A Cross-Border Due Diligence Manual for Listing Lawyers

The 2025-2026 cycle for Chinese companies pursuing overseas listings—whether via dual-primary on the Hong Kong Stock Exchange (HKEX) Main Board or a U.S. IPO on the NYSE or Nasdaq—has introduced a fundamentally more rigorous due diligence standard than any prior period. This shift is driven not by a single rule change, but by the cumulative weight of three concurrent forces: the PRC’s expanded filing requirements under the Measures for the Administration of Overseas Securities Offering and Listing by Domestic Companies (effective 31 March 2023), the HKEX’s enhanced sponsor liability regime under Listing Rules Chapter 3A and Practice Note 21, and the U.S. Public Company Accounting Oversight Board’s (PCAOB) resumed inspection authority over audit firms in mainland China and Hong Kong. For listing lawyers—whether acting as Hong Kong sponsor counsel, PRC issuer counsel, or U.S. securities counsel—the margin for error has narrowed to zero. A single omission in verifying the VIE (Variable Interest Entity) contractual chain, the PRC outbound direct investment (ODI) route, or the 37号文 registration for individual shareholders can now trigger a refusal by the CSRC, a rejection letter from the HKEX Listing Division, or a Securities and Exchange Commission (SEC) comment letter that delays the filing by months. This article provides a technical, step-by-step due diligence manual calibrated to these 2025-2026 realities, structured around the four most failure-prone domains: corporate structure verification, PRC regulatory compliance, financial statement integrity, and cross-border data flow legality.

Corporate Structure Verification: From Cayman to WFOE

The VIE Contractual Chain: Beyond the Standard Template

The VIE structure remains the dominant listing vehicle for PRC-based companies in sectors with foreign investment restrictions, including education, internet content, and healthcare. Under the Special Administrative Measures (Negative List) for Foreign Investment Access (2024 edition), 31 sectors remain wholly or partially prohibited to foreign capital. Listing lawyers must verify that the VIE agreements—typically an exclusive option agreement, a proxy agreement, an equity pledge agreement, and a loan agreement—are legally valid under PRC contract law and do not constitute a de facto equity transfer that triggers the Foreign Investment Law (FIL) Article 28 prohibition.

The due diligence standard has been elevated by the HKEX’s December 2023 revised Listing Decision HKEX-LD150-2023, which requires the sponsor to confirm that the VIE structure is the minimum necessary to achieve the issuer’s business objectives. This means the lawyer must produce a sector-by-sector justification: for each restricted business line, document why a direct WFOE (Wholly Foreign-Owned Enterprise) cannot be used. For example, if the issuer operates both an online education platform (restricted) and a software development arm (unrestricted), the VIE agreements must cover only the former. The Cayman holding company’s constitutional documents must also be reviewed to ensure they permit the issuance of variable interest entities’ shares to the WFOE nominee.

The ODI Route: PRC Outbound Direct Investment Filing Chain

Every dollar that flows from the Cayman listing vehicle to the PRC operating companies must trace back to a legally completed ODI filing. The Regulations on Foreign Exchange Control (State Council Decree No. 532) and the Circular on Further Improving the Administration of Foreign Exchange and Cross-border Capital Flows (SAFE Hui Fa [2020] No. 3) require that any PRC entity or individual making an overseas direct investment must register with the local branch of the National Development and Reform Commission (NDRC) and the Ministry of Commerce (MOFCOM), and then obtain a foreign exchange registration certificate from SAFE.

Listing lawyers must verify the following for each PRC shareholder or entity in the chain:

• The NDRC Project Filing Certificate (for investments above USD 300 million in sensitive sectors, or USD 1 billion in non-sensitive sectors, a report is required under NDRC Order No. 11).
• The MOFCOM Certificate of Overseas Investment Enterprise.
• The SAFE Foreign Exchange Registration Form for Overseas Direct Investment (Form FDI).

A common failure point is the use of offshore SPVs (Special Purpose Vehicles) in BVI or Cayman that were established before the ODI route was formalized. In such cases, the lawyer must document a retroactive filing or a “supplementary registration” under the Notice on Issues Concerning the Administration of Foreign Exchange for Overseas Listings of Domestic Residents (SAFE Hui Fa [2014] No. 37, known as “37号文”). As of 2025, the CSRC has been rejecting filings where the 37号文 registration post-dates the SPV incorporation by more than 12 months without a reasonable explanation.

