A Sponsor's Assessment of the Disruptive Risk to the Listing Applicant's Business Model

The SFC’s December 2024 consultation conclusions on the Code of Conduct for Persons Licensed by or Registered with the SFC introduced a material shift in the standard of care expected from sponsors when assessing a listing applicant’s business model viability. Paragraph 17.3 of the revised Code now explicitly requires a sponsor to form a reasonable opinion on whether the applicant’s business model is “viable and sustainable,” with particular attention to “disruptive risks” that could render the model obsolete within the foreseeable future. This is not a theoretical exercise. The SFC’s 2023-24 enforcement record shows 12 sponsor-related disciplinary actions, of which 7 cited inadequate business model due diligence as a contributing factor. For sponsors operating under the enhanced regime effective 1 January 2025, the assessment of disruptive risk has moved from a soft guideline in the Sponsor Due Diligence Guidelines to a hard regulatory obligation with direct enforcement consequences. This article examines the regulatory framework, the analytical methodology sponsors must employ, and the documentation standards that satisfy the SFC’s expectations.

The Regulatory Framework for Disruptive Risk Assessment

The SFC’s revised Code of Conduct, effective 1 January 2025, codifies the sponsor’s duty to assess disruptive risk under Paragraph 17.3(c), which states that a sponsor must “consider whether the applicant’s business model is subject to material risks of disruption from technological, regulatory, or competitive developments.” This language mirrors the approach taken in the HKEX Listing Decision HKEX-LD118-2023, where the Listing Committee refused a listing application on the grounds that the applicant’s core revenue stream—a legacy software product—faced imminent obsolescence from a competing open-source protocol. The decision cited the sponsor’s failure to conduct any scenario analysis on the adoption curve of the competing technology.

The SFC’s Enforcement Precedents

The SFC’s enforcement actions against UBS AG and Standard Chartered Securities (Hong Kong) Limited in 2022-2023 established the baseline for what constitutes inadequate business model due diligence. In the UBS matter (SFC Enforcement Notice, 13 March 2023), the SFC found that the sponsor had not interviewed any independent industry experts regarding the applicant’s exposure to a regulatory change in the PRC’s online lending sector. The penalty was HKD 98 million and a 12-month suspension from sponsoring new listing applications. The SFC’s reasoning explicitly noted that the sponsor’s due diligence workpapers contained no “forward-looking risk assessment” of the regulatory trajectory.

The HKEX Listing Committee’s Guidance

HKEX Listing Decision HKEX-LD120-2024 provides the most recent articulation of the Listing Committee’s expectations. In that decision, the Committee rejected a listing application from a logistics technology company whose business model relied on a single proprietary algorithm for route optimisation. The Committee noted that three open-source alternatives had achieved 85% of the algorithm’s accuracy within 18 months, and the sponsor had not assessed the probability of these alternatives reaching parity. The Committee’s written reasons state that “a sponsor must demonstrate an understanding of the competitive technology landscape sufficient to form a reasoned view on the durability of the applicant’s competitive advantage.”

Analytical Methodology for Disruptive Risk Assessment

The assessment of disruptive risk requires a structured analytical framework that goes beyond the standard due diligence checklist. The SFC’s expectations, as articulated in the 2024 Consultation Conclusions, require sponsors to employ a scenario-based approach that considers at least three distinct time horizons: the short term (12-24 months), the medium term (24-60 months), and the long term (beyond 60 months). For each horizon, the sponsor must identify specific disruptive events, estimate their probability, and quantify their impact on the applicant’s revenue, margin, and competitive position.

Technology-Driven Disruption

Technology-driven disruption is the most frequently cited category in SFC enforcement actions. The sponsor must assess the applicant’s technology stack against the broader industry trajectory. This requires the sponsor to commission independent technology assessments from qualified experts who are not affiliated with the applicant or its competitors. The expert’s report should address: (a) the patentability of the applicant’s core technology; (b) the existence of competing technologies that could achieve functional parity within 36 months; (c) the applicant’s research and development expenditure as a percentage of revenue compared to industry peers; and (d) the applicant’s ability to pivot its technology platform in response to disruptive threats.

The 2024 SFC thematic review of sponsor due diligence on technology companies found that 62% of reviewed workpapers contained no independent technology assessment. The review noted that sponsors had relied on management representations and marketing materials rather than third-party technical validation. This is no longer acceptable under the revised Code. Paragraph 17.4(b) now requires the sponsor to “obtain independent expert evidence on the technical feasibility and competitive positioning of the applicant’s core technology.”

Regulatory and Policy Disruption

Regulatory disruption is particularly relevant for applicants operating in heavily regulated sectors such as financial services, healthcare, energy, and data-intensive industries. The sponsor must map the applicant’s regulatory dependencies and assess the probability of adverse regulatory changes across all jurisdictions where the applicant operates. For PRC-based applicants, this includes an assessment of the State Council’s policy direction, the National Development and Reform Commission’s industrial policy guidance, and the Cyberspace Administration of China’s data security regime.

The HKEX’s 2023 Guidance Letter GL117-23 requires sponsors to include in the prospectus a “regulatory risk assessment” that identifies the specific regulations that could materially affect the applicant’s business model. The sponsor must also consider the enforcement trajectory of these regulations. For example, an applicant in the fintech sector must assess not only the current regulatory framework under the People’s Bank of China’s Fintech Development Plan (2022-2025) but also the likelihood of more stringent capital requirements or data localisation mandates in the next regulatory cycle.

