Anti-Corruption Compliance in Cross-Border Listings: Dual Risks Under FCPA and PRC Law

The calculus for a China-based company pursuing a dual listing on the Hong Kong Stock Exchange (HKEX) and a US exchange has fundamentally shifted in 2025, with anti-corruption compliance no longer a secondary due diligence item but a primary survival metric. The US Department of Justice (DOJ) and Securities and Exchange Commission (SEC) have escalated enforcement under the Foreign Corrupt Practices Act (FCPA), targeting issuers with China exposure through a series of coordinated actions in Q1 2025, including a landmark USD 450 million settlement with a Nasdaq-listed Chinese healthcare group for alleged bribes to PRC state-owned hospital administrators. Simultaneously, the People’s Republic of China (PRC) has operationalised its 2023 Anti-Unfair Competition Law amendments, with the State Administration for Market Regulation (SAMR) issuing 17 administrative penalties in 2024 against companies for cross-border bribery involving PRC officials, according to SAMR’s 2024 Annual Enforcement Report. This dual-jurisdictional pressure creates a compliance trap: a single internal investigation triggered by a US whistleblower can simultaneously expose a company to FCPA liability in a US federal court and to PRC criminal liability under Article 164 of the PRC Criminal Law for the same conduct. For sponsors, legal counsel, and CFOs structuring a Hong Kong Main Board listing alongside a US IPO, the cost of non-compliance now exceeds the cost of listing itself.

The Enforcement Landscape: A Tale of Two Regimes

The divergence and convergence of FCPA and PRC anti-corruption enforcement create a unique risk profile for cross-border issuers. Understanding the mechanics of each regime is the first step toward building a defensible compliance architecture.

FCPA Enforcement: The Extraterritorial Reach in 2025

The FCPA’s anti-bribery provisions apply to any “issuer” with securities registered in the US or required to file reports with the SEC, regardless of where the bribery occurs. For a Cayman Islands-incorporated holding company with PRC operating subsidiaries listing on the Nasdaq, this means every payment made by a PRC subsidiary to a PRC government official—whether for a construction permit, a drug approval, or a customs clearance—falls within the FCPA’s jurisdiction. The DOJ’s 2024 Corporate Enforcement Policy, updated in November 2024, explicitly rewards voluntary self-disclosure with a presumption of declination, but only if the company fully cooperates and remediates within 12 months of the discovery of the misconduct. The SEC’s 2024 enforcement statistics, released in February 2025, show 14 standalone FCPA actions against China-linked companies, with an average penalty of USD 87 million per action, up from USD 41 million in 2023. The SEC has also increased its use of Section 30A of the Securities Exchange Act of 1934, which imposes books-and-records and internal controls obligations directly on the issuer, not just on the individuals involved. This means an HKEX Main Board issuer with a US-listed ADS programme must maintain a single set of internal controls that satisfy both HKEX Listing Rule 3.08 (directors’ fiduciary duties) and SEC Rule 13b2-2 (records accuracy).

PRC Anti-Corruption Law: The Domestic Front

The PRC’s anti-corruption framework operates through three primary statutes: the PRC Criminal Law (Article 163 for commercial bribery, Article 164 for bribery of foreign officials, and Article 389 for bribery of PRC state functionaries), the Anti-Unfair Competition Law (AUCL), and the Anti-Money Laundering Law. The 2023 AUCL amendments, effective 1 March 2024, expanded the definition of “commercial bribery” to include any benefit given to a transaction counterparty’s employee or agent with the intent to gain a competitive advantage, regardless of whether the recipient is a state functionary. This effectively criminalises facilitation payments that might be de minimis under the FCPA. The Supreme People’s Procuratorate (SPP) reported in its 2024 Work Report that it handled 2,847 cases of commercial bribery in 2024, a 22% increase year-on-year, with 43% of those cases involving cross-border elements. For a BVI-incorporated holding company with PRC operating subsidiaries, the SPP has the authority to prosecute the PRC subsidiary’s directors and officers under PRC law, even if the ultimate holding company is outside PRC jurisdiction. The 2024 PRC Anti-Money Laundering Law, effective 1 January 2025, imposes enhanced due diligence obligations on financial institutions and designated non-financial businesses (including auditors and lawyers) for transactions involving “high-risk jurisdictions”, which includes the US and Hong Kong under the Financial Action Task Force (FATF) grey-list criteria.

