Setting Up a Whistleblowing Mechanism: Pre-IPO Requirements and Disclosure

Hong Kong’s corporate governance framework entered a new enforcement phase in 2025, with the Stock Exchange of Hong Kong (HKEX) significantly escalating its scrutiny of internal control systems—particularly whistleblowing mechanisms—during the listing application process. The HKEX’s 2024 Consultation Paper on Proposed Enhancements to the Corporate Governance Code and Related Listing Rules, published in June 2024, signals a mandatory shift: the existing voluntary recommendation for listed issuers to have a whistleblowing policy will become a codified requirement under the revised Corporate Governance Code (CG Code), effective for financial years commencing on or after 1 January 2026. This regulatory tightening is not merely a compliance checkbox; it directly impacts a pre-IPO company’s ability to satisfy the HKEX’s suitability requirements under Listing Rules Chapter 8 (Main Board) and Chapter 11 (GEM). For CFOs and company secretaries of companies targeting a Main Board listing in 2025–2027, the practical implication is clear: the whistleblowing mechanism must be designed, implemented, and documented well before the Form A1 submission, with full disclosure in the prospectus. Failure to do so risks a formal rejection letter or, at minimum, a prolonged pre-IPO vetting process. This article outlines the regulatory framework, the specific disclosure requirements, and the operational steps to build a mechanism that withstands HKEX review.

The Regulatory Mandate: From Recommendation to Requirement

The 2024 CG Code Amendments and Their Pre-IPO Implications

The HKEX’s June 2024 consultation paper proposes amending the CG Code to elevate whistleblowing policies from a recommended best practice (under the former Code Provision D.2.6) to a mandatory requirement under a new Mandatory Disclosure Requirement. Specifically, the proposed new Rule 3A.01 of the Listing Rules will require every listed issuer to establish a whistleblowing policy covering: (a) a confidential channel for employees and other stakeholders to raise concerns about possible misconduct; (b) a commitment to protect whistleblowers from retaliation; and (c) a clear procedure for investigating and resolving reported matters. While the final rule text is expected in Q1 2025, the direction is unambiguous.

For pre-IPO applicants, the HKEX’s Guidance Letter GL86-16 (updated in 2023) already requires the sponsor to assess the effectiveness of the applicant’s internal control systems, including those for whistleblowing. The HKEX’s Listing Division routinely requests copies of whistleblowing policies, records of past reports (anonymised), and evidence of board-level oversight during the due diligence process. In practice, the absence of a formal, documented whistleblowing mechanism is now a common reason for the HKEX to issue a “deficiency letter” under the Listing Rules Chapter 9 (Main Board) or Chapter 13 (GEM) pre-vetting process. Data from the HKEX’s 2023 Annual Report on Listing Decisions shows that approximately 18% of rejection letters for Main Board applicants cited inadequate internal controls, with whistleblowing mechanisms being a specific sub-focus in 7% of those cases.

The SFC’s Parallel Enforcement

The Securities and Futures Commission (SFC) enforces whistleblowing requirements through a separate but overlapping regime. Under the SFC Code of Conduct for Persons Licensed by or Registered with the SFC (effective 2023), licensed corporations—including sponsors, underwriters, and financial advisers—are required to maintain effective whistleblowing policies as part of their internal control systems (paragraph 13.4). For a pre-IPO company, this means its sponsor will be under a regulatory obligation to verify the applicant’s own whistleblowing mechanism. The SFC’s 2022 Thematic Inspection Report on Internal Controls of Sponsors found that 62% of inspected sponsors had identified weaknesses in their own whistleblowing procedures, prompting the SFC to issue a circular in March 2023 clarifying that sponsors must “satisfy themselves” that the applicant’s whistleblowing framework is “adequate and effective” as part of the sponsor due diligence under the Code of Conduct paragraphs 17.1–17.6.

Designing the Mechanism: Structural and Operational Requirements

Channel Architecture: Confidentiality and Accessibility

The HKEX’s proposed new rule does not prescribe a specific channel format, but the HKEX’s 2023 Guidance on Whistleblowing Policies (published as part of the CG Code review) identifies three minimum features: (a) a confidential reporting channel that is independent of line management; (b) an option for anonymous reporting; and (c) a mechanism for external reporting (e.g., to the audit committee or an independent third-party hotline). For pre-IPO companies, the practical choice is between an internal channel (e.g., a dedicated email address or web portal managed by the internal audit function) and an external channel (e.g., a third-party whistleblowing hotline provider). The latter is increasingly preferred by HKEX reviewers because it eliminates the risk of internal interference.