PRC Regulatory Compliance: The CSRC Filing and Sectoral Licenses

The CSRC Filing: Rule 2 and the “Prohibited” List

Under the Measures for the Administration of Overseas Securities Offering and Listing by Domestic Companies (the “Overseas Listing Measures”), any PRC domestic company seeking a direct or indirect overseas listing must file with the CSRC within three business days of submitting the listing application to the overseas exchange. The filing must include:

• A legal opinion from PRC counsel confirming that the issuer does not fall under the “prohibited listing” categories (Article 8: enterprises in sectors where foreign investment is prohibited by the Negative List, enterprises that have been subject to criminal penalties for illegal fundraising, and enterprises whose controlling shareholders or actual controllers are on the CSRC’s blacklist).
• A copy of the issuer’s business license and all material licenses.
• A description of the VIE structure, if any, with a legal analysis of its compliance with FIL.

The CSRC has, since January 2024, been issuing “supplementary notice” letters (补充通知) within 20 working days of the filing. These letters typically request additional information on the ODI chain, the use of proceeds, and the PRC data classification. Listing lawyers should budget for at least two rounds of CSRC questions, each requiring a response within 15 working days. Failure to respond within the deadline results in the filing being deemed withdrawn.

Sectoral Licenses: The Telecom and ICP Trap

For internet-based issuers, the most frequently challenged license is the Value-Added Telecommunications Business License (ICP license) issued by the provincial MIIT. Under the Telecommunications Regulations of the PRC (State Council Decree No. 291), any company providing internet information services must hold an ICP license. The critical due diligence point: the ICP license must be held by the PRC operating company that is the VIE variable interest entity, not by the WFOE. If the WFOE holds the license, the structure violates the foreign investment restriction on telecom services (Negative List, Category II: telecommunications services with value-added services are restricted to foreign ownership of no more than 50%).

Listing lawyers must also verify the Internet Content Provider (ICP) Filing number (ICP备号) for the issuer’s website and any mobile applications. The CSRC has, in its 2024 review of 18 overseas listing filings, requested ICP filings for all operational websites in 12 cases. The Cybersecurity Law of the PRC (Article 21) further requires that the issuer’s network infrastructure pass a Multi-Level Protection Scheme (MLPS or 等保) assessment, with Level 2 or Level 3 certification depending on the data sensitivity. As of 2025, the HKEX Listing Division has begun requiring a copy of the MLPS filing certificate in the listing application documents for all technology issuers.

Financial Statement Integrity: Audit Trail and Revenue Verification

The PCAOB Inspection and Audit Firm Selection

The PCAOB’s December 2022 announcement that it had secured full access to inspect audit firms in mainland China and Hong Kong ended the Holding Foreign Companies Accountable Act (HFCAA) delisting risk for most Chinese issuers. However, the 2024 and 2025 inspection cycles have revealed persistent deficiencies. In its 2024 inspection report for a Big Four firm’s PRC practice, the PCAOB identified deficiencies in 12 of 20 audits reviewed, including failures to test revenue recognition for contracts with multiple performance obligations and inadequate testing of related-party transactions.

For listing lawyers, the audit firm selection now carries a regulatory consequence. The CSRC’s Supplementary Notice on the Filing of Overseas Listing Audit Firms (2023) requires that the audit firm be registered with the CSRC and have a “no adverse record” certification from the local securities regulatory bureau. The lawyer must verify the audit firm’s registration status on the CSRC’s public database and obtain a representation letter from the audit firm confirming that it has not been subject to any administrative penalty in the preceding 36 months.

Revenue Verification: The “Bank Statement” Standard

The HKEX’s Guidance Letter GL94-18 (updated 2023) requires the sponsor to perform independent verification of the issuer’s top 10 customers and the top 10 suppliers, with a focus on revenue cut-off testing and the existence of side agreements. For listing lawyers, the standard is higher: under Listing Rule 3A.09, the sponsor must exercise “reasonable skill and care” in verifying the information in the prospectus. This has been interpreted by the SFC in its Statement on Sponsor Failures in IPO Cases (2019) to require that the lawyer independently confirm the issuer’s revenue recognition policy against the PRC Accounting Standards for Business Enterprises (ASBE) No. 14 (Revenue).