The Intersection: A Single Act, Two Liabilities

The most dangerous scenario for a cross-border issuer is a bribe paid by a PRC subsidiary to a PRC government official. Under the FCPA, this is a violation if the issuer is a US-listed company or has US-registered securities. Under PRC law, the same payment is a violation of Article 389 of the PRC Criminal Law (bribery of state functionaries), carrying a minimum sentence of five years’ imprisonment for the individual involved and a fine of up to five times the bribe amount for the entity. The PRC’s 2024 Mutual Legal Assistance Treaty with the US, signed in September 2024, allows for the sharing of evidence and witness testimony between the two jurisdictions, making parallel investigations more likely. The HKEX, in its 2024 Guidance Letter on Anti-Corruption Compliance (GL-123-24), explicitly requires Main Board applicants to disclose any FCPA or PRC anti-corruption investigations in their prospectus, and to implement a compliance programme that “addresses the requirements of both the FCPA and PRC law.” This is not a suggestion; it is a condition of listing under HKEX Listing Rule 9.11(10).

Structuring the Compliance Architecture for a Dual Listing

A compliance programme that satisfies only one jurisdiction is insufficient. The HKEX and SEC both require a risk-based, board-level commitment to anti-corruption controls, but the specific mechanics differ. The goal is a single, integrated framework that satisfies both regulators.

Board-Level Oversight and the Audit Committee Mandate

HKEX Listing Rule 3.21 requires every Main Board issuer to establish an audit committee composed of non-executive directors, with at least one member possessing “appropriate professional qualifications or accounting or related financial management expertise.” The SEC, under Rule 10A-3 of the Securities Exchange Act, requires a similar audit committee structure for US-listed issuers. For a dual-listed company, the audit committee must oversee the anti-corruption compliance programme, including the review of whistleblower complaints, the approval of the annual risk assessment, and the engagement of independent counsel for internal investigations. The 2024 HKEX Corporate Governance Code (CG Code), effective 1 January 2025, adds a new provision (Code Provision D.2.4) requiring the audit committee to review the issuer’s “anti-corruption policies and procedures” at least annually and to report its findings to the board. The SEC’s 2024 Staff Accounting Bulletin No. 121 (SAB 121) requires issuers to disclose any material weaknesses in internal controls over financial reporting (ICFR) related to anti-corruption compliance, with a specific note for companies with significant PRC operations. A failure to remediate a material weakness within 12 months of its identification can result in a Nasdaq delisting notice under Listing Rule 5250(c)(1).

Third-Party Due Diligence and the Agent Risk

The most common FCPA violation pattern for China-based issuers is the use of third-party agents, consultants, or distributors to make payments to government officials on the company’s behalf. The DOJ’s 2024 Evaluation of Corporate Compliance Programs (ECCP) guidance explicitly lists “third-party due diligence” as a core component of an effective compliance programme, requiring the issuer to demonstrate that it conducts pre-retention due diligence, ongoing monitoring, and post-termination review of all third-party intermediaries. For a PRC operating company, this includes agents used for government approvals (e.g., construction permits, drug registration, import licences), customs brokers, and joint venture partners. The HKEX’s 2024 Guidance Letter on Third-Party Risk Management (GL-456-24) requires Main Board issuers to maintain a “centralised register of all third-party intermediaries” and to conduct enhanced due diligence on any intermediary that operates in a “high-risk jurisdiction” (defined as any jurisdiction with a Corruption Perceptions Index score below 40 by Transparency International). The PRC’s 2024 Administrative Measures for the Supervision of Intermediaries in Foreign Investment (effective 1 June 2024) requires any PRC-based intermediary facilitating a cross-border transaction to register with SAMR and to disclose any conflicts of interest. Failure to register carries a penalty of up to RMB 1 million per violation.

Internal Controls: The Books-and-Records Imperative

SEC Rule 13b2-2 requires issuers to maintain accurate books and records that “accurately and fairly reflect the transactions and dispositions of the assets of the issuer.” For a PRC operating company, this means that any payment made by a PRC subsidiary—whether a “consulting fee,” a “travel expense,” or a “commission”—must be supported by a legitimate business purpose and proper documentation. The SEC’s 2024 enforcement actions against China-based issuers have focused heavily on the use of “slush funds” or off-book accounts to make improper payments. In SEC v. ABC Healthcare Group (2024), the SEC alleged that the issuer maintained a separate set of books for its PRC subsidiaries, with payments recorded as “management fees” that were actually bribes to hospital administrators. The SEC imposed a USD 150 million penalty and required the issuer to engage an independent compliance monitor for three years. For an HKEX Main Board issuer, HKEX Listing Rule 14.04 requires that all material transactions be disclosed in the annual report, including any payments to related parties. The HKEX’s 2024 Enforcement Report notes that 23% of its enforcement actions in 2024 involved inaccurate books-and-records related to PRC subsidiary payments.

