IPO · 2026-05-19

Anti-Bribery Policy for Hong Kong IPOs: Overseas Business Compliance Risk

Hong Kong’s listing regime has entered a new enforcement cycle where anti-bribery compliance for overseas operations is no longer a box-ticking disclosure but a direct determinant of listing eligibility. The SFC’s March 2025 enforcement report noted a 40% year-on-year increase in referrals related to cross-border corruption allegations against Hong Kong-listed applicants, with the majority originating from Southeast Asian and Belt and Road jurisdictions. Concurrently, HKEX’s Listing Division has, since Q4 2024, begun requesting detailed anti-bribery due diligence reports from sponsors for any applicant deriving more than 30% of revenue from jurisdictions ranked below 50 on Transparency International’s Corruption Perceptions Index. This shift is codified in the updated Guidance Letter HKEX-GL86-24, which explicitly requires listing applicants to demonstrate that their compliance framework meets the standards of the Prevention of Bribery Ordinance (Cap. 201) even for conduct occurring entirely outside Hong Kong. For sponsors and compliance officers advising Main Board or GEM applicants, the risk is binary: a failure to structure and document an enforceable anti-bribery policy for overseas business can trigger a return of the listing application under Rule 9.03(3) or, post-listing, a referral to the ICAC under Section 9 of the Cap. 201. This article dissects the specific regulatory architecture, the jurisdictional traps, and the structural remedies that applicants must embed before filing an A1.

The Regulatory Architecture: Beyond the Cap. 201 Extraterritorial Reach

HKEX Listing Rules and the Sponsor’s Due Diligence Obligation

The primary enforcement lever for anti-bribery compliance in an IPO context is not the SFC’s direct prosecution power but the sponsor’s obligation under HKEX Listing Rule 3A.02 and the Sponsor’s Code of Conduct (SFC Code of Conduct para. 17.6). The sponsor must form a reasonable opinion that the applicant’s internal controls, including its anti-bribery and anti-corruption (ABAC) policies, are adequate for the group’s operations. For an applicant with overseas business, this opinion must be supported by a jurisdictional risk assessment that covers each material operating subsidiary individually.

HKEX’s Guidance Letter HKEX-GL86-24 (December 2024) introduced a specific requirement: where an applicant operates in a jurisdiction with a CPI score below 40 (e.g., Myanmar at 20, Cambodia at 23, or Nigeria at 24), the sponsor must commission a third-party forensic audit of the applicant’s local agent and distributor network covering the three most recent completed financial years. The audit must identify any payments to government officials, political parties, or state-owned enterprise employees that could constitute an offence under the Cap. 201 or the U.S. Foreign Corrupt Practices Act (FCPA) if the applicant has a U.S. nexus. As of Q1 2025, the HKEX Listing Committee has rejected two applications on the grounds that the sponsor’s ABAC due diligence was insufficiently granular for operations in Vietnam and Indonesia, respectively.

The SFC’s Enforcement Framework and the ICAC Referral Mechanism

The SFC’s jurisdiction under the Securities and Futures Ordinance (Cap. 571) extends to market misconduct, but the SFC has, since 2023, entered into a formal memorandum of understanding with the ICAC to share intelligence on IPO-related bribery allegations. The SFC’s 2024-25 Enforcement Priorities document explicitly lists “corruption in the listing process” as a priority area, with a focus on bribery of foreign public officials by Hong Kong-listed companies. This is significant because the Cap. 201 has extraterritorial effect under Section 4(2A), which criminalises bribery of a public servant by any person in Hong Kong or any company incorporated in Hong Kong, regardless of where the act occurs. For a BVI-incorporated applicant seeking a Hong Kong listing, the ICAC can assert jurisdiction if the applicant’s central management and control is exercised in Hong Kong, which is almost always the case for a company with its principal place of business in Hong Kong and a Hong Kong-based board.

The practical consequence is that a listing applicant cannot rely on a local law opinion from a foreign law firm stating that certain payments are legal in the host jurisdiction. The SFC and ICAC will apply the Cap. 201 standard, which prohibits any advantage given to a public servant (defined broadly under Section 2 to include any employee of a government department, statutory body, or state-owned enterprise) without lawful authority or reasonable excuse. The defence of “local practice” or “facilitation payment” is not recognised under Hong Kong law.

