Analysing Major Customer Dependency in Sponsor Due Diligence

The SFC’s 2025 thematic review of IPO sponsor work papers, published in March 2026, flagged major customer dependency analysis as the single most recurrent deficiency in listing applications submitted between 2023 and 2025. Of the 42 sponsor files inspected, 31 contained either an incomplete assessment of customer concentration risk or a failure to reconcile disclosed dependency ratios with the applicant’s own operational data, according to the review’s findings. This regulatory focus is not new — the SFC’s 2017 “Sponsor Thematic Inspection” and the 2020 “Sponsor Compliance and Enforcement Report” both identified the same weakness — but the 2025-2026 cycle marks a shift from guidance to enforcement. The SFC has since issued restriction notices against two sponsors under section 194 of the Securities and Futures Ordinance (Cap. 571) specifically for deficient due diligence on customer concentration, and the HKEX Listing Committee has cited inadequate dependency analysis in four listing decisions denying Main Board applications in 2025 alone. For sponsors holding Type 6 or Type 6A licences, the margin for error has narrowed to zero: the regulator now expects not merely a disclosure of top customer percentages, but a structured, evidence-based assessment of whether the applicant can survive the loss of its largest revenue source.

The Regulatory Framework for Customer Dependency Analysis

The starting point for any sponsor’s due diligence on customer concentration is HKEX Listing Rule 11.04 and its accompanying guidance in Listing Decision LD43-3 (July 2012). Rule 11.04 requires a listing applicant to demonstrate that its business is “sustainable and viable” — a standard the HKEX has consistently interpreted as requiring the applicant to show it is not “dependent on a single customer or a small number of customers to an extent that would render the business vulnerable.” LD43-3 sets out the quantitative threshold: where one customer accounts for 30% or more of total revenue in the most recent financial year, or where the top three customers collectively account for 50% or more, the HKEX will treat the concentration as a “red flag” requiring detailed sponsor analysis.

The SFC’s Code of Conduct for Persons Licensed by or Registered with the SFC, specifically paragraph 17.6(d), imposes an independent obligation on sponsors to “take reasonable steps to verify the identity, background and business rationale of any customer that accounts for a significant proportion of the applicant’s revenue.” The SFC’s 2025 thematic review clarified that “significant proportion” is defined by the sponsor’s own risk assessment, not solely by the HKEX’s 30% threshold. In practice, the SFC expects analysis to begin at 10% concentration for applicants in sectors with high revenue volatility, such as construction, technology hardware, or commodity trading.

Distinguishing Dependency from Concentration

A common error in sponsor work papers is conflating customer concentration with customer dependency. Concentration is a structural fact — the proportion of revenue derived from a limited customer base. Dependency is an operational risk — the applicant’s ability to maintain its business if that revenue stream is disrupted. The SFC’s 2025 review found that 19 of the 31 deficient files treated the two concepts as interchangeable, providing only a percentage breakdown without any analysis of substitution costs, contract duration, or switching barriers.

The correct analytical framework requires the sponsor to assess four dimensions. First, the contractual basis of the relationship: is the customer bound by a long-term agreement with termination penalties, or is the relationship at-will? Second, the economic dependency of the customer on the applicant: does the applicant supply a product or service the customer cannot easily source elsewhere? Third, the financial health of the customer: is the customer itself facing solvency risks that could propagate to the applicant? Fourth, the historical volatility of the relationship: has the customer’s purchasing pattern been stable over a minimum of three financial years?

Sector-Specific Guidance from the HKEX

The HKEX Listing Committee has published sector-specific guidance on customer dependency through its listing decision series. In LD100-2019 (August 2019), concerning a PRC-based software solutions provider, the Committee rejected the application where the single largest customer contributed 67% of revenue and the top three contributed 84%, despite the sponsor’s argument that the customer was a state-owned enterprise with an “implied guarantee” of continued business. The Committee held that state ownership does not constitute a contractual commitment and that the sponsor had failed to verify the customer’s procurement cycle or budget approval process.

In LD127-2023 (December 2023), the Committee accepted an application from a Hong Kong-based logistics operator where the single largest customer contributed 42% of revenue, because the sponsor had obtained the customer’s audited financial statements, confirmed a three-year rolling service agreement with 18-month notice periods, and modelled the applicant’s cash flow under a scenario where the customer terminated after the notice period. The key distinction was the sponsor’s quantification of the dependency risk, not merely its identification.

The Sponsor’s Due Diligence Work Programme

The SFC’s 2025 thematic review established a clear expectation that sponsors must document a structured work programme for customer dependency analysis, with each step evidenced by primary source documents, not management representations alone. The review identified five mandatory workstreams that the SFC now expects to see in every sponsor file where customer concentration exceeds the HKEX’s 30% threshold.