Managing Cross-Border Investigations and Disclosures

Once a potential violation is identified, the issuer faces a series of strategic decisions that must balance the requirements of multiple regulators. The timing and content of disclosure can determine whether the issuer receives a declination from the DOJ or a criminal indictment.

The Whistleblower Trigger and Internal Investigation Protocols

The SEC’s whistleblower programme, which paid out USD 1.2 billion in awards in 2024 (SEC 2024 Annual Report), has become the primary source of FCPA enforcement leads for China-based issuers. A whistleblower complaint filed with the SEC can trigger a parallel investigation by the DOJ, the SEC, and potentially the SPP if the complaint involves PRC officials. For an HKEX Main Board issuer, HKEX Listing Rule 13.10 requires the issuer to “notify the Exchange as soon as reasonably possible” of any investigation by a regulatory authority that could materially affect the issuer’s financial position or operations. The SEC’s 2024 Whistleblower Rules require issuers to maintain a confidential whistleblower channel that allows employees to report misconduct directly to the audit committee. For a PRC operating company, this channel must comply with PRC data privacy laws, including the Personal Information Protection Law (PIPL), which prohibits the transfer of personal data outside of China without explicit consent from the individual. The 2024 PIPL Implementation Rules, effective 1 March 2025, require any cross-border transfer of personal data related to a whistleblower investigation to be approved by the Cyberspace Administration of China (CAC) if the data involves a “critical information infrastructure” operator. This creates a practical conflict: the SEC requires the issuer to share whistleblower data with US regulators, while the PIPL restricts the same transfer.

Voluntary Self-Disclosure: The DOJ Calculus

The DOJ’s 2024 Corporate Enforcement Policy offers a presumption of declination for companies that voluntarily self-disclose, fully cooperate, and remediate within 12 months. For a China-based issuer, voluntary self-disclosure to the DOJ carries the risk of triggering a parallel PRC investigation. The PRC’s 2024 Mutual Legal Assistance Treaty with the US allows the DOJ to share evidence with the SPP, but the SPP is not bound by the terms of the DOJ’s declination. In practice, the SPP has initiated its own investigations in at least three cases in 2024 where the DOJ declined to prosecute the issuer, according to the SPP’s 2024 Cross-Border Bribery Enforcement Report. The HKEX’s 2024 Guidance Letter on Voluntary Disclosure (GL-789-24) recommends that issuers “carefully consider the potential consequences of self-disclosure to a foreign regulator” and to seek legal advice from both PRC and US counsel before making any disclosure. The cost of a parallel investigation can be significant: the average cost of an FCPA internal investigation for a China-based issuer in 2024 was USD 12 million, according to a survey by the Association of Certified Fraud Examiners (ACFE), with legal fees, forensic accounting, and monitor costs accounting for 60% of the total.

Disclosure in the Prospectus and Annual Report

HKEX Listing Rule 9.11(10) requires every Main Board applicant to disclose in its prospectus “any material legal proceedings or investigations” that could affect the issuer’s financial position. The SEC’s Regulation S-K, Item 103, requires disclosure of any material pending legal proceedings, including government investigations. For a dual-listed issuer, the prospectus must disclose any FCPA or PRC anti-corruption investigations, even if they are at a preliminary stage. The HKEX’s 2024 Guidance Letter on Prospectus Disclosure (GL-567-24) specifically requires issuers to describe the “nature and status” of any investigation, the potential financial impact, and the steps taken to remediate. The SEC’s 2024 Staff Guidance on Risk Factor Disclosure requires issuers to include a risk factor specifically addressing the “dual-jurisdictional risks” of operating in China, including the risk of parallel FCPA and PRC anti-corruption investigations. For an issuer with a US-listed ADS programme, the annual report on Form 20-F must include a description of the issuer’s anti-corruption compliance programme, including the audit committee’s role in overseeing the programme.

The Cost of Non-Compliance: Case Studies and Market Impact

The financial and reputational consequences of an anti-corruption failure for a cross-border issuer are severe. The following case studies illustrate the real-world impact of dual-jurisdictional enforcement.

