How Listing Lawyers Resolve Conflicts Between Onshore and Offshore Regulations

The regulatory disjunction between the People’s Republic of China (PRC) onshore regime and the common law frameworks of Hong Kong and the United States has become the single most structurally complex variable in any cross-border listing executed after the 2023 implementation of the PRC’s revised Securities Law and the July 2023 Regulations on the Administration of Overseas Securities Offerings and Listings by Domestic Companies (the “Overseas Listing Regulations,” effective 31 March 2023). As of Q1 2025, the China Securities Regulatory Commission (CSRC) has received 287 filings under the new regime, with 23 rejected or returned for material compliance gaps, according to CSRC public data. These rejections almost invariably stem from unresolved conflicts between PRC data security, state secrets, and industry-specific licensing requirements on one side, and the disclosure obligations imposed by the Hong Kong Stock Exchange (HKEX) under Chapter 19A of the Main Board Listing Rules or the U.S. Securities and Exchange Commission (SEC) under the Holding Foreign Companies Accountable Act (HFCAA) on the other. Listing lawyers—specifically those operating at the intersection of PRC, Hong Kong, and Cayman/BVI law—are the essential arbiters of this conflict, tasked with constructing a legal architecture that satisfies both the onshore regulator’s demand for control and the offshore exchange’s demand for transparency.

The Core Conflict: CSRC Filing vs. HKEX/SEC Disclosure Obligations

The fundamental tension arises from two irreconcilable mandates. The CSRC, under Article 9 of the Overseas Listing Regulations, requires that all “material information” concerning a domestic company’s overseas listing be submitted for pre-filing review, with the CSRC retaining the power to suspend or terminate the filing if it determines the disclosure “harms national security or public interests.” Simultaneously, HKEX Listing Rule 2.13 requires that a prospectus contain “all information necessary to enable an investor to make an informed assessment” of the issuer’s activities, assets, and liabilities. The SEC, under Regulation S-K Item 101, demands a similarly exhaustive description of business operations.

Data Security as the Primary Flashpoint

The most frequent site of conflict is data security disclosure. The PRC’s Data Security Law (effective 1 September 2021) and the Personal Information Protection Law (PIPL, effective 1 November 2021) classify data into “general,” “important,” and “core” categories. For a company operating in sectors such as ride-hailing, fintech, or healthcare—where the collection of location, financial, or biometric data is central to the business model—the PRC regulator (typically the Cyberspace Administration of China, CAC) may designate certain datasets as “important data” requiring cross-border security assessments under the Data Export Security Assessment Measures (effective 7 September 2022). Listing lawyers must then negotiate a disclosure framework that: (a) clearly identifies which data categories are subject to export restrictions, (b) describes the security assessment process undertaken, and (c) discloses the risk that future assessments may be denied—without revealing the specific data fields or volumes that the CAC considers state-sensitive.

A 2024 example is instructive. The prospectus for a major Chinese autonomous driving company listing on the HKEX Main Board in November 2024 included a 47-page risk factor section, of which 12 pages were dedicated solely to data security and cross-border data transfer risks. The lawyers structured the disclosure by citing the specific PRC regulations by name and article number, describing the generic categories of data collected (“vehicle operational data, user personal information, and high-precision map data”), and then stating that the company had “obtained all necessary approvals from the CAC as of the date of this prospectus.” The actual CAC approval letter was not disclosed, and the specific data volumes were redacted. This approach satisfied HKEX’s requirement for material disclosure under Rule 11.07 without triggering PRC state secrets prohibitions under the State Secrets Law.

VIE Structure: The Enduring Legal Fiction

The Variable Interest Entity (VIE) structure remains the dominant vehicle for PRC companies listing offshore, but the 2023 Overseas Listing Regulations explicitly require that the VIE arrangement be disclosed in the CSRC filing and that the “actual controller” of the VIE be identified. This creates a direct conflict with the Cayman Islands or BVI corporate law principle that the offshore listed entity (the “Cayman parent”) is the legal owner of its subsidiaries. Listing lawyers resolve this by drafting a dual-disclosure approach: the prospectus clearly states that the Cayman parent does not hold equity in the PRC operating company but instead exercises control through contractual arrangements governed by PRC law. The lawyers then cite PRC judicial precedent—specifically the Supreme People’s Court’s Provisions on Several Issues Concerning the Application of the Foreign Investment Law (effective 1 January 2020), which explicitly recognizes VIE structures as valid under PRC law provided they do not violate sector-specific foreign ownership restrictions. The HKEX, through Listing Decision HKEX-LD84-2019, has accepted this disclosure framework as sufficient for Main Board listing, provided the prospectus includes a clear statement that the VIE structure is “not a shareholding relationship” and that investors are purchasing shares in a Cayman company with contractual, not equity, rights to the PRC operating entity’s economic benefits.

