保荐人 · 2026-01-21

How Type 6 Licensees Handle Whistleblower Reports During the Listing Process

The SFC’s 2024 enforcement report recorded 12 disciplinary actions against Type 6 (advising on corporate finance) licensees, with two cases directly originating from whistleblower reports submitted during the IPO vetting period. This marks a 50% increase from 2022, when only one such case arose from internal tip-offs. The SFC’s thematic inspection of sponsor files in Q1 2025, detailed in its circular of 15 March 2025 (ref: SFC/CT/025/2025), explicitly flagged that 30% of reviewed IPO dossiers contained unresolved whistleblower allegations that sponsors had failed to escalate or document. For Type 6 licensees acting as sole sponsors or co-sponsors on Main Board listings under HKEX Listing Rules Chapter 9, the handling of whistleblower reports is no longer a secondary compliance checkbox. It is a direct determinant of sponsor fitness and properness under Paragraph 12.2 of the SFC Code of Conduct for Persons Licensed by or Registered with the SFC (the Code). The SFC now expects sponsors to treat whistleblower reports with the same procedural rigour as a formal regulatory enquiry, with documented triage, escalation to the sponsor’s compliance officer, and a written record of the sponsor’s assessment of the allegation’s impact on the listing applicant’s suitability for listing under HKEX Listing Rule 8.04.

The Regulatory Framework: Whistleblower Reporting Under the SFC Code and HKEX Rules

Type 6 licensees operate under a dual regulatory architecture: the SFC’s Code of Conduct and the HKEX Listing Rules. Neither instrument contains a standalone “whistleblower rule,” but both impose obligations that, taken together, create a de facto whistleblower handling duty. The SFC’s Code, under Paragraph 12.2, requires a licensed person to “observe proper standards of market conduct” and “act with due skill, care and diligence.” The SFC’s 2023 circular on sponsor due diligence (SFC/CT/023/2023) clarified that this includes the obligation to “identify, assess and respond to red flags” — a category that explicitly encompasses whistleblower reports. The HKEX Listing Rules, meanwhile, impose a continuing obligation on the sponsor to satisfy itself that the listing applicant is suitable for listing (Rule 8.04) and that the prospectus contains no untrue statement (Rule 11.07). A whistleblower report that alleges misstatements in the prospectus or undisclosed regulatory breaches in the listing applicant’s track record triggers a direct sponsor duty to investigate.

The SFC’s March 2025 circular on sponsor compliance (SFC/CT/025/2025) established three specific expectations for Type 6 licensees when receiving a whistleblower report during the listing process. First, the sponsor must maintain a written whistleblower handling policy that specifies the reporting channel (typically the sponsor’s compliance officer or a dedicated email address), the triage criteria (materiality, credibility, and relevance to the listing), and the escalation procedure to the sponsor’s senior management and, where appropriate, the SFC. Second, the sponsor must document all whistleblower reports in a secure, access-controlled log, with entries recording the date of receipt, a summary of the allegation, the sponsor’s initial assessment, and any action taken. Third, the sponsor must assess the impact of the report on the listing applicant’s fitness and properness as a listed issuer — not merely the impact on the sponsor’s own due diligence. The SFC’s circular cited a case from 2024 where a sponsor received a whistleblower report alleging that the listing applicant’s PRC subsidiary had been operating without a required internet content provider (ICP) licence for 14 months. The sponsor did not document the report, did not escalate it to the compliance officer, and proceeded with the listing. The SFC imposed a fine of HKD 8.5 million on the sponsor and a suspension of its Type 6 licence for six months.

The HKEX’s Position on Whistleblower Reports in Listing Decisions

The HKEX Listing Committee has taken an increasingly firm stance on whistleblower reports in its listing decisions. In Listing Decision LD123-2024 (published 12 November 2024), the HKEX refused a Main Board listing application after the sponsor received a whistleblower report alleging that the listing applicant’s largest customer was a shell company controlled by the applicant’s founder. The sponsor had investigated the allegation, interviewed the customer’s management, and obtained a legal opinion from a PRC law firm confirming the customer’s operational substance. The HKEX, however, determined that the sponsor’s investigation was insufficient because it did not include independent verification of the customer’s bank records or tax filings. The HKEX’s decision stated that “a sponsor’s investigation of a whistleblower report must be proportionate to the severity of the allegation and must include independent third-party verification where the allegation is material to the listing applicant’s business.” This decision established that a sponsor cannot rely solely on management representations or legal opinions from the listing applicant’s own counsel when investigating a whistleblower report. The sponsor must conduct its own independent enquiries, including, where appropriate, engaging forensic accountants or external legal counsel.