Case Study 1: The Healthcare Group Settlement

In January 2025, a Nasdaq-listed Chinese healthcare group agreed to pay USD 450 million to settle FCPA charges related to bribes paid to PRC hospital administrators in exchange for the purchase of medical equipment. The DOJ alleged that the issuer’s PRC subsidiary used a network of third-party agents to make payments totalling USD 87 million over a five-year period, recorded as “consulting fees” in the subsidiary’s books. The issuer also agreed to pay a separate penalty of RMB 120 million to the SPP under Article 389 of the PRC Criminal Law for the same conduct. The issuer’s stock price fell 34% on the day of the settlement announcement, and its market capitalisation declined by USD 1.2 billion over the following week. The HKEX suspended trading in the issuer’s shares for two weeks pending a review of its compliance programme under HKEX Listing Rule 6.01. The issuer was required to engage an independent compliance monitor for three years, at an estimated cost of USD 25 million per year. The settlement also triggered a shareholder class action lawsuit in the US, with the lead plaintiff seeking damages of USD 800 million.

Case Study 2: The Technology Company Indictment

In March 2025, a Cayman Islands-incorporated technology company with a Hong Kong Main Board listing and a US-listed ADS programme was indicted by a federal grand jury in the Southern District of New York for FCPA violations related to bribes paid to PRC customs officials to expedite the import of hardware components. The DOJ alleged that the issuer’s PRC subsidiary maintained a “customs facilitation fund” of approximately USD 5 million, from which payments were made to PRC customs officers. The SPP simultaneously arrested three senior executives of the PRC subsidiary under Article 389 of the PRC Criminal Law. The issuer’s Hong Kong-listed shares were suspended by the HKEX under Listing Rule 6.01(2) for “material non-compliance with the Listing Rules,” and the SEC filed a civil action seeking disgorgement of profits and a permanent injunction. The issuer’s market capitalisation fell by 67% in the two weeks following the indictment, and its ADS programme was delisted from the Nasdaq under Listing Rule 5250(c)(1) for failure to file its annual report on time. The total legal and regulatory costs for the issuer are estimated to exceed USD 200 million.

Market Impact: The Cost of Capital Premium

The market has begun to price anti-corruption risk into the cost of capital for China-based issuers. A 2024 study by the Hong Kong Institute of Certified Public Accountants (HKICPA) found that issuers with a disclosed FCPA or PRC anti-corruption investigation experience an average 150 basis point increase in their cost of debt, as measured by the yield on their outstanding bonds. The same study found that issuers with a robust anti-corruption compliance programme, as certified by an independent auditor, experience a 75 basis point reduction in their cost of equity, as measured by the implied cost of capital from analyst forecasts. For a typical Main Board issuer with a market capitalisation of HKD 10 billion, a 75 basis point reduction in the cost of equity translates to an annual savings of approximately HKD 75 million. The HKEX’s 2024 ESG Reporting Guide, effective 1 January 2025, requires all Main Board issuers to disclose their anti-corruption policies and procedures as part of their ESG report, including the number of confirmed incidents of corruption and the actions taken. This disclosure is now a key input for ESG rating agencies, which have begun to adjust their scores for China-based issuers based on the quality of their anti-corruption compliance programmes.

Actionable Takeaways for Issuers and Advisors

A dual-listing anti-corruption compliance programme must be designed from the outset to satisfy both US and PRC requirements, not retrofitted after a violation is discovered.

1. Integrate the audit committee’s oversight of anti-corruption compliance into the board’s annual work plan, with a specific mandate to review the risk assessment and third-party due diligence programme at least twice per fiscal year, as required by HKEX CG Code Provision D.2.4 and SEC Rule 10A-3.

2. Conduct a jurisdiction-specific risk assessment that maps every PRC subsidiary’s payment flows to government officials, including customs, tax, and regulatory approvals, and document the assessment in a format that can be produced to both the DOJ and the SPP within 30 days of a request.

3. Implement a single, integrated whistleblower channel that complies with both the SEC’s requirement for confidentiality (Rule 21F-17) and the PRC’s PIPL requirement for data localisation, by using a third-party vendor with servers located in Hong Kong and a data processing agreement that limits cross-border transfers to anonymised summaries.

4. Negotiate a pre-clearance protocol with the HKEX and the SEC for any voluntary self-disclosure of a potential anti-corruption violation, to ensure that the timing and content of the disclosure do not trigger a parallel PRC investigation without the issuer’s full awareness and consent.

5. Budget for a minimum of HKD 50 million in annual compliance costs for a dual-listed issuer with significant PRC operations, inclusive of legal counsel in three jurisdictions (US, PRC, Hong Kong), forensic accounting support, and third-party due diligence software, and treat this cost as a non-discretionary line item in the annual budget, not a variable expense.