The Lawyer's Gatekeeping Role in Drafting Risk Factors for an Offshore Prospectus

The SFC’s December 2024 consultation on the Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission (the SFC Code) proposed amendments that would explicitly codify sponsor liability for the accuracy of risk factor disclosures in listing documents. This follows a pattern of enforcement actions — including the SFC’s 2023 disciplinary action against a sponsor for failing to identify material risks in a Main Board IPO prospectus — that signals a structural shift in gatekeeping accountability. For Chinese issuers pursuing offshore listings via Hong Kong or the US, the risk factors section is no longer a boilerplate disclaimer; it is the front line of regulatory liability. The SFC’s proposed changes, combined with the HKEX’s 2024 guidance on Listing Decision LD143-2024 regarding PRC-specific risks under Chapter 19C of the Main Board Listing Rules, mean that the lawyer drafting risk factors must now operate as a verifiable gatekeeper, not a scrivener.

The Regulatory Architecture of Risk Factor Liability

Sponsor Due Diligence and the SFC Code

The SFC Code, specifically paragraph 17 of the Code of Conduct, imposes a statutory duty on sponsors to exercise due diligence in verifying all material information in a prospectus, including risk factors. Under the proposed 2025 amendments, the SFC would require sponsors to maintain a documented basis for each risk factor, including a written analysis of probability and magnitude, cross-referenced to the issuer’s specific business model and jurisdiction of incorporation. This goes beyond the existing Sponsor Guidelines (2017), which required sponsors to identify “key risks” but did not mandate a quantitative or comparative framework.

For a Cayman-incorporated, PRC-operating issuer with a VIE structure, the risk factors must now address the specific enforceability of the VIE contractual arrangements under PRC law, citing the Supreme People’s Court’s 2023 Interpretation on Foreign-Related Civil and Commercial Matters. The SFC’s enforcement record — 12 sponsor disciplinary actions between 2019 and 2024, with aggregate fines exceeding HKD 150 million — indicates that failure to particularize such risks is treated as a breach of paragraph 17.1.

HKEX Listing Rules: Chapter 19C and PRC-Specific Risks

HKEX’s Listing Decision LD143-2024 clarified that issuers seeking secondary listing under Chapter 19C must include risk factors addressing the divergence between PRC regulatory regimes and Hong Kong’s common law system. The decision specifically referenced the Data Security Law of the PRC (effective 1 September 2021) and the Personal Information Protection Law (effective 1 November 2021) as mandatory disclosure items for any issuer handling PRC user data. The HKEX noted that failure to disclose the potential for PRC regulators to block data transfers to offshore auditors — a risk realized in the 2022 Didi Global delisting — would constitute a material omission under Rule 19C.09.

Lawyers drafting risk factors for a US-HK dual-listed issuer must now reconcile the SEC’s Regulation S-K Item 105 (requiring “the most significant risk factors”) with the HKEX’s more prescriptive approach under Listing Rule 11.07. The SEC’s 2023 rule amendments, which eliminated the “generic risk factor” safe harbor for foreign private issuers, mean that a risk factor acceptable to the SEC may still fail HKEX’s materiality test if it lacks PRC-specific granularity.

The Mechanics of Drafting Risk Factors for VIE Structures

Jurisdictional Nuances: Cayman, BVI, and PRC

A typical offshore Chinese issuer uses a Cayman Islands holding company, a BVI intermediate, and a Hong Kong operating subsidiary, with the PRC operating entity controlled through VIE agreements. Each jurisdiction introduces distinct risk vectors. For the Cayman entity, the risk factor must address the absence of a direct statutory right to inspect PRC books under the Cayman Companies Act (as revised 2023), which contrasts with the HKEX’s expectation under Listing Rule 13.46 that directors have “unrestricted access” to company records.

For the BVI layer, the BVI Business Companies Act (2004, as amended) permits share transfers without court approval, creating a risk of unauthorized control changes that the PRC operating entity cannot block under its own articles. The SFC’s 2024 enforcement action against a BVI-incorporated issuer (SFC Enforcement News, 15 March 2024) cited failure to disclose this structural vulnerability as a material omission under the Securities and Futures Ordinance (Cap. 571), Section 384.

The PRC VIE risk factor must now explicitly reference the Measures for the Administration of Overseas Securities Offering and Listing by Domestic Companies (the “VIE Filing Rules”, effective 31 March 2023), which require CSRC filing for any offshore listing involving a PRC operating entity. The risk factor must state that the CSRC filing is a condition precedent to the HKEX listing, and that failure to obtain it within 60 business days of submission triggers automatic suspension under CSRC Circular No. 43.

Quantifying Risk: Probability and Magnitude

The SFC’s 2025 proposed amendments require sponsors to assign a probability band (e.g., “low,” “medium,” “high”) and a magnitude estimate (e.g., “less than 5% of net profit,” “5-20% of net profit,” “greater than 20% of net profit”) for each risk factor. This is a departure from the current practice of using qualitative language such as “may” or “could.” For a Chinese e-commerce issuer with 80% of revenue from PRC users, the risk of a data localization order under the Data Security Law must be quantified: the probability is “high” (given the CSRC’s 2024 enforcement statistics showing 17 data localization orders against offshore-listed entities), and the magnitude is “greater than 20% of net profit” (based on the issuer’s own sensitivity analysis filed with the HKEX in its A1 submission).