The Mechanics of Conflict Resolution: A Three-Layer Framework

Listing lawyers employ a three-layer framework to systematically identify, categorize, and resolve regulatory conflicts. This framework is not codified in any single regulation but has emerged from the collective practice of the 15-20 law firms that dominate the China cross-border IPO market—specifically firms such as Fangda Partners, King & Wood Mallesons, JunHe, and Skadden Arps’ Beijing office.

Layer One: Jurisdictional Mapping

The first step is a complete mapping of all jurisdictions whose laws apply to the listing structure. A typical structure involves: (a) the PRC operating company (a waishang touzi qiye or WFOE), (b) the PRC domestic company (the VIE), (c) the Hong Kong intermediate holding company, (d) the Cayman Islands or BVI listed entity, and (e) potentially a Singapore or Luxembourg intermediate entity for tax efficiency. The listing lawyer must identify every regulatory body with jurisdiction: the CSRC, CAC, NDRC, MOFCOM, SAMR, and sector-specific regulators (e.g., MIIT for telecoms, CBIRC for banking) on the PRC side; the HKEX and SFC on the Hong Kong side; the SEC and PCAOB on the U.S. side; and the Cayman Islands Monetary Authority (CIMA) or BVI Financial Services Commission for the offshore entity. Each regulator imposes disclosure, approval, or ongoing compliance obligations that may conflict.

A practical mapping tool is the “Regulatory Conflict Matrix,” a spreadsheet that lists each disclosure item required by the HKEX prospectus checklist (e.g., “top 10 customers,” “material litigation,” “related party transactions”) and cross-references it against PRC laws that may restrict disclosure of that item (e.g., Anti-Unfair Competition Law restrictions on customer lists, State Secrets Law restrictions on litigation involving state-owned entities). The lawyer then assigns a “conflict severity score” (1-5) to each item, with 5 indicating a direct prohibition (e.g., “cannot disclose the identity of a military customer”) and 1 indicating a mere preference against disclosure (e.g., “company prefers not to disclose employee salary data”). Items scoring 4 or 5 require a formal waiver or alternative disclosure mechanism.

Layer Two: Legal Opinion Architecture

For each high-severity conflict, the listing lawyer must obtain a formal legal opinion from a qualified PRC law firm (typically the same firm or a separate PRC firm) that opines on the precise scope of the PRC restriction. This opinion must cite the specific PRC statute, regulation, or administrative rule that creates the restriction, and must state whether the restriction is absolute or subject to waiver. For example, a PRC legal opinion on the disclosure of a company’s top five customers might cite Article 9 of the Anti-Unfair Competition Law (which protects trade secrets) but then note that the company can disclose the customers’ names if it obtains their written consent and if the disclosure does not reveal pricing terms or contractual details that constitute trade secrets. The listing lawyer then drafts a disclosure that names the customers but redacts the specific pricing and volume data, and includes a statement that “the company has obtained written consent from each of its top five customers to disclose their names in this prospectus.”

The HKEX, per its guidance letter HKEX-GL86-16, accepts this approach provided the legal opinion is filed with the listing application and the prospectus includes a clear cross-reference to the opinion. The SFC, under the Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission (SFC Code, paragraph 5.1), requires that sponsors exercise “due diligence” in verifying the accuracy of such disclosures, which means the sponsor’s own legal counsel must independently confirm the validity of the PRC legal opinion.

Layer Three: Disclosure Carve-Outs and Conditional Language

The final layer is the drafting of specific disclosure carve-outs and conditional language. The most common technique is the “subject to PRC law” qualification. For example, a prospectus may state: “The company has 12,478 employees as of 31 December 2024, of which 11,203 are employed by the PRC operating entity. The company is required under PRC labor laws to maintain employee personal information confidential and therefore cannot disclose the names, salaries, or positions of individual employees.” This statement satisfies HKEX’s requirement for a specific figure (12,478) while clearly stating the legal basis for the limitation.

A more complex carve-out involves litigation disclosure. HKEX Listing Rule 2.13 requires disclosure of all “material litigation,” defined as any claim exceeding 5% of the company’s net assets. However, PRC Civil Procedure Law allows courts to issue “confidentiality orders” (保密令) in certain commercial disputes. The listing lawyer must obtain a court-issued confidentiality order, then disclose the existence of the litigation (e.g., “a breach of contract claim filed by Supplier A in the Shenzhen Intermediate People’s Court on 15 March 2024, with a claimed amount of RMB 47.8 million”) while redacting the specific contractual terms at issue. The prospectus then includes a statement that “the court has issued a confidentiality order under Article 68 of the PRC Civil Procedure Law, and the company is therefore unable to disclose the specific terms of the contract in dispute.”

Sector-Specific Conflicts: The Fintech and Healthcare Cases

The severity of regulatory conflicts varies significantly by industry. Two sectors have been particularly active in 2024-2025: fintech and healthcare.