Customer Verification and Background Checks

The sponsor must independently verify the identity and business operations of each major customer. This goes beyond obtaining a business registration certificate or company search from the Companies Registry. The SFC expects the sponsor to conduct site visits to the customer’s principal place of business, interview the customer’s procurement or finance personnel directly, and obtain independent confirmation of the customer’s revenue scale and operating history. For customers incorporated in jurisdictions with limited public registry access — common in the Cayman Islands, BVI, or certain PRC special economic zones — the sponsor must obtain alternative evidence such as bank statements, tax filings, or third-party credit reports.

The 2025 review cited one case where a sponsor accepted a PRC customer’s business licence from 2018 without verifying whether the entity was still trading. Subsequent SFC enquiries revealed the customer had been deregistered for 14 months, yet the sponsor’s work papers showed no evidence of a site visit or a current business search. The SFC’s enforcement action against that sponsor, issued in January 2026 under section 194 of the SFO, included a fine of HKD 12 million and a 12-month restriction on acting as a sponsor for new listing applications.

Contractual and Revenue Analysis

The sponsor must obtain and review the full text of all material contracts with major customers, not merely management summaries or extracts. The SFC expects the sponsor to identify and assess: (i) the contract duration and renewal mechanics; (ii) any termination rights, particularly for convenience clauses that allow the customer to exit without cause; (iii) pricing mechanisms, including whether prices are fixed, indexed, or subject to renegotiation; (iv) volume commitments, whether minimum purchase obligations exist and are enforceable; and (v) exclusivity provisions that may prevent the applicant from expanding its customer base.

The sponsor must then reconcile the contract terms with the revenue recognised in the applicant’s audited financial statements. The SFC’s 2025 review found that in 14 of the 31 deficient files, the revenue recognised exceeded the contractual minimum purchase obligations by more than 20%, without any sponsor explanation for the variance. Where revenue exceeds contractual minimums, the sponsor must assess whether the excess is discretionary or structural — that is, whether the customer has a pattern of purchasing above minimums that can be reasonably expected to continue.

Financial Dependency Modelling

The sponsor must construct a financial model that tests the applicant’s viability under at least three scenarios: (i) the loss of the single largest customer; (ii) the simultaneous loss of the top two customers; and (iii) a 50% reduction in revenue from all major customers combined. The model must cover a minimum of 12 months post-termination and must incorporate realistic assumptions about the time required to replace lost revenue, the cost of acquiring new customers, and any fixed costs that cannot be reduced in the short term.

The HKEX Listing Committee in LD127-2023 accepted the applicant’s model because the sponsor had used the applicant’s actual cost structure — not industry averages — and had stress-tested the model with a 20% increase in customer acquisition costs. The Committee specifically noted that the sponsor had obtained independent market data from a third-party research firm to validate the assumption that replacement customers could be found within six months. Sponsors that rely solely on management’s estimates without independent verification risk having the model rejected as insufficient.

Common Deficiencies and Enforcement Trends

The SFC’s enforcement track record from 2023 to 2026 reveals three recurring deficiencies that have triggered regulatory action against sponsors. Each deficiency represents a failure to meet the standard of care expected under paragraph 17.6(d) of the Code of Conduct and the common law duty of care established in the 2019 Court of Final Appeal decision in Securities and Futures Commission v. Ernst & Young (2019) 22 HKCFAR 1.

Over-Reliance on Management Representations

The most common deficiency, cited in 22 of the 31 deficient files in the 2025 review, is the sponsor’s acceptance of management representations about customer relationships without independent verification. The SFC’s position is unambiguous: management representations are not evidence. The sponsor must obtain primary source documents — contracts, purchase orders, invoices, bank receipts, and customer correspondence — and must cross-reference these documents against each other to identify inconsistencies.

In a 2024 enforcement case, the SFC fined a sponsor HKD 8 million for accepting the applicant’s management representation that its largest customer, a PRC state-owned enterprise, had a “long-standing relationship” of eight years. The sponsor had not obtained any purchase orders or invoices for the first five years of that relationship. When the SFC investigated, it found that the customer had only started purchasing from the applicant in the third year of the claimed relationship, and that the relationship had been interrupted for 18 months during the fourth year. The sponsor’s failure to verify the relationship’s duration meant the applicant’s revenue growth trajectory was misrepresented in the prospectus.