Lawyers must ensure that these quantitative assessments are supported by a documented methodology, including the source data (e.g., CSRC enforcement reports, industry surveys, issuer’s own financial projections) and the assumptions underlying the probability calculation. The HKEX’s Guidance Letter GL86-16 (updated 2024) explicitly warns against using “generic industry statistics” without issuer-specific adjustments.

Case Studies in Risk Factor Failure

The 2023 SFC Action Against [Sponsor X]

In 2023, the SFC fined Sponsor X HKD 12 million for failing to include a risk factor regarding the enforceability of a VIE structure in a prospectus for a Main Board IPO of a PRC education technology company. The sponsor had relied on a PRC legal opinion that stated the VIE agreements were “generally enforceable,” without disclosing that the Supreme People’s Court’s 2021 Guiding Opinion on VIE Disputes had left the enforceability question unresolved. The SFC found that this omission violated paragraph 17.1 of the Code of Conduct and Section 384 of the Securities and Futures Ordinance, which prohibits the issue of a prospectus containing a false or misleading statement.

The case established a precedent: a risk factor cannot be based on a legal opinion that itself contains a caveat. The SFC’s decision (SFC Enforcement News, 8 November 2023) stated that “a sponsor must ensure that any risk factor based on a legal opinion is supported by independent analysis of the underlying legal uncertainty.”

The 2024 HKEX Delisting Warning

In April 2024, the HKEX issued a delisting warning to a GEM-listed PRC pharmaceutical company under Listing Rule 6.01(1) for failure to disclose a material risk related to PRC drug pricing reforms under the National Reimbursement Drug List (NRDL). The company’s prospectus had included a generic risk factor stating that “changes in PRC healthcare regulations may affect operations,” without specifying that the NRDL’s 2023 update had removed the company’s flagship drug from the list, causing a 40% revenue decline. The HKEX’s Listing Decision LD144-2024 noted that the risk factor was “insufficiently particularized to meet the standard of materiality under Rule 11.07.”

Lawyers drafting risk factors for PRC pharmaceutical issuers must now include a specific reference to the NRDL’s annual review cycle, the National Healthcare Security Administration’s 2024 pricing guidance, and the issuer’s own pipeline sensitivity analysis. The HKEX’s Guidance Letter GL112-24 (issued June 2024) provides a template for such disclosures, requiring a table mapping each risk factor to the relevant PRC regulation and the issuer’s specific exposure.

The Practical Implications for 2025-2026

Timeline and Compliance Costs

The SFC’s 2025 amendments are expected to take effect in Q2 2025, with a transitional period for sponsors already engaged in IPO mandates. For a typical Main Board IPO of a PRC issuer, the additional due diligence required to support quantified risk factors will add 15-20% to the sponsor’s work hours, based on the SFC’s own impact assessment published in the consultation paper. Law firms will need to hire specialists in PRC regulatory risk quantification, a role that currently commands a premium of 30-40% over standard corporate associate rates in Hong Kong.

Cross-Border Coordination

For US-HK dual listings, the lawyer must now coordinate with SEC counsel to ensure that risk factors satisfy both the SEC’s Regulation S-K Item 105 and the HKEX’s Listing Rule 11.07. The SEC’s 2023 rule amendments require risk factors to be “specific to the registrant” and “organized by significance,” which aligns with the HKEX’s materiality standard. However, the SEC does not require quantitative probability and magnitude assessments, creating a potential conflict: a risk factor that is quantified for HKEX purposes may be deemed “speculative” under SEC guidance. The lawyer must include a disclaimer in the US prospectus that the quantitative assessment is “for HKEX compliance purposes only and does not constitute a prediction of future events.”

Actionable Takeaways

1. Lawyers drafting risk factors for a PRC offshore issuer must now include a documented probability and magnitude assessment for each risk factor, supported by issuer-specific data and cross-referenced to the SFC’s 2025 proposed amendments to the Code of Conduct.
2. For VIE structures, the risk factor must explicitly cite the PRC VIE Filing Rules (effective 31 March 2023) and the Supreme People’s Court’s 2023 Interpretation, and state that the CSRC filing is a condition precedent to the HKEX listing.
3. The HKEX’s Listing Decision LD143-2024 requires PRC-specific risk factors for Chapter 19C secondary listings, including mandatory disclosure of data localization risks under the Data Security Law and the Personal Information Protection Law.
4. Any risk factor based on a PRC legal opinion must include independent analysis of the underlying legal uncertainty, following the precedent set by the SFC’s 2023 enforcement action against Sponsor X.
5. For US-HK dual listings, the lawyer must include a cross-border compliance disclaimer in the US prospectus to avoid conflict between the SEC’s prohibition on speculative risk factors and the HKEX’s quantitative disclosure requirements.