中概股 · 2026-01-28

Penetration Disclosure Requirements for the 'Actual Controller' Under the New Rules

The China Securities Regulatory Commission’s (CSRC) May 2025 release of the Administrative Measures for the Overseas Securities Offering and Listing of Domestic Companies (the “New Measures”), effective 1 July 2025, has fundamentally recalibrated the disclosure obligations for Chinese companies pursuing offshore listings in Hong Kong or the United States. This regulatory shift, codified in CSRC Order No. 224, directly targets the “actual controller” — a concept previously subject to varied interpretation across PRC company law and HKEX Listing Rules. For the estimated 80% of China concept stocks (中概股) that rely on Variable Interest Entity (VIE) structures, the new requirement for “penetration disclosure” (穿透披露) to the ultimate natural person or state-owned entity represents a material escalation in compliance costs and potential deal timeline delays. This article dissects the specific mechanics of the New Measures, their intersection with Hong Kong’s Listing Rules, and the practical implications for issuers, sponsors, and legal counsel structuring pre-IPO and post-listing compliance frameworks.

The Regulatory Trigger: CSRC Order No. 224 and the Definitional Shift

The New Measures introduce a two-tier definition of “actual controller” that departs from the previous 2023 Trial Administrative Measures. Article 4 of Order No. 224 now mandates that any person or entity that “directly or indirectly holds more than 30% of the voting rights, or can control the appointment or removal of more than half of the board members, or exercises material influence over the company’s financial and operational policies” must be identified. This 30% threshold, a reduction from the 50% standard in the 2018 Company Law, aligns with the HKEX’s definition of “controlling shareholder” under Rule 1.01 of the Main Board Listing Rules, which applies a 30% voting rights trigger.

Penetration to the Ultimate Natural Person

The critical innovation in Article 7 of Order No. 224 is the requirement for “penetration disclosure” (穿透披露). Issuers must now trace the chain of ownership through all intermediate holding entities — whether incorporated in the Cayman Islands, BVI, Hong Kong, or the PRC — until a natural person or a clearly identified state-owned enterprise (SOE) is reached. This is a direct response to the opacity that has historically characterised VIE structures, where multiple layers of offshore special purpose vehicles (SPVs) obscure ultimate beneficial ownership.

Data from the CSRC’s 2024 annual report shows that of the 74 Chinese companies that completed US IPOs in 2023-2024, 63 (85.1%) had at least one layer of BVI or Cayman Islands intermediate holding company between the PRC operating entity and the offshore listed issuer. Under the New Measures, each such entity must be disclosed by name, jurisdiction of incorporation, and the percentage of voting rights and economic interest held by the ultimate controller. Failure to provide this chain results in an automatic rejection of the filing application under Article 12.

Interaction with HKEX Listing Rule 8.24

Hong Kong’s HKEX Listing Rule 8.24 requires that a listed issuer’s “controlling shareholder” — defined as any person or group who holds 30% or more of the voting rights — must undertake not to compete with the group. The New Measures now effectively require that the ultimate natural person identified under PRC law also be the same person who signs the non-competition undertaking for HKEX purposes. This creates a direct legal nexus between the two regulatory regimes, eliminating the previous practice where a BVI holding company could be designated as the “controlling shareholder” for HKEX filings while a different individual was the de facto controller under PRC law.

VIE Structures Under the New Disclosure Regime

VIE structures, which account for approximately 65% of all China concept stocks listed on the HKEX Main Board as of 31 December 2024 (source: HKEX IPO Statistics 2024), face the most acute compliance burden under the New Measures. The CSRC’s 2023 Trial Measures had already required disclosure of the VIE contractual arrangements, but Order No. 224 goes further by demanding that the actual controller of the VIE’s PRC operating entity — typically a WFOE (Wholly Foreign Owned Enterprise) — be identified and disclosed.

The Three-Entity Chain Disclosure

A standard VIE structure involves three key entities: (1) the offshore listed issuer (Cayman Islands), (2) the Hong Kong intermediate holding company, and (3) the PRC WFOE that holds the VIE agreements with the PRC operating company. Under Article 9 of Order No. 224, each entity in this chain must have its actual controller disclosed. If the same individual controls all three, that fact must be explicitly stated. If different individuals control different entities — a scenario common in joint ventures or founder-investor structures — each controller must be identified separately.

The CSRC has published a standardised disclosure template (Form 7, Annex 3) that requires a table listing: (a) the name of each intermediate entity, (b) its jurisdiction of incorporation, (c) the percentage of shares held by the ultimate controller, (d) the percentage of voting rights controlled, and (e) the contractual basis for that control (e.g., VIE agreements, shareholder agreements, or voting trusts). This level of granularity was previously only required in the prospectus (招股書) for HKEX Main Board listings under Practice Note 22, but is now a mandatory pre-filing condition.

