How to Conduct a Penetration Check on 'Connected Persons' in a Hong Kong IPO

The Hong Kong Stock Exchange (HKEX) has sharpened its focus on the integrity of a listing applicant’s shareholder base, particularly where a significant portion of shares is allocated to a small group of placees. The Exchange’s heightened scrutiny of “connected persons” — a concept defined under the HKEX Listing Rules — has become a critical gatekeeping mechanism in 2025 and 2026, following a series of enforcement actions against sponsors for failures in due diligence. The HKEX’s 2024 Enforcement Report noted a 40% year-on-year increase in disciplinary actions related to inadequate sponsor work, with failures to identify and properly disclose connected person placings being a recurring theme. For sponsors, legal advisers, and compliance officers advising on a Hong Kong IPO, the “penetration check” — the process of tracing the ultimate beneficial ownership of placees to determine if they are connected to the issuer, its directors, or its substantial shareholders — is no longer a procedural box-ticking exercise. It is a substantive liability risk. This article outlines the regulatory framework, the practical mechanics of a penetration check, and the specific steps required to satisfy HKEX and SFC standards in the current enforcement environment.

The Regulatory Framework: Defining the Connected Person

The obligation to conduct a penetration check stems directly from the HKEX’s definition of a “connected person” under the Listing Rules, specifically Rule 14A.07 to 14A.11. The definition is broad and extends beyond immediate family to include associates, affiliates, and entities controlled by or acting in concert with a director, chief executive, or substantial shareholder. The SFC’s Code of Conduct for Persons Licensed by or Registered with the SFC (the “Code of Conduct”) further mandates that a sponsor must take all reasonable steps to satisfy itself that the information in the prospectus is accurate and complete in all material respects. This includes the identity of placees and their connections to the issuer.

A failure to identify a connected person in a placing can lead to a breach of Rule 14A.35, which requires that any transaction with a connected person be conducted on normal commercial terms and be subject to independent shareholder approval if it exceeds the de minimis thresholds. In the context of an IPO placing, the consequence is potentially a restatement of the prospectus, a delay in listing, or a referral to the SFC for disciplinary action. The 2023 SFC disciplinary action against a major sponsor firm for failing to identify that a placee was an associate of a director of the listing applicant serves as a clear precedent. The sponsor was fined HKD 12 million and its licence was suspended for six months.

The Mechanics of a Penetration Check: A Step-by-Step Approach

The penetration check is not a single event but a structured process that must be documented from the initial due diligence phase through to the post-IPO compliance period. The process is designed to peel back layers of ownership to identify the ultimate natural persons or controlling entities behind each placee.

Step 1: Initial Screening and KYC Documentation

The first step is to obtain a complete set of Know Your Client (KYC) documentation from each placee. This includes certified true copies of passports or national identity cards for individuals, and certificates of incorporation, registers of directors and shareholders, and organisational charts for corporate entities. The sponsor must ensure that the documentation is current and not older than six months from the date of the placing agreement. The HKEX’s Guidance Letter HKEX-GL86-16, updated in 2024, explicitly states that sponsors must obtain and review the constitutional documents and ownership structure of every placee that is a legal entity.

For a corporate placee registered in an offshore jurisdiction such as the BVI, Cayman Islands, or Bermuda, the sponsor must request a certified copy of the register of members and the register of directors. Where the placee is a trust, the sponsor must obtain a copy of the trust deed and a letter from the trustee confirming the identity of the settlor, the protector (if any), and the beneficiaries. The SFC’s 2022 circular on anti-money laundering practices emphasises that for trusts, the ultimate beneficial owner is the individual who ultimately owns or controls the trust, which may be the settlor or a beneficiary, depending on the trust structure.

Step 2: Tracing the Ownership Chain

Once the initial documentation is obtained, the sponsor must trace the ownership chain to the ultimate natural person. This is the core of the penetration check. The HKEX’s Listing Decision HKEX-LD130-2024 clarified that a “connected person” includes any entity where a director or substantial shareholder of the listing applicant, or any of their associates, holds 10% or more of the voting power or is able to exercise significant influence. The threshold for “significant influence” is not rigidly defined but is assessed on a case-by-case basis, considering factors such as board representation, contractual arrangements, and the ability to direct the entity’s financial and operating policies.

The sponsor should prepare an ownership diagram for each placee, showing the chain from the placee entity down to the ultimate natural persons. Where the chain involves multiple layers, the sponsor must obtain documentary evidence for each layer. For example, if a placee is a BVI company that is itself owned by a Cayman Islands exempted company, the sponsor must obtain the register of members for the Cayman company. If the Cayman company is owned by a trust, the trust deed and the trustee’s confirmation letter are required. The process continues until the sponsor can identify the ultimate natural person or persons who control the placee.

Step 3: Cross-Referencing Against the Connected Person List

The sponsor must then cross-reference the identified ultimate beneficial owners against a comprehensive list of connected persons. This list must include all directors, chief executives, substantial shareholders (holding 10% or more of the listing applicant’s shares), and their respective associates. The list must also include any person who has been a director or substantial shareholder of the listing applicant within the 12 months preceding the date of the prospectus, as required by Rule 14A.07.

The cross-referencing should be done not only by name but also by common identifiers such as Hong Kong Identity Card numbers, passport numbers, and residential addresses. The SFC’s 2023 enforcement case against a sponsor for failing to identify a connected person involved a placee that was held through a chain of offshore companies, where the ultimate beneficial owner was the brother of a director, but the sponsor had only checked the name against the director’s name and not against the director’s family members. The SFC found that the sponsor had failed to conduct a “reasonably thorough” check.

Practical Challenges and Common Pitfalls

The penetration check is fraught with practical difficulties, particularly when dealing with placees from jurisdictions with weak corporate transparency laws or where nominee arrangements are common. The sponsor must be alert to red flags that indicate a potential connection that has not been disclosed.

Red Flags in Offshore Structures

A common red flag is the use of a BVI or Cayman Islands entity that has been incorporated shortly before the placing. The HKEX’s Guidance Letter HKEX-GL86-16 notes that a placee incorporated within the six months prior to the IPO placing date should be subject to enhanced due diligence. The sponsor should request an explanation for the timing of the incorporation and obtain evidence of the placee’s business activities and source of funds.

Another red flag is the use of a nominee shareholder. If the register of members of a placee entity shows a corporate director or a professional trustee as the registered owner, the sponsor must request a declaration from the nominee confirming the identity of the beneficial owner. The SFC’s 2021 circular on nominee arrangements states that a sponsor cannot rely solely on a nominee’s declaration without conducting independent verification, such as reviewing bank account mandates or board resolutions.

The Problem of “Piggybacking” Placees

A particularly difficult scenario is where a placee is a fund or a special purpose vehicle that receives allocations from multiple investors. In such cases, the sponsor must determine whether any of the underlying investors in the fund are connected persons. The HKEX’s Listing Decision HKEX-LD130-2024 addressed this by stating that where a placee is a fund, the sponsor must obtain a list of all investors who hold 10% or more of the fund’s net asset value or who have the ability to direct the fund’s investment decisions. If any such investor is a connected person, the entire allocation to the fund may be treated as a connected person placing, requiring independent shareholder approval.

The practical challenge is that fund managers are often reluctant to disclose their investor lists, citing confidentiality agreements. The sponsor must negotiate a solution, such as obtaining a legal opinion from the fund’s counsel confirming that no connected person holds a material interest, or obtaining a side letter from the fund manager confirming that the fund will not allocate any of the IPO shares to a connected person. The HKEX has indicated that it will accept a legal opinion if it is from a reputable law firm and is supported by the fund’s constitutional documents.

The 12-Month Look-Back Period

The connected person definition extends to persons who have been directors or substantial shareholders within the 12 months preceding the prospectus date. This creates a look-back obligation for the sponsor. The sponsor must maintain a list of all persons who held such positions during that period and cross-reference them against the placees.

In practice, this means that the sponsor must obtain from the listing applicant a complete list of all directors and substantial shareholders for the 12-month period, including any persons who resigned or sold their shares during that time. The sponsor must then verify this list against the company’s statutory records, such as the register of directors and the register of substantial shareholders maintained under the Companies Ordinance (Cap. 622). The 2024 SFC enforcement case involving a sponsor that failed to identify a former director who had resigned nine months before the prospectus date as a connected person resulted in a public censure and a fine of HKD 8 million.

Documentation and Disclosure Requirements

The HKEX requires that the sponsor’s due diligence on connected persons be fully documented in the sponsor’s working papers. The working papers must include a detailed memo explaining the steps taken, the documents reviewed, and the conclusions reached. The HKEX’s Guidance Letter HKEX-GL86-16 states that the sponsor must maintain a “clear audit trail” of its due diligence.

The Sponsor’s Declaration

The sponsor is required to provide a declaration in the prospectus that it has taken all reasonable steps to satisfy itself that the information in the prospectus is accurate and complete. This declaration, set out in Appendix 1A of the Listing Rules, specifically requires the sponsor to confirm that it has conducted due diligence on the placees and that, to the best of its knowledge, no placee is a connected person unless disclosed.

If the sponsor identifies a connected person, it must ensure that the transaction is structured as a connected transaction under Rule 14A.35. This requires that the placing be on normal commercial terms and that the listing applicant obtain independent shareholder approval if the transaction exceeds the de minimis thresholds. The sponsor must also ensure that the prospectus contains a clear disclosure of the connected person’s identity and the terms of the placing.

The Role of the Compliance Adviser

After listing, the compliance adviser has an ongoing obligation to monitor the issuer’s compliance with the connected transaction rules. If a connected person placing was not identified at the IPO stage, the compliance adviser must report the matter to the HKEX and the SFC. The 2025 SFC circular on post-IPO compliance emphasised that the compliance adviser must have a system in place to monitor changes in the issuer’s connected person list and to review any subsequent placings or share transfers that may involve connected persons.

Conclusion and Actionable Takeaways

The penetration check on connected persons in a Hong Kong IPO is a high-stakes due diligence exercise that requires a systematic, documented approach. The regulatory environment in 2025-2026 is unforgiving, with the HKEX and SFC actively pursuing enforcement actions against sponsors that fail to identify connected persons. The following takeaways are specific actions that sponsors, legal advisers, and compliance officers should implement:

1. Obtain KYC documentation for every placee, including certified copies of passports, certificates of incorporation, and registers of members, and ensure all documentation is current (not older than six months).

2. Trace the ownership chain to the ultimate natural person for every corporate placee, trust, or fund, and prepare a documented ownership diagram for each, with supporting evidence for each layer.

3. Maintain a comprehensive and current list of all connected persons, including directors, substantial shareholders, their associates, and any persons who held such positions within the 12 months preceding the prospectus date.

4. Conduct enhanced due diligence on any placee incorporated within six months of the placing, any placee using nominee arrangements, or any fund that refuses to disclose its investor list, and document the rationale for accepting the risk.

5. **Ensure that the sponsor’s working papers contain a clear audit trail of the penetration check, including a memo explaining the steps taken, the documents reviewed, and the conclusions reached, to withstand regulatory scrutiny.