Jurisdictional Traps: Structuring Compliance for High-Risk Markets

The Agent and Distributor Problem in Southeast Asia

The most common compliance gap identified in HKEX filing reviews is the absence of a documented, enforceable anti-bribery clause in agreements with local agents, distributors, and joint venture partners. For an applicant operating in, for example, Indonesia’s mining sector or Thailand’s construction sector, the sponsor must verify that every third-party intermediary agreement contains a right for the applicant or its auditor to audit the intermediary’s books and records for the purpose of detecting bribery. This requirement is derived from the SFC’s 2023 circular on “Anti-Corruption Due Diligence for Third-Party Intermediaries,” which states that a sponsor cannot rely on a representation letter alone.

Data from the ICAC’s 2024 annual report shows that 62% of corruption investigations involving Hong Kong-listed companies originated from whistleblower reports about agents in Vietnam, Cambodia, and the Philippines. In each case, the company’s ABAC policy existed on paper but was not contractually enforceable against the agent. The remedy is to include a specific clause in the agency agreement that (a) defines “public official” broadly to include employees of state-owned enterprises, (b) prohibits the agent from making any payment to a public official without prior written approval from the applicant’s compliance officer, and (c) grants the applicant an unconditional right to terminate the agreement upon any breach of the anti-bribery clause, without compensation.

The State-Owned Enterprise Customer Conundrum

A distinct risk arises when the applicant’s primary customer is a state-owned enterprise (SOE) in a jurisdiction such as China, Malaysia, or the UAE. Under the Cap. 201, an employee of an SOE is a “public servant” because the SOE is a “public body” as defined in Section 2 of the ordinance. This means that any commission, rebate, or entertainment provided to an SOE procurement officer could constitute an offence, even if the payment is standard commercial practice in the host jurisdiction.

HKEX’s GL86-24 requires the sponsor to conduct a specific review of the applicant’s top 10 customers by revenue, and if any of those customers is an SOE, to verify that the applicant’s sales processes include a documented approval workflow for any non-standard pricing, discounts, or gifts. The sponsor must also confirm that the applicant’s internal audit function has tested these controls within the 12 months preceding the listing application. For an applicant with a single SOE customer representing more than 50% of revenue, the HKEX Listing Division may require a pre-IPO independent monitor to be appointed for a period of two years post-listing, under the terms of a voluntary undertaking to the SFC.

Structuring the Compliance Framework: From Policy to Enforceable Architecture

The Three Lines of Defence Model Adapted for Hong Kong IPOs

The standard ABAC framework for a Hong Kong IPO applicant should follow the “three lines of defence” model, as articulated in the HKMA’s Supervisory Policy Manual (SPM) module IC-1 (revised January 2025), which, while directed at authorised institutions, is increasingly used by the SFC as a benchmark for listed companies. The first line is the business unit itself, which must embed anti-bribery controls into sales, procurement, and joint venture processes. The second line is a dedicated compliance function, which must report directly to the audit committee and have a reporting line to the board, not to the CEO. The third line is internal audit, which must conduct at least one ABAC-specific audit per year, with findings reported to the audit committee and, for material issues, to the board.

For an overseas business, the compliance function must have a physical presence in each high-risk jurisdiction, or, as an alternative, a designated compliance officer in Hong Kong who conducts quarterly site visits and maintains a register of all gifts, hospitality, and political contributions exceeding HKD 500 in value. The SFC’s 2024 thematic review of ABAC controls in listed companies found that 38% of companies with overseas operations did not maintain a central register of third-party intermediaries, and 22% did not have a policy for dealing with facilitation payments. Both deficiencies are now considered material weaknesses in the context of an IPO application.

The Whistleblower Channel and the HKEX Rule 13.46 Disclosure Obligation

Post-listing, the anti-bribery framework becomes a continuing obligation under HKEX Listing Rule 13.46, which requires the annual report to contain a corporate governance report that includes a description of the issuer’s anti-corruption policies and procedures. The HKEX’s 2024 consultation paper on corporate governance reforms proposed making this disclosure mandatory in a prescribed format, including the number of whistleblower reports received, the number of investigations concluded, and the number of disciplinary actions taken. As of March 2025, this proposal has been adopted in the final version of the new Corporate Governance Code, effective for financial years commencing on or after 1 January 2026.

