How to Disclose Non-Compliance Incidents Found During IPO Due Diligence

The SFC and HKEX’s joint statement in December 2024 on sponsor liability for due diligence failures has sharpened the consequences of discovering non-compliance incidents during an IPO. The statement, referencing SFC Code of Conduct paragraphs 17.1 to 17.6, explicitly holds sponsors accountable for verifying that a listing applicant’s disclosure of non-compliance is “complete, accurate, and not misleading.” This is not a theoretical risk. In 2024, the SFC disciplined two sponsors for inadequate due diligence on historical non-compliance with PRC foreign exchange and tax laws, imposing fines totalling HKD 48 million. For any Main Board or GEM applicant with a VIE structure or cross-border operations, the question is no longer whether non-compliance incidents exist — it is how to structure their disclosure to survive SFC scrutiny and avoid a listing delay or rejection.

The Regulatory Framework for Non-Compliance Disclosure

HKEX Listing Rules and the Materiality Threshold

HKEX Listing Rules Chapter 11, specifically Rule 11.06, requires a prospectus to contain “full, true and accurate disclosure of all material matters.” Materiality is defined by whether the information would influence a reasonable investor’s decision to subscribe for or deal in the securities. For non-compliance incidents — such as historical failure to register a VIE agreement with the PRC Ministry of Commerce, or past violations of SAFE rules on cross-border capital flows — the materiality threshold is measured against the applicant’s revenue, asset size, and operational dependence on the non-compliant activity.

The 2023 HKEX Guidance Letter GL68-23 (updated) provides a three-part test for assessing materiality of non-compliance: (1) the financial impact of the non-compliance, measured by any fines, penalties, or remedial costs; (2) the operational impact, including whether the non-compliance could lead to suspension of a material business licence; and (3) the reputational impact, assessed by reference to media coverage or regulatory inquiries. If any of these three factors exceeds 5% of the applicant’s net profit or total assets, the incident is presumptively material and must be disclosed.

SFC Sponsor Due Diligence Requirements

The SFC Code of Conduct paragraph 17.6(d) requires sponsors to perform “reasonable due diligence” to identify any non-compliance with laws and regulations that could have a material adverse effect on the listing applicant. This includes reviewing correspondence with regulators, conducting management interviews, and, where necessary, engaging PRC legal counsel to issue a legal opinion on the non-compliance. The sponsor must document all steps taken, including the reasons for concluding that a particular incident is not material.

The December 2024 joint statement clarified that the sponsor’s duty extends to verifying the accuracy of the applicant’s remedial actions. If the applicant claims to have obtained a waiver from the PRC regulator, the sponsor must sight the waiver document and confirm its authenticity with the issuing authority. Failure to do so constituted the basis for the HKD 48 million fine against a sponsor in 2024, where the sponsor accepted a legal opinion letter without independently verifying the regulator’s response.

Structuring the Disclosure in the Prospectus

The Risk Factors Section: Placement and Wording

Non-compliance incidents must be disclosed in the Risk Factors section of the prospectus, typically under a sub-heading such as “Risks Relating to Our Corporate Structure and Compliance with PRC Laws.” The wording must follow the SFC’s prescribed format: state the specific law or regulation violated, the period during which the non-compliance occurred, the financial or operational impact, and the remedial actions taken. Vague language such as “we may have been non-compliant in certain respects” is insufficient. The SFC expects precise references, such as “failure to register the VIE agreements with the Ministry of Commerce under the 2006 M&A Rules from 2018 to 2022.”

The disclosure must also quantify the potential maximum penalty. For example, if the non-compliance relates to PRC foreign exchange rules (SAFE Circular 37), the penalty can be up to 30% of the amount involved. The prospectus must state that amount in RMB and HKD, and disclose whether the applicant has set aside a provision in its financial statements. If no provision has been made, the sponsor must explain why, referencing HKAS 37 on provisions, contingent liabilities, and contingent assets.

The Business Section: Integration with Operations

Non-compliance incidents that affect a material business licence or regulatory approval must also be disclosed in the Business section of the prospectus. For a PRC online education company with a VIE structure, if the company operated for six months without an ICP licence (required under the PRC Telecommunications Regulations), this fact must be disclosed under “Licences and Permits.” The disclosure should state the date the licence was eventually obtained, the period of unlicensed operation, and whether any enforcement action was taken by the MIIT or local communications bureau.

The HKEX Listing Rule 11.07 requires that any material litigation, arbitration, or regulatory proceedings be disclosed. If the non-compliance led to a regulatory investigation, even if no formal proceedings were commenced, the prospectus must disclose the investigation’s status. The SFC considers the failure to disclose a pending investigation as a material omission, as established in the 2022 SFC enforcement action against the sponsor of a failed biotech listing (SFC v. Sponsor A, 2022).

The Legal Opinion and Waiver Letters

Every non-compliance disclosure must be supported by a PRC legal opinion that addresses three points: (1) the legal basis for concluding that a violation occurred, (2) the maximum potential penalty under applicable PRC law, and (3) the effectiveness of any remedial actions taken. The legal opinion must be issued by a PRC law firm with a valid practising licence and must be addressed to the sponsor and the applicant. The opinion must be dated within three months of the prospectus’s registration date.

