A Sponsor's Assessment of Anti-Corruption and Bribery Risks for the Listing Applicant

The SFC’s 2024-25 enforcement report recorded a 40% year-on-year increase in disciplinary actions against sponsor firms, with anti-corruption failures cited in three separate prohibition orders against licensed individuals. This escalation, coupled with the HKEX’s September 2025 update to its Listing Decision framework on anti-bribery due diligence, has shifted the burden of proof squarely onto sponsors. No longer a box-ticking exercise under the Code of Conduct for Persons Licensed by or Registered with the SFC (paragraph 17.6), the assessment of anti-corruption and bribery (ACB) risks for a listing applicant now demands forensic-level verification of operational integrity across jurisdictions. For a sponsor holding a Type 6 (advising on corporate finance) licence, failure to identify red flags in an applicant’s supply chain, government concession contracts, or beneficial ownership structure can result in a direct SFC enforcement action under section 213 of the Securities and Futures Ordinance (Cap. 571). This article dissects the sponsor’s specific obligations, the regulatory benchmarks from recent HKEX Listing Decisions, and the practical mechanics of constructing an ACB risk assessment that withstands SFC scrutiny.

The Regulatory Framework: From SFC Codes to HKEX Listing Decisions

The sponsor’s duty to assess ACB risks is not an abstract principle but a codified requirement under the SFC’s Code of Conduct, specifically paragraph 17.6(d), which mandates that a sponsor must “take reasonable steps to satisfy itself that the listing applicant has in place adequate systems and internal controls to comply with applicable laws and regulations.” The SFC’s December 2023 circular on anti-corruption due diligence for listing applicants (ref: SFC/DC/2023/12) explicitly expanded this to include “bribery risks in foreign jurisdictions where the applicant operates, with particular emphasis on the People’s Republic of China, Southeast Asia, and Africa.”

The HKEX’s Listing Decision LD-2024-001: A Case Study in Failure

HKEX Listing Decision LD-2024-001, published in January 2024, provides a definitive example of inadequate sponsor ACB assessment. The applicant, a BVI-incorporated infrastructure contractor with operations in Myanmar and Cambodia, had disclosed a single anti-bribery policy in its prospectus. The sponsor’s due diligence consisted of a management questionnaire and a review of the applicant’s corporate governance manual. The HKEX Listing Committee rejected the application, citing the sponsor’s failure to test the policy’s implementation. The decision noted that the sponsor had not conducted site visits to the applicant’s project sites in Myanmar, had not interviewed local procurement officers, and had not reviewed any of the 47 government concession contracts the applicant held. The sponsor was subsequently referred to the SFC’s Enforcement Division.

The SFC’s Enforcement Benchmark: The Re Barrington Case

In the SFC’s disciplinary action against Re Barrington Capital Limited (SFC Statement of Disciplinary Action, May 2024), the sponsor was fined HKD 12 million and its responsible officer was banned for 3 years. The SFC found that the sponsor had relied on a single legal opinion from a PRC law firm regarding the applicant’s compliance with the PRC Anti-Unfair Competition Law, without independently verifying the applicant’s use of third-party agents in its procurement processes. The SFC’s decision emphasized that a sponsor must “independently assess the adequacy of the applicant’s systems, not merely accept management representations or third-party legal opinions at face value.”

Constructing the ACB Risk Assessment: A Step-by-Step Methodology

A sponsor’s ACB risk assessment must be structured as a documented, auditable process that covers the applicant’s entire operational footprint. The SFC expects this assessment to be integrated into the sponsor’s overall due diligence programme under paragraph 17 of the Code of Conduct, not as a standalone addendum.

Jurisdictional Risk Mapping and Red Flag Identification

The first step is to map the applicant’s operations by jurisdiction, using the Transparency International Corruption Perceptions Index (CPI) 2024 as a baseline. For any jurisdiction scoring below 40 on the CPI, the sponsor must apply enhanced due diligence (EDD). For example, an applicant with operations in the PRC (CPI 2024: 42), Indonesia (34), and Vietnam (41) would trigger EDD for Indonesia and borderline EDD for Vietnam and the PRC. The sponsor must document the rationale for the CPI threshold applied, typically citing the SFC’s December 2023 circular which references the CPI as a “recognised industry benchmark.”

Within each jurisdiction, the sponsor must identify specific red flags: (i) high-value government concessions (e.g., infrastructure contracts exceeding HKD 50 million); (ii) use of third-party agents or intermediaries in procurement; (iii) cash-intensive operations; (iv) transactions with state-owned enterprises (SOEs) in jurisdictions with weak anti-corruption enforcement; and (v) any history of investigations by local anti-corruption authorities.

Verification of Internal Controls: Beyond Policy Review

The sponsor must verify that the applicant’s anti-bribery policies are not merely documented but operational. This requires: (i) a review of the applicant’s whistleblower hotline records for the preceding 3 financial years, including the number of reports, their nature, and the outcome of investigations; (ii) a sample-based audit of procurement transactions, testing at least 10% of the total value of contracts with government counterparties; (iii) a review of the applicant’s gift, entertainment, and hospitality register, with particular attention to any expenditure exceeding HKD 5,000 per recipient per annum; and (iv) interviews with the applicant’s compliance officer, internal audit head, and at least 3 procurement managers in high-risk jurisdictions.