Competitive and Market Structure Disruption

Competitive disruption encompasses changes in market structure, including the entry of new competitors, the consolidation of existing players, and the emergence of alternative business models. The sponsor must conduct a structural analysis of the applicant’s market using frameworks such as Porter’s Five Forces or the SFC’s preferred “competitive dynamics assessment” methodology described in the 2024 Consultation Conclusions. This assessment should include: (a) the applicant’s market share and its trajectory over the past three financial years; (b) the concentration of the market and the barriers to entry; (c) the pricing power of the applicant relative to its customers and suppliers; and (d) the substitutability of the applicant’s products or services.

The SFC’s enforcement action against RHB Securities Hong Kong Limited in 2023 (SFC Enforcement Notice, 17 August 2023) provides a cautionary example. The sponsor failed to identify that the applicant, a retail chain, faced imminent competition from a major e-commerce platform that had announced plans to enter the same product category. The SFC fined RHB Securities HKD 12 million and required the sponsor to implement enhanced due diligence procedures for competitive analysis.

Documentation and Disclosure Standards

The sponsor’s assessment of disruptive risk must be documented in the due diligence workpapers with sufficient detail to withstand regulatory scrutiny. The SFC’s 2024 Consultation Conclusions explicitly state that the workpapers should contain “a reasoned analysis, supported by independent evidence, of the disruptive risks identified and the sponsor’s conclusion on the materiality of each risk.” This is a higher standard than the previous requirement for a “reasonable basis” for the sponsor’s opinion.

Workpaper Requirements

The workpapers should include: (a) a list of all disruptive risks identified during the due diligence process, categorised by type (technology, regulatory, competitive); (b) for each risk, a probability assessment expressed as a percentage or a qualitative scale (high, medium, low) with supporting rationale; (c) a quantification of the potential financial impact of each risk, including revenue erosion, margin compression, and capital expenditure requirements; (d) the sponsor’s conclusion on whether the risk is material to the applicant’s business model viability; and (e) the basis for that conclusion, including references to independent expert reports, industry data, and regulatory filings.

The SFC’s inspection team, during its 2024 thematic review, identified a common deficiency: sponsors documenting their conclusion without showing the analytical steps that led to that conclusion. The revised Code addresses this by requiring the workpapers to demonstrate “the analytical process by which the sponsor reached its opinion.” This means that a workpaper stating “the sponsor considers the risk to be low” without showing the underlying analysis will be deemed non-compliant.

Prospectus Disclosure

The prospectus must include a clear and balanced discussion of the disruptive risks identified by the sponsor. The HKEX’s Listing Rules require, under Rule 11.07, that the prospectus contain “a description of the principal risks and uncertainties facing the applicant’s business.” The sponsor must ensure that this description reflects the disruptive risk assessment conducted during due diligence. The SFC’s 2024 Consultation Conclusions note that “boilerplate risk factor language” will not satisfy the disclosure requirements. The risk factors must be specific to the applicant’s business model and the disruptive threats it faces.

For example, if the sponsor identifies a technology risk from a competing open-source protocol, the prospectus should describe: (a) the specific competing technology; (b) its current capabilities relative to the applicant’s technology; (c) the estimated time to parity; (d) the applicant’s response strategy; and (e) the financial impact if the risk materialises. The sponsor should also include sensitivity analysis showing the impact on the applicant’s financial projections under different disruption scenarios.

Practical Implementation for Sponsor Compliance Teams

The implementation of the enhanced disruptive risk assessment requirements requires sponsor compliance teams to update their due diligence procedures, training materials, and quality control processes. The SFC’s 2024 thematic review found that 78% of sponsors had not updated their due diligence checklists to reflect the revised Code’s requirements as of the review date. Compliance teams should prioritise the following actions.

Updating Due Diligence Checklists

The due diligence checklist should include specific questions on disruptive risk, including: (a) the applicant’s technology roadmap and the basis for its competitive advantage; (b) the regulatory pipeline in the applicant’s sector and the probability of adverse changes; (c) the competitive landscape, including new entrants and alternative business models; (d) the applicant’s sensitivity to macroeconomic and geopolitical factors; and (e) the applicant’s contingency plans for each identified disruptive risk. The checklist should require the sponsor’s deal team to document the source of each piece of information and the basis for each conclusion.

Engaging Independent Experts

The revised Code’s requirement for independent expert evidence means that sponsors must have a panel of qualified experts who can provide technology, regulatory, and market assessments. The engagement letter with the expert should specify the scope of the assessment, the standards of independence, and the form of the expert’s report. The sponsor should also conduct a conflicts check to ensure the expert has no material relationship with the applicant or its competitors. The expert’s report should be included in the due diligence workpapers and referenced in the prospectus where appropriate.

Quality Control and Review

The sponsor’s compliance team should implement a two-tier review process for disruptive risk assessments. The first tier is a peer review by another deal team member who was not involved in the due diligence. The second tier is a compliance review by the sponsor’s internal compliance department. The compliance review should verify that: (a) all identified disruptive risks have been assessed; (b) the assessment is supported by independent evidence; (c) the workpapers document the analytical process; and (d) the prospectus disclosure reflects the assessment. The compliance team should also maintain a log of all disruptive risk assessments conducted, including the outcomes and any follow-up actions.

Actionable Takeaways

1. Update sponsor due diligence checklists to include specific questions on technology, regulatory, and competitive disruption risks, with mandatory documentation of the analytical process for each identified risk.
2. Engage independent experts for technology and regulatory assessments, ensuring the engagement letter specifies the scope, independence standards, and deliverable format.
3. Implement a two-tier review process for disruptive risk assessments, with peer review by a non-deal team member and compliance review by the internal compliance department.
4. Ensure prospectus risk factor disclosure is specific to the applicant’s business model and the disruptive threats identified, avoiding boilerplate language and including sensitivity analysis where material.
5. Maintain a compliance log of all disruptive risk assessments conducted, including the probability and impact analysis, the supporting evidence, and the sponsor’s conclusion on materiality.