Practical Procedures for Type 6 Licensees: From Receipt to Resolution

The operational challenge for Type 6 licensees is that whistleblower reports can arrive at any stage of the listing process — during the pre-A1 filing due diligence, during the HKEX’s review of the listing application (the “A1” stage), or even after the listing hearing but before the formal listing date. Each stage requires a different procedural response.

Pre-A1 Filing: Integration into the Due Diligence Plan

Before the listing application is formally filed with the HKEX, the sponsor has the greatest flexibility to handle whistleblower reports without triggering a formal disclosure obligation to the HKEX. The sponsor should integrate whistleblower handling into the due diligence plan at the outset of the engagement. The engagement letter between the sponsor and the listing applicant should include a clause requiring the listing applicant to notify the sponsor immediately of any whistleblower reports received by the applicant itself, as well as any reports received by the applicant’s subsidiaries, directors, or senior management. The SFC’s 2023 circular on sponsor due diligence (SFC/CT/023/2023) recommended that sponsors include this clause in all engagement letters, noting that “a listing applicant’s failure to disclose a whistleblower report to its sponsor may constitute a breach of the listing applicant’s obligation to cooperate with the sponsor under the HKEX Listing Rules.” The sponsor’s due diligence team should also establish a dedicated email address (e.g., whistleblower@sponsorfirm.hk) and a secure, encrypted document repository for storing whistleblower reports and related investigation materials. The compliance officer should be the primary point of contact for all whistleblower reports, with the sponsor’s legal counsel engaged at the earliest possible stage to assess legal privilege and confidentiality issues.

Post-A1 Filing: Disclosure to the HKEX and the SFC

Once the listing application is filed with the HKEX (the “A1” stage), the sponsor’s obligations become more complex. The sponsor must consider whether the whistleblower report constitutes a “material change” in the listing applicant’s circumstances that requires an updated filing under HKEX Listing Rule 9.11(3). The HKEX’s Guidance Letter GL85-16 (updated January 2024) states that a sponsor must notify the HKEX “as soon as reasonably practicable” of any information that “materially affects the listing applicant’s suitability for listing or the accuracy of the prospectus.” A whistleblower report that alleges fraud, regulatory breaches, or material misstatements in the prospectus will almost certainly trigger this notification obligation. The sponsor should notify the HKEX in writing, setting out the nature of the allegation, the sponsor’s initial assessment, and the proposed investigation plan. The sponsor should also consider whether the report must be disclosed to the SFC under Paragraph 12.2 of the Code, which requires a licensed person to “report promptly to the SFC any matter that the licensed person has reasonable grounds to suspect constitutes a breach of any provision of the Securities and Futures Ordinance (Cap. 571) (SFO).” If the whistleblower report alleges conduct that may constitute a breach of the SFO — such as market misconduct under Part XIII of the SFO or false statements in a prospectus under Section 40 of the Companies (Winding Up and Miscellaneous Provisions) Ordinance (Cap. 32) — the sponsor must report to the SFC.

Post-Hearing: The Race Against the Listing Date

The most challenging scenario for a Type 6 licensee is receiving a whistleblower report after the HKEX listing hearing but before the formal listing date. The sponsor has a very limited window — typically between the hearing date and the listing date, which can be as short as 5 to 10 business days — to investigate the report and decide whether to proceed with the listing. The SFC’s 2024 enforcement action against a sponsor that received a whistleblower report three days after the hearing (SFC Enforcement Notice 2024/12) provides a cautionary case study. The sponsor received a report alleging that the listing applicant had inflated its revenue by HKD 120 million through round-tripping transactions with a related party. The sponsor conducted a two-day investigation, interviewed the listing applicant’s CFO, and obtained a written confirmation from the applicant’s auditor that the revenue was genuine. The sponsor then proceeded with the listing. The SFC found that the sponsor’s investigation was inadequate because it did not independently verify the transactions with the counterparty, did not review the applicant’s bank statements, and did not engage a forensic accountant. The SFC imposed a fine of HKD 12 million and a suspension of the sponsor’s Type 6 licence for 12 months. The sponsor’s compliance officer should, in this scenario, immediately convene a meeting of the sponsor’s internal risk committee, engage external legal counsel and a forensic accountant, and notify the HKEX of the report and the sponsor’s proposed investigation plan. The sponsor should also consider whether to request a postponement of the listing date from the HKEX under Listing Rule 9.11(3).