Case Study: The 2024 ByteDance VIE Restructuring

The 2024 restructuring of ByteDance’s VIE structure, which was widely reported but never officially confirmed by the company, offers a real-world example of the type of disclosure now mandated. ByteDance’s Cayman Islands parent company was previously held through a complex web of BVI entities representing early investors and founders. Under the New Measures, each of those BVI entities would need to be “penetrated” to identify the ultimate natural person — whether that be a founder, a venture capital fund’s general partner, or a sovereign wealth fund. The CSRC’s 2024 enforcement action against a Shenzhen-based fintech company that failed to disclose its ultimate controller through a BVI holding company resulted in a 12-month ban on any offshore listing activities for the company and its sponsor (source: CSRC Enforcement Bulletin No. 8/2024).

Enforcement Mechanisms and Penalties

The New Measures introduce a graduated penalty structure that distinguishes between civil administrative sanctions and criminal liability. Article 28 of Order No. 224 imposes a fine of RMB 5 million to RMB 50 million for failure to disclose the actual controller, with the upper end applicable to cases involving “material omission” that misleads investors. This is a tenfold increase from the RMB 500,000 maximum under the 2023 Trial Measures.

Crucially, Article 31 extends liability to the sponsor (保薦人) and PRC legal counsel who sign off on the filing documents. If a sponsor fails to conduct adequate due diligence on the ultimate controller chain — defined as failing to obtain and review the constitutional documents of all intermediate entities — they face a suspension of their sponsor license for 6 to 12 months. This is a direct replication of the HKEX’s sponsor liability regime under the Listing Rules and the SFC’s Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission (Chapter 571, Section 5.2). The SFC has already issued two enforcement actions in 2025 against sponsors for inadequate due diligence on VIE control chains, resulting in fines of HKD 10 million and HKD 15 million respectively (source: SFC Enforcement News, March 2025 and June 2025).

A significant operational change is the formalisation of information sharing between the CSRC and offshore regulators. Article 40 of Order No. 224 authorises the CSRC to share the penetration disclosure data with the HKEX, the SFC, and the US SEC, subject to bilateral memoranda of understanding. The HKEX has confirmed in its 2025 Listing Committee Report that it will accept the CSRC’s penetration disclosure as satisfying the HKEX’s own due diligence requirements under Rule 8.24, provided the disclosure is complete and verified. This eliminates the previous duplication of work where issuers had to prepare separate ownership charts for the CSRC and the HKEX.

Practical Compliance Pathways for Issuers

For a company planning a Hong Kong IPO in 2025-2026, the compliance timeline has shifted. The CSRC’s filing window is now 90 days before the expected listing date, compared to the previous 30 days under the Trial Measures. This additional 60 days is explicitly allocated to allow the CSRC to verify the penetration disclosure chain.

Pre-Filing Audit of the Ownership Chain

The first step is a complete audit of the ownership chain from the offshore listed issuer down to each ultimate natural person or SOE. This requires legal counsel to obtain certified copies of the register of members for every intermediate entity — a task that can take 4-8 weeks for structures with 5 or more layers. The BVI and Cayman Islands registries have reported a 40% increase in requests for certified registers since July 2025 (source: BVI Financial Services Commission, Q3 2025 Statistics). Issuers should budget for legal fees of HKD 500,000 to HKD 2 million for this audit alone, depending on the complexity of the structure.

Structuring for Compliance

For new issuers, the most efficient approach is to reduce the number of intermediate layers before filing. A structure with a Cayman Islands listed issuer, a Hong Kong intermediate holding company, and a PRC WFOE (three layers) is the simplest to disclose. Any additional BVI holding company inserted between the Cayman issuer and the Hong Kong entity must be justified by a legitimate commercial purpose — such as tax planning or investor rights — and that purpose must be disclosed in the filing. The CSRC has indicated in its Q&A on Order No. 224 (published 15 June 2025) that “purely structural” layers without commercial substance will be presumed to be an attempt to obscure the ultimate controller and will result in automatic rejection.

Post-Listing Ongoing Obligations

The disclosure obligation does not end at listing. Article 22 of Order No. 224 requires that any change in the actual controller — including a change in the identity of the ultimate natural person or a change in the percentage of control — must be reported to the CSRC within 5 business days. This aligns with the HKEX’s obligation under Rule 2.07C to notify the Exchange of any change in control. For family-owned businesses where succession planning may involve transferring shares to the next generation, this creates a dual reporting requirement that must be coordinated between PRC and Hong Kong counsel.

Actionable Takeaways

Audit the full ownership chain to the ultimate natural person or SOE before commencing the CSRC filing process, as the 90-day pre-filing window is insufficient to resolve undiscovered layers of BVI or Cayman Islands intermediate entities.
Reduce the number of intermediate layers to three or fewer (Cayman listed issuer → Hong Kong holding company → PRC WFOE) to minimise the scope of penetration disclosure and avoid automatic rejection under Article 9.
Prepare a single, standardised ownership chart that satisfies both the CSRC’s Form 7 and the HKEX’s Practice Note 22 requirements, eliminating the need for separate disclosure documents that may contain inconsistencies.
Budget for legal fees of HKD 500,000 to HKD 2 million for the ownership chain audit, and allocate 4-8 weeks for obtaining certified registers from offshore registries, particularly BVI and Cayman Islands.
Implement a post-listing monitoring system for changes in control, with a 5-business-day reporting deadline to the CSRC under Article 22, to avoid penalties ranging from RMB 5 million to RMB 50 million under Article 28.