The most common failure is the “channel stuffing” scenario, where the issuer books revenue on goods delivered to a distributor but not yet sold to the end customer. The lawyer should request the distributor’s inventory reports and, where possible, the end-customer sales data. The SFC has, in enforcement actions against three sponsors between 2020 and 2024, cited the failure to detect channel stuffing as a primary deficiency. The remedy is a “sell-through” verification procedure: for the top 3 distributors, the lawyer should request a sample of end-customer invoices and cross-reference them with the distributor’s purchase orders.

Cross-Border Data Flow and Cybersecurity Compliance

The Data Security Law and the “Data Exit” Assessment

The Data Security Law of the PRC (DSL, effective 1 September 2021) and the Personal Information Protection Law (PIPL, effective 1 November 2021) impose two distinct obligations on issuers with PRC operations. First, the issuer must classify its data under the DSL’s three-tier system: general, important, and core. If the issuer processes “important data” (defined in Article 21 and further specified by sectoral regulators), it must conduct a Data Exit Security Assessment (数据出境安全评估) with the Cyberspace Administration of China (CAC) before transferring the data outside the PRC. As of 2025, the CAC has published the list of important data catalogues for 12 sectors, including finance, healthcare, and transportation.

Second, under PIPL Article 38, if the issuer transfers personal information outside the PRC, it must either:

• Pass the CAC’s data exit security assessment (for data processors that process the personal information of more than 1 million individuals or have transferred the personal information of more than 100,000 individuals in the preceding year).
• Obtain a Personal Information Protection Certification from a CAC-accredited body.
• Sign a Standard Contract for Cross-border Transfer of Personal Information with the overseas recipient (under the CAC’s Measures for the Standard Contract for Cross-border Transfer of Personal Information, effective 1 June 2023).

Listing lawyers must verify that the issuer has a documented data classification policy and that any data transfer to the Cayman parent or the U.S. underwriters is covered by one of these three mechanisms. The HKEX’s Guidance on Cybersecurity and Data Protection (January 2024) explicitly requires the listing applicant to disclose its data exit compliance status in the prospectus. Failure to do so has led to the HKEX issuing a “stop the clock” letter in at least four cases in 2024.

The Cybersecurity Review: The “Critical Information Infrastructure” Threshold

Under the Cybersecurity Review Measures (effective 15 February 2022), any issuer that operates a “critical information infrastructure” (CII) in the PRC must undergo a cybersecurity review before listing overseas. The definition of CII is broad: it includes any network or system that, if disrupted, would cause “serious harm to national security, the national economy, or the public interest” (Article 2). The CAC has, in practice, applied this to internet platforms with more than 1 million daily active users and to financial technology companies.

The due diligence procedure requires the lawyer to obtain the issuer’s CII designation status from the relevant sectoral regulator (e.g., the MIIT for telecoms, the PBOC for financial services). If the issuer has not been formally designated as a CII operator, the lawyer should still assess whether the issuer’s business falls within the CAC’s published criteria. The 2024 amendment to the Cybersecurity Review Measures expanded the review scope to include “online platform operators that have collected the personal information of more than 1 million users and are seeking overseas listing.” This is a strict liability threshold: if the issuer meets the user count, the review is mandatory, regardless of whether the data is sensitive.

Actionable Takeaways for Listing Lawyers

1. Begin the CSRC filing preparation at least 12 weeks before the intended HKEX A1 submission — the 20-working-day review clock starts only after the filing is complete, and the CSRC’s supplementary notice letters typically require two rounds of responses.
2. Verify the ODI chain for every PRC shareholder holding more than 5% of the Cayman issuer — a missing 37号文 registration for a single individual shareholder can block the entire listing under the Overseas Listing Measures Article 10.
3. Request the ICP license and MLPS certificate from the VIE variable interest entity, not the WFOE — the HKEX Listing Division has rejected two applications in 2024 where the ICP license was held by the WFOE, citing a violation of the Negative List.
4. Conduct a “sell-through” revenue verification for the top 3 distributors — the SFC’s enforcement track record since 2020 shows that channel stuffing is the most common revenue recognition failure in PRC listings.
5. Document the data classification policy and the data exit mechanism (CAC assessment, certification, or standard contract) before the prospectus draft is circulated — the HKEX’s January 2024 guidance makes this a mandatory disclosure item, and the CAC’s review can take 45 to 90 working days.