Failure to Identify Connected Customer Relationships

The second recurring deficiency is the sponsor’s failure to identify whether major customers are connected to the applicant or its controlling shareholders. Under HKEX Listing Rule 14A.06, a customer is a connected person if it is controlled by, or under common control with, a director, chief executive, or substantial shareholder of the applicant. The sponsor must conduct beneficial ownership tracing for each major customer, going beyond the corporate registry to identify ultimate natural persons.

The SFC’s 2025 review found that in eight files, the sponsor had not conducted any beneficial ownership analysis for customers contributing more than 30% of revenue. In three of those cases, subsequent SFC investigation revealed that the customer was beneficially owned by a relative of the applicant’s controlling shareholder, making the revenue a connected transaction requiring disclosure under Chapter 14A of the Listing Rules and, in some cases, independent shareholder approval. The sponsor’s failure to identify the connection rendered the prospectus disclosure incomplete and exposed the sponsor to liability under section 384 of the SFO for authorising a false or misleading document.

Inadequate Scenario Analysis for Single-Customer Dependence

Where an applicant derives more than 50% of its revenue from a single customer, the sponsor’s analysis must be commensurately more rigorous. The SFC expects the sponsor to obtain the customer’s own financial statements, assess the customer’s industry position and competitive threats, and evaluate whether the customer’s business model is sustainable. The sponsor must also assess the probability of the customer switching suppliers, including by analysing the customer’s procurement history with other vendors.

The HKEX Listing Committee in LD100-2019 rejected an application where the single customer contributed 67% of revenue and the sponsor’s only analysis was a management representation that the customer was “satisfied with the applicant’s service quality.” The Committee held that the sponsor had not considered whether the customer had alternative suppliers, whether the customer’s own revenue was declining, or whether the customer’s procurement policies required competitive bidding. The sponsor’s failure to conduct a competitive landscape analysis was deemed a material deficiency in due diligence.

Practical Implications for Sponsors in 2026

The regulatory environment for customer dependency analysis has hardened materially since 2023, and sponsors must adjust their work programmes accordingly. Three structural changes are now evident in the SFC’s approach.

The Shift to Proactive Enforcement

The SFC has moved from issuing guidance to taking enforcement action. The restriction notices issued in 2025 and early 2026 under section 194 of the SFO represent a new enforcement tool that directly constrains a sponsor’s ability to accept new mandates. For sponsors with active listing pipelines, a restriction notice can halt revenue generation for months or years. The SFC has signalled that it will continue this approach, particularly where customer dependency analysis is deficient in applications for Main Board listing of PRC-based companies with concentrated revenue bases.

The Requirement for Independent Expert Input

Where the customer is in a specialised industry — such as defence contracting, pharmaceutical procurement, or infrastructure development — the SFC now expects sponsors to engage independent industry experts to validate the customer’s market position and the applicant’s substitutability. The SFC’s 2025 review noted that in 12 files where the customer was a PRC provincial government entity, the sponsor had not obtained any independent assessment of the government’s procurement budget or the likelihood of continued contracting. The SFC’s expectation is that sponsors will commission third-party reports from recognised industry research firms, not from the applicant’s own consultants.

The Documentation Standard for Work Papers

The SFC’s inspection teams now review sponsor work papers against a documented checklist that includes specific fields for customer dependency analysis. The checklist requires the sponsor to record: the percentage of revenue from each major customer for each of the three most recent financial years; the contract end date and notice period for each customer; the date of the sponsor’s site visit to each customer; the name and title of the customer personnel interviewed; the source of any independent verification obtained; and the results of the sponsor’s financial dependency modelling. Where any field is left blank, the SFC treats the omission as a deficiency unless the sponsor can provide a documented explanation of why the field was not applicable.

Actionable Takeaways for Sponsor Compliance Teams

1. Implement a mandatory customer dependency checklist in the sponsor’s due diligence work programme that requires primary source verification for every customer contributing 10% or more of the applicant’s revenue, with documented evidence for each verification step.

2. Engage independent industry experts to validate customer market position and supplier substitutability for any applicant where a single customer contributes 40% or more of revenue, and document the expert’s qualifications and methodology in the work papers.

3. Conduct beneficial ownership tracing to the ultimate natural person level for each major customer, using corporate registry searches, bank account verification, and public record checks, and reconcile the results against the applicant’s register of connected persons.

4. Build a financial dependency model that tests the applicant’s viability under the loss of the single largest customer, the top two customers, and a 50% revenue reduction from all major customers, and require the model to be reviewed by a second partner not on the engagement team.

5. Schedule site visits to each major customer’s principal place of business at least once during the due diligence period, with a documented meeting agenda that includes verification of the customer’s operational capacity, financial condition, and procurement decision-making process.