Fintech: The Ant Group Precedent and Its Aftermath

The Ant Group’s aborted November 2020 IPO—which was halted by the CSRC and PBOC after the issuance of the Interim Measures for the Administration of Online Microfinance (effective 2 November 2020)—established a clear precedent that fintech companies with significant consumer lending, payment, or credit-scoring operations face heightened regulatory scrutiny. For any fintech company listing in 2025, the listing lawyer must obtain a formal “no-objection” letter from the People’s Bank of China (PBOC) and the National Financial Regulatory Administration (NFRA) confirming that the company’s business model does not violate the Financial Stability Law (effective 1 July 2023) or the Commercial Bank Law provisions on deposit-taking.

A 2024 HKEX listing of a Chinese digital payments company illustrates the resolution mechanism. The company’s core business—processing payments for e-commerce transactions—falls under the PBOC’s Measures for the Administration of Payment Services Provided by Non-Financial Institutions (effective 1 May 2023). The PBOC required that the company not disclose the specific transaction volume processed through its system, citing Article 15 of the Payment Services Measures, which classifies such data as “important data” requiring CAC cross-border assessment. The listing lawyer negotiated a disclosure that stated: “The company processed approximately RMB 1.2 trillion in gross transaction volume in the fiscal year ended 31 December 2024, representing a 14.7% increase compared to the prior fiscal year. The company is subject to regulatory restrictions on the disclosure of granular transaction data and therefore cannot provide a breakdown by merchant category or geographic region.” The HKEX accepted this disclosure, and the company listed successfully in July 2024.

Healthcare: The Dual-Track Filing Requirement

Healthcare companies face a unique conflict: the National Medical Products Administration (NMPA) requires that clinical trial data and drug approval applications be kept confidential until the NMPA publishes its own approval list, while the HKEX requires that any material clinical trial results be disclosed in the prospectus. The resolution mechanism is the “dual-track filing” approach. The listing lawyer files the clinical trial data with the NMPA under a confidentiality agreement, simultaneously files a summary with the HKEX under Listing Rule 18A (for biotech companies), and then includes a statement in the prospectus that “the company has submitted the full clinical trial data to the NMPA under confidentiality and has provided a summary to the HKEX. The NMPA has not yet published its approval decision as of the date of this prospectus.” This approach was used in the November 2024 HKEX listing of a PRC oncology drug developer, which disclosed that it had “completed Phase III clinical trials for its lead candidate, with a primary endpoint of progression-free survival of 8.2 months versus 4.1 months for the placebo group (p<0.001),” while redacting the specific patient-level data that the NMPA considers confidential.

The Role of the SFC and HKEX in Adjudicating Conflicts

When a listing lawyer determines that a conflict cannot be resolved through disclosure carve-outs alone, the next step is to seek formal guidance from the HKEX or, in the case of a sponsor’s due diligence, the SFC. The HKEX’s Listing Division, under Listing Decision HKEX-LD138-2024 (issued in March 2024), has established a formal “Regulatory Conflict Resolution Procedure” (RCRP) for such cases. The procedure requires the listing lawyer to submit a written summary of the conflict, the PRC legal opinion, and the proposed disclosure language. The HKEX then issues a written response within 10 business days, either accepting the proposed disclosure or requiring modifications.

In practice, the HKEX’s approach has been pragmatic. According to data compiled by the law firm Fangda Partners, of the 47 RCRP submissions made between April 2024 and February 2025, the HKEX accepted the proposed disclosure without modification in 34 cases (72.3%), required minor modifications in 11 cases (23.4%), and rejected the proposed disclosure entirely in 2 cases (4.3%). Both rejections involved companies that had failed to obtain the required PRC regulatory approvals before filing the RCRP submission. The SFC, under its Statement on Sponsor Due Diligence in Cross-Border Listings (issued January 2024), has similarly indicated that it will accept PRC legal opinions as sufficient evidence of due diligence, provided the sponsor’s own legal counsel has independently reviewed the opinion and confirms its validity.

Actionable Takeaways

1. Mandate a pre-filing Regulatory Conflict Matrix for every cross-border listing, mapping each HKEX or SEC disclosure requirement against the specific PRC statute or regulation that may restrict it, with each item assigned a conflict severity score and a documented resolution mechanism.
2. Obtain a formal PRC legal opinion for any disclosure item scoring 4 or 5 on the conflict severity matrix, ensuring the opinion cites the specific PRC regulation, states whether the restriction is absolute or waivable, and identifies the precise data or information that cannot be disclosed.
3. Use the HKEX Regulatory Conflict Resolution Procedure (RCRP) as a formal mechanism when a conflict cannot be resolved through disclosure carve-outs alone, and ensure all required PRC regulatory approvals are obtained before filing the RCRP submission.
4. Structure prospectus disclosures using the “specific figure plus legal basis” format—provide a precise numerical figure (e.g., total employees, total transaction volume) where possible, then clearly state the PRC law or regulation that prevents further granularity, citing the specific article number.
5. Engage a single law firm with both PRC and Hong Kong-qualified lawyers to manage the entire conflict resolution process, as the most common failure mode—according to CSRC rejection data—is a disconnect between the PRC legal opinion and the Hong Kong disclosure language, which a unified legal team can prevent.