Cross-Border Considerations: Whistleblower Reports Involving PRC Subsidiaries

A significant proportion of Hong Kong IPO applicants are PRC-incorporated companies with BVI or Cayman Islands holding structures. Whistleblower reports frequently involve allegations about the PRC operating subsidiaries — such as undisclosed regulatory breaches, tax evasion, or labour disputes. Type 6 licensees must navigate the intersection of Hong Kong regulatory requirements and PRC law, particularly the PRC Labour Contract Law (2008, amended 2018) and the PRC Anti-Unfair Competition Law (2019), which impose confidentiality obligations on employers that may conflict with a sponsor’s need to investigate whistleblower reports.

The PRC does not have a comprehensive whistleblower protection law equivalent to the Dodd-Frank Act in the US or the Public Interest Disclosure Act in the UK. Instead, whistleblower protection is fragmented across multiple pieces of legislation. The PRC Labour Contract Law, under Article 39, allows an employer to terminate an employee who “seriously breaches the employer’s rules and regulations,” which can include unauthorised disclosure of company information to a third party — including a sponsor. This creates a tension for Type 6 licensees: the whistleblower may be the sponsor’s best source of information about a material issue, but the whistleblower may face legal or employment consequences under PRC law for providing that information. The SFC’s 2023 circular on cross-border due diligence (SFC/CT/023/2023) acknowledged this tension and stated that sponsors should “take reasonable steps to protect the identity of whistleblowers in PRC subsidiaries, including by using secure communication channels and anonymising the whistleblower’s identity in internal documentation.” The sponsor should also include a clause in the engagement letter requiring the listing applicant to agree not to retaliate against any whistleblower who reports in good faith to the sponsor, and to indemnify the whistleblower against any losses arising from such reporting.

The Role of PRC Legal Counsel in Whistleblower Investigations

When a whistleblower report involves a PRC subsidiary, the sponsor should engage independent PRC legal counsel — not the listing applicant’s existing PRC counsel — to conduct the investigation. The sponsor’s PRC counsel should be instructed to assess the legal validity of the allegation under PRC law, to interview the whistleblower if possible (subject to the whistleblower’s consent and confidentiality), and to obtain documentary evidence from the PRC subsidiary. The sponsor’s PRC counsel should also advise on the legal risks of the investigation itself, including potential liability under the PRC Anti-Unfair Competition Law for obtaining trade secrets or confidential business information through the whistleblower report. The SFC’s 2024 enforcement action against a sponsor that relied solely on the listing applicant’s PRC counsel to investigate a whistleblower report (SFC Enforcement Notice 2024/18) resulted in a fine of HKD 5 million, on the grounds that the sponsor had failed to ensure the independence of the investigation. The sponsor’s compliance officer should ensure that the PRC legal counsel’s engagement letter explicitly states that the counsel is acting for the sponsor, not the listing applicant, and that the counsel’s findings must be reported directly to the sponsor without filtering by the listing applicant’s management.

Actionable Takeaways for Type 6 Compliance Officers

Draft a written whistleblower handling policy that specifies the reporting channel, triage criteria, and escalation procedure to the sponsor’s compliance officer and senior management, and ensure this policy is reviewed by the sponsor’s external legal counsel at least annually.
Include a whistleblower notification clause in every sponsor engagement letter, requiring the listing applicant to disclose any whistleblower reports received by the applicant or its subsidiaries within 24 hours of receipt.
Engage independent PRC legal counsel for any whistleblower investigation involving a PRC subsidiary, and ensure the counsel’s engagement letter explicitly states that the counsel acts for the sponsor, not the listing applicant.
Notify the HKEX in writing of any whistleblower report received after the A1 filing that alleges fraud, regulatory breaches, or material misstatements in the prospectus, and provide the HKEX with the sponsor’s investigation plan within