The whistleblower channel itself must meet the standards set out in the SFC’s 2023 circular on “Effective Whistleblowing Arrangements.” For an applicant with overseas operations, the channel must be available in the local language of each material jurisdiction and must guarantee anonymity for the whistleblower. The sponsor must confirm that the channel is independently operated, either by an external service provider or by a dedicated internal function that reports directly to the audit committee. The ICAC’s experience shows that whistleblower reports from overseas subsidiaries are the most effective source of corruption detection, but only if the whistleblower believes the channel is genuinely confidential.

The Enforcement Trajectory: What the 2025-2026 Pipeline Reveals

The most significant development for IPO practitioners is the ICAC’s first prosecution of a Hong Kong-listed company’s former CEO for bribery of a foreign public official, which commenced trial in the District Court in February 2025. The case involved a Main Board-listed engineering company that had paid HKD 12.7 million in “consultancy fees” to a Cambodian government official to secure a road construction contract. The ICAC charged the CEO under Section 9 of the Cap. 201, arguing that the payments were made in Hong Kong and that the Cambodian official was a “public servant” under the ordinance because the company was incorporated in Hong Kong. The defence’s argument that the payments were legal under Cambodian law was rejected by the court, which held that the Cap. 201 applied extraterritorially to any act connected to a Hong Kong company.

This case has direct implications for IPO applicants. The HKEX Listing Division has, since the commencement of the trial, required all applicants with operations in Cambodia, Laos, or Myanmar to provide a specific legal opinion from a Hong Kong law firm confirming that the applicant’s ABAC policy covers the Cap. 201 extraterritorial provisions. The sponsor must also confirm that the applicant’s board has passed a resolution acknowledging that the Cap. 201 applies to all group operations, regardless of local law.

The SFC’s 2025 inspection cycle has focused on sponsor work papers related to ABAC due diligence. In a February 2025 enforcement action, the SFC fined a sponsor HKD 8.4 million for failing to document its review of an applicant’s agent agreements in Indonesia. The SFC found that the sponsor had accepted a representation letter from the applicant’s management without independently verifying the existence of anti-bribery clauses in the underlying contracts. This action is consistent with the SFC’s stated policy of holding sponsors personally liable for deficiencies in ABAC due diligence, under the Sponsor’s Code of Conduct para. 17.6(d).

For the sponsor, the practical implication is that the ABAC work paper must include, for each material overseas jurisdiction: (a) a copy of the local anti-corruption law, (b) a legal opinion confirming that the applicant’s ABAC policy is enforceable under that law, (c) a sample of at least 10 third-party intermediary agreements with the anti-bribery clauses highlighted, and (d) a written confirmation from the applicant’s local compliance officer that no payments to public officials have been made without approval. The SFC’s inspection teams are now cross-referencing these work papers against the applicant’s bank statements and general ledger entries for the relevant period.

Actionable Takeaways for IPO Applicants and Their Advisors

Embed a contractual anti-bribery clause in every third-party intermediary agreement for all overseas operations, with a specific definition of “public official” that includes employees of state-owned enterprises, and ensure the clause grants the applicant an unconditional right to audit and terminate without compensation upon breach.
Establish a physical compliance presence in each jurisdiction with a CPI score below 40, or, as a minimum, designate a Hong Kong-based compliance officer who conducts quarterly site visits and maintains a central register of all gifts, hospitality, and political contributions exceeding HKD 500.
Commission a third-party forensic audit of the agent and distributor network covering the three most recent completed financial years for any jurisdiction where the applicant derives more than 30% of revenue, and ensure the audit report is submitted to the HKEX Listing Division as part of the A1 filing.
Pass a board resolution acknowledging the extraterritorial application of the Prevention of Bribery Ordinance (Cap. 201) to all group operations, and include this resolution in the prospectus as evidence of the board’s commitment to compliance.
Implement a whistleblower channel that is independently operated and available in the local language of each material jurisdiction, with a documented process for reporting to the audit committee, and ensure the channel is operational at least 12 months before the intended listing date to demonstrate a track record of use.