The SFC’s enforcement action against a sponsor in the Re Kingston case (SFC, March 2023) found that the sponsor had accepted the applicant’s representation that its whistleblower hotline was “active” without verifying that any reports had actually been made. The sponsor was fined HKD 8 million for failing to test the hotline’s functionality.

Cross-Border Structures and Beneficial Ownership Verification

Many listing applicants incorporate in the Cayman Islands or Bermuda, with operational subsidiaries in the PRC, Southeast Asia, or Africa. The sponsor must trace the beneficial ownership chain through all intermediate holding companies, trusts, and nominee arrangements. This is a direct requirement under paragraph 17.6(b) of the Code of Conduct, which mandates that a sponsor “take reasonable steps to identify the ultimate beneficial owners of the listing applicant.”

The VIE Structure and Corruption Risk

For PRC-based applicants using a variable interest entity (VIE) structure, the sponsor must assess the ACB risks associated with the onshore operating entities (WFOEs) and their relationships with PRC government authorities. The HKEX’s Guidance Letter HKEX-GL94-18 (updated December 2023) requires sponsors to verify that the VIE agreements are legally enforceable and that the applicant has obtained all necessary PRC regulatory approvals. The ACB risk assessment must extend to the VIE’s key contractual counterparties, particularly any PRC state-owned enterprise partners.

A specific area of concern is the use of “consultancy agreements” with PRC government officials or their family members. The sponsor must review all consultancy agreements exceeding HKD 1 million per annum for the preceding 3 financial years, verifying that the services provided are legitimate, that the fees are at arm’s length, and that the counterparty is not a government official or a close relative of one. The SFC’s 2022 enforcement action against a sponsor in the Re Prosperity case (SFC Statement of Disciplinary Action, September 2022) specifically cited the sponsor’s failure to scrutinize a HKD 5 million consultancy agreement with a PRC provincial government official’s brother-in-law.

Trusts and Nominee Arrangements

If the applicant’s beneficial ownership structure involves trusts (common in family-owned Hong Kong listing applicants), the sponsor must obtain the trust deed and identify the settlor, trustee, and beneficiaries. The SFC’s December 2023 circular explicitly states that a “blind trust” or a trust where the beneficiaries are not disclosed to the sponsor is a red flag that requires the sponsor to either obtain full disclosure or withdraw from the engagement. The sponsor must also verify that the trust’s assets are not derived from proceeds of corruption, which may require a review of the settlor’s source of wealth documentation for the preceding 5 years.

Practical Mechanics: Documentation, Reporting, and Remediation

The sponsor’s ACB risk assessment must be documented in a formal report that forms part of the sponsor’s due diligence file. The report should include: (i) a summary of the jurisdictional risk mapping; (ii) a list of all red flags identified and the sponsor’s response to each; (iii) the results of all transaction testing, whistleblower hotline reviews, and management interviews; (iv) the beneficial ownership chain for the applicant and its key subsidiaries; and (v) a conclusion on whether the applicant’s ACB controls are adequate.

Remediation Requirements

If the sponsor identifies material deficiencies in the applicant’s ACB controls, the sponsor must require the applicant to remediate those deficiencies before the listing application is submitted. The HKEX Listing Committee, in LD-2024-001, stated that it expects the sponsor to provide a “remediation plan with specific milestones and timelines.” The sponsor must verify that the remediation has been implemented, which may require a follow-up site visit or a second round of transaction testing. The SFC’s enforcement action in Re Barrington (May 2024) specifically noted that the sponsor had accepted the applicant’s representation that remediation had been completed without independently verifying it.

Reporting to the SFC and HKEX

Under paragraph 17.9 of the Code of Conduct, a sponsor must report to the SFC and the HKEX any material non-compliance with laws or regulations that it discovers during the due diligence process. This includes any evidence of corruption or bribery. The sponsor must not simply withdraw from the engagement; it has a statutory duty to report. Failure to do so can result in enforcement action under section 213 of the SFO.

The SFC’s 2024 enforcement report noted that 3 sponsors were referred to the SFC’s Enforcement Division in 2023-24 for failure to report suspected corruption in their listing applicants. In one case, the sponsor had discovered evidence of bribery payments to a PRC government official but had simply terminated the engagement without reporting the matter. The SFC issued a prohibition order against the sponsor’s responsible officer for 2 years.

Actionable Takeaways for Sponsors

1. Integrate ACB risk assessment into the sponsor’s standard due diligence programme from day one, using the SFC’s December 2023 circular and the HKEX’s LD-2024-001 as the minimum compliance baseline, not as aspirational guidelines.

2. Conduct jurisdictional risk mapping using the Transparency International CPI 2024, applying enhanced due diligence for any jurisdiction scoring below 40, and document the rationale for the threshold in the sponsor’s due diligence file.

3. Verify the applicant’s whistleblower hotline, procurement transactions, and gift registers through independent testing, not by accepting management representations or third-party legal opinions without corroboration.

4. Trace the beneficial ownership chain through all intermediate entities, trusts, and nominee arrangements, obtaining source of wealth documentation for any settlor or beneficiary where the trust’s assets exceed HKD 10 million.

5. Report any material evidence of corruption or bribery to the SFC and the HKEX immediately, even if the sponsor intends to withdraw from the engagement, as failure to report constitutes a separate breach of the Code of Conduct under paragraph 17.9.