due diligence. Common red flags include: a high volume of payments to agents in jurisdictions with a low Transparency International score; a pattern of entertainment expenses to government officials without documented business justifications; or a whistleblowing channel that has received no reports in three years (which may indicate a lack of trust in the system rather than a clean record).

If the sponsor identifies a material deficiency, the issuer must remediate before the Form A1 filing. Remediation typically involves: (i) updating the policy; (ii) conducting a retrospective review of high-risk transactions; (iii) implementing new controls; and (iv) engaging an external consultant to validate the remediation. The sponsor will document the remediation in its due diligence report, which is submitted to the HKEX and the SFC.

Actionable Takeaways

• The HKEX Listing Rules and SFC enforcement actions require an IPO applicant to have a board-approved, operationally embedded anti-corruption compliance programme before filing Form A1, not after.
• The programme must include a risk-tiered third-party due diligence process, a written gift and entertainment policy with specific monetary thresholds, and a documented training certification for all directors and relevant employees.
• A whistleblowing channel with an independent reporting mechanism and a documented investigation procedure is a non-negotiable requirement under the Corporate Governance Code, and its absence will be flagged by the sponsor.
• The sponsor’s due diligence will test the operational effectiveness of the programme, not just its existence; a compliance dashboard with three years of data should be prepared in advance.
• Any material deficiency identified during the sponsor’s due diligence must be remediated before the listing application is submitted, and the remediation must be validated by an external consultant and documented in the sponsor’s workpapers.