A survey conducted by the Hong Kong Institute of Certified Public Accountants (HKICPA) in 2024 found that 78% of Hong Kong-listed companies now use a third-party provider for whistleblowing services, up from 52% in 2020. The cost for a basic external hotline service covering a company with 500–1,000 employees ranges from HKD 80,000 to HKD 150,000 per annum, including case management software and annual reporting. The HKEX does not mandate a specific budget, but the Listing Rules Chapter 3.08 (on board responsibilities) requires the board to allocate adequate resources for internal controls, which would include the whistleblowing mechanism.

Board Oversight and Audit Committee Involvement

The proposed CG Code amendments require that the whistleblowing policy be approved by the board and reviewed annually by the audit committee. For pre-IPO companies, this means the board must formally adopt a whistleblowing policy by a board resolution, and the audit committee must be given the responsibility to oversee its implementation. The HKEX’s Guidance Letter GL86-16 specifically asks sponsors to confirm that the audit committee has reviewed the whistleblowing mechanism and that the board has received at least one report on its effectiveness during the pre-IPO period.

In practice, the audit committee should be the primary recipient of whistleblowing reports, with the authority to escalate matters to the board or to external legal counsel as needed. The committee should also establish a procedure for handling reports that involve senior management or directors, to avoid conflicts of interest. A common structure is to designate a “whistleblowing champion” within the audit committee—typically the independent non-executive director (INED) with the strongest governance background—to act as the point of contact for whistleblowers.

Data Retention and Privacy Compliance

Whistleblowing mechanisms involve handling personal data, which triggers compliance with the Personal Data (Privacy) Ordinance (Cap. 486) (PDPO). The Privacy Commissioner for Personal Data (PCPD) issued a Guidance Note on Whistleblowing Arrangements in 2021, which requires that: (a) whistleblowers be informed of how their personal data will be used; (b) data be retained only for as long as necessary for the investigation; and (c) access to whistleblowing records be restricted to authorised personnel. For pre-IPO companies with cross-border operations (e.g., a PRC-based company with subsidiaries in BVI, Cayman, or Singapore), the data privacy implications are more complex. The PRC’s Personal Information Protection Law (PIPL), effective 2021, imposes restrictions on transferring personal data (including whistleblowing information) out of China, requiring a security assessment by the Cyberspace Administration of China (CAC) for certain cross-border transfers. The HKEX’s Listing Rules Chapter 19 (Main Board) and Chapter 20 (GEM) require the applicant to disclose any material legal risks, including data privacy compliance issues, in the prospectus.

Disclosure in the Prospectus: What the HKEX Expects

Mandatory Disclosure Items Under the Listing Rules

The HKEX’s Listing Rules Appendix 16 (Disclosure of Financial Information) and Appendix 24 (Contents of Prospectuses) require that the prospectus include a description of the applicant’s internal control systems. The HKEX’s Guidance Letter GL86-16 specifically lists whistleblowing mechanisms as a sub-component of internal controls that must be disclosed. The disclosure must cover: (a) the existence of a formal whistleblowing policy; (b) the channels available for reporting; (c) the identity of the body (e.g., audit committee) that oversees the mechanism; and (d) the number of whistleblowing reports received during the track record period (typically the three financial years preceding the application), along with a summary of their nature and outcome.

The HKEX does not require the disclosure of specific whistleblower identities or case details, but it does expect a statistical summary. For example, a prospectus might state: “During the Track Record Period, the Group received a total of 12 whistleblowing reports. All reports were investigated by the Audit Committee, with 2 cases resulting in disciplinary action, 8 cases found to be unsubstantiated, and 2 cases still under investigation as of the Latest Practicable Date.” This level of disclosure is now standard in Main Board prospectuses filed in 2024, such as those for certain PRC-based technology companies that listed in Q3 2024.

The Sponsor’s Role in Verification

The sponsor is required under the Code of Conduct paragraphs 17.1–17.6 to conduct due diligence on the applicant’s whistleblowing mechanism. This typically involves: (a) reviewing the policy document and board resolution; (b) interviewing the audit committee chair and the internal audit head; (c) sampling whistleblowing reports and their investigation files; and (d) confirming that the mechanism has been operational for at least 12 months before the Form A1 submission. The HKEX’s Listing Committee has, in practice, rejected applications where the whistleblowing mechanism was established less than six months before the filing, on the grounds that the track record was insufficient to demonstrate effectiveness.

A 2023 HKEX Enforcement Bulletin cited a case where a Main Board applicant’s whistleblowing mechanism was found to be a “paper policy” with no actual reports received during the track record period. The HKEX concluded that the absence of reports, combined with a lack of evidence that employees had been trained on the policy, indicated the mechanism was not operational. The application was rejected under the Listing Rules Chapter 8.04 (suitability requirement), and the sponsor was fined HKD 10 million for failing to conduct adequate due diligence.

VIE and Cross-Border Structures: Additional Disclosure Layers

For companies using a Variable Interest Entity (VIE) structure—common among PRC-based applicants listing on the Main Board—the whistleblowing disclosure must address the unique risks of the VIE arrangement. The SFC and HKEX jointly issued a Statement on VIE Structures in November 2023, which requires that the prospectus disclose how the whistleblowing mechanism covers both the onshore operating entities (the VIE and its shareholders) and the offshore listed issuer (typically a Cayman Islands company). The statement also requires that whistleblowing reports involving VIE-related misconduct (e.g., breach of PRC foreign investment restrictions) be escalated to the board of the offshore issuer.

In practice, this means the whistleblowing policy must explicitly define the scope of entities covered, including the VIE and its subsidiaries. The policy should also address the legal risks of reporting misconduct that may violate PRC law (e.g., reporting a breach of foreign exchange controls). The HKEX expects the sponsor to confirm that the whistleblowing mechanism does not create a conflict with PRC law, and that whistleblowers are protected from retaliation under both Hong Kong law and the applicable PRC laws (e.g., the PRC Labour Contract Law).

Operational Implementation: Timeline and Documentation

Pre-IPO Timeline: 18–24 Months Before Filing

The recommended timeline for implementing a whistleblowing mechanism is 18 to 24 months before the expected Form A1 submission. This allows for: (a) the board to adopt the policy (Month 1–2); (b) the appointment of a third-party hotline provider (Month 2–3); (c) employee training and communication (Month 3–6); (d) a pilot period of at least 12 months during which actual reports can be received and investigated (Month 6–18); and (e) a review by the sponsor and audit committee (Month 18–24). The HKEX’s Guidance Letter GL86-16 does not specify a minimum pilot period, but the 2023 Enforcement Bulletin indicates that a period of less than 12 months is likely to be questioned.

Documentation Requirements for the Sponsor’s Due Diligence File

The sponsor’s due diligence file should contain: (a) the board resolution adopting the whistleblowing policy; (b) the policy document itself, including the channels, confidentiality provisions, and investigation procedure; (c) a record of employee training sessions, including attendance lists and training materials; (d) a log of all whistleblowing reports received during the track record period, anonymised and summarised; (e) investigation reports for each case, including findings and remedial actions; and (f) the audit committee’s annual review report on the mechanism’s effectiveness. The HKEX’s Listing Division may request any of these documents during the pre-vetting process.

Common Deficiencies and How to Avoid Them

The HKEX’s 2023 Annual Report on Listing Decisions identified the following common deficiencies in whistleblowing mechanisms among pre-IPO applicants: (a) the policy was not approved by the board (found in 12% of deficiency letters); (b) the audit committee had not reviewed the mechanism (9%); (c) employees had not been trained on the policy (15%); (d) the mechanism had been in place for less than six months before filing (22%); and (e) the policy did not cover the VIE entities (6% of VIE-structured applicants). Each of these deficiencies can be addressed by starting the implementation process early and by engaging the sponsor and legal counsel to review the policy against the HKEX’s expectations.

Actionable Takeaways

1. Implement the whistleblowing mechanism at least 18 months before the Form A1 submission, with a board-approved policy, a third-party hotline, and a documented record of employee training and actual reports received.
2. Ensure the audit committee is the designated oversight body and that it receives at least one annual report on the mechanism’s effectiveness before the filing date.
3. Disclose a statistical summary of whistleblowing reports in the prospectus, including the number of reports, their nature, and the outcome of investigations, to satisfy the HKEX’s Appendix 16 and Appendix 24 requirements.
4. For VIE-structured applicants, explicitly extend the whistleblowing policy to cover all onshore operating entities and address the legal risks of cross-border reporting under PRC law.
5. Engage the sponsor to conduct a pre-filing review of the whistleblowing mechanism and to include it in the sponsor’s due diligence file under the Code of Conduct paragraphs 17.1–17.6, to avoid the risk of a deficiency letter or rejection.