If the applicant has obtained a waiver or exemption from the regulator, the waiver letter must be appended to the prospectus as an exhibit. The HKEX will typically require the waiver letter to be translated into English by a certified translator, with the translation verified by the sponsor’s legal counsel. The December 2024 joint statement emphasised that a waiver letter is not a “blank cheque” — it must explicitly state the period and scope of the waiver, and the regulator must confirm that it will not take enforcement action for the past non-compliance.

Cross-Border Considerations for VIE Structures

PRC Foreign Exchange and Tax Non-Compliance

For VIE-structured applicants, the most common non-compliance incidents involve SAFE Circular 37 registration failures and PRC tax underpayment. SAFE Circular 37 requires PRC residents who hold offshore special purpose vehicles (SPVs) to register their shareholding with the local SAFE branch. Failure to do so can result in a penalty of up to RMB 500,000 per individual, and more critically, can block the SPV from repatriating IPO proceeds to China. The prospectus must disclose the number of PRC resident shareholders who failed to register, the date when registration was eventually completed, and any penalties paid.

PRC tax non-compliance often arises from the VIE’s profit transfer structure. Under PRC Enterprise Income Tax Law Article 41, related-party transactions must be conducted at arm’s length. If the VIE paid management fees to the offshore WFOE at a rate that the tax bureau later deemed excessive, the prospectus must disclose the tax assessment, any additional tax paid, and the penalty (typically 0.05% per day on the underpaid amount). The disclosure must reference the specific tax bureau’s assessment notice and state whether the applicant has appealed.

Hong Kong Listing Rules on VIE Structures

HKEX Guidance Letter HKEX-GL77-14 (updated 2023) sets out specific disclosure requirements for VIE structures. Paragraph 4.2 requires the applicant to disclose any historical non-compliance with PRC laws that could affect the validity of the VIE agreements. This includes failure to obtain the required approvals from the PRC Ministry of Commerce under the 2006 M&A Rules, or failure to file the VIE agreements with the relevant local government authority. The disclosure must include a legal opinion from PRC counsel confirming that the non-compliance has been remedied and that the VIE agreements remain valid and enforceable.

If the non-compliance is so material that it could lead to the VIE agreements being voided by a PRC court, the HKEX may require the applicant to restructure the VIE or, in extreme cases, withdraw the listing application. The 2023 case of a PRC fintech applicant was withdrawn after the HKEX determined that the applicant’s historical non-compliance with PRC data security laws could not be adequately remedied within a reasonable timeframe.

Remedial Actions and the Timeline to Listing

Quantifying Remedial Costs and Timeline

The prospectus must disclose the total cost of remedial actions, including legal fees, regulatory fines, and any compensation paid to affected parties. If the remedial actions involve obtaining new licences or approvals, the disclosure must include the timeline — from the date the application was submitted to the date the licence was granted. The HKEX will scrutinise any gap between the non-compliance period and the remedial action date. A gap exceeding 12 months without a reasonable explanation will be treated as a material deficiency.

For example, an applicant that operated without a required PRC internet content provider licence for 18 months must explain why the licence application was not submitted earlier. If the applicant claims it was unaware of the requirement, the sponsor must assess whether this indicates a systemic compliance failure that could affect other areas of the business. The SFC’s 2024 enforcement action highlighted that a sponsor’s failure to probe such gaps constituted a breach of its due diligence obligations.

Impact on the Listing Timetable

A material non-compliance incident typically adds 3 to 6 months to the listing timetable. The HKEX requires the applicant to demonstrate a “clean compliance record” for at least 12 months before the listing application is submitted. If the non-compliance occurred within that 12-month period, the HKEX may require the applicant to wait until the 12-month clean period has elapsed before resubmitting the application. This requirement is set out in HKEX Listing Decision LD143-2023, which addressed a case where the applicant’s non-compliance with PRC environmental laws occurred 8 months before the listing application.

The sponsor must factor this timeline into the A1 filing date. If the non-compliance is discovered during the sponsor’s due diligence, the sponsor should immediately notify the HKEX via the pre-A1 consultation process. The HKEX may issue a “red flag” letter requiring the applicant to address the non-compliance before the A1 filing is accepted. In practice, this means the sponsor should budget for at least two additional months of due diligence and legal work for each material non-compliance incident.

Actionable Takeaways

1. Quantify every non-compliance incident by its financial impact (fines, penalties, remedial costs) and operational impact (licence suspension risk) against the 5% materiality threshold under HKEX Guidance Letter GL68-23.
2. Structure the prospectus disclosure with precise legal references — the specific PRC law, regulation, or circular violated, the exact period of non-compliance, and the maximum statutory penalty — avoiding any general or hypothetical language.
3. Obtain a PRC legal opinion dated within three months of the prospectus registration date that addresses the legal basis for the violation, the maximum penalty, and the effectiveness of remedial actions, and append any regulator waiver letter as an exhibit with a certified English translation.
4. Document the sponsor’s independent verification of all remedial actions, including sighting regulator waiver letters and confirming their authenticity, to comply with SFC Code of Conduct paragraph 17.6(d) as reinforced by the December 2024 joint statement.
5. Factor a minimum 12-month clean compliance record before the A1 filing and budget for 3 to 6 additional months of due diligence and legal work for each material non-compliance incident, using the HKEX pre-A1 consultation process to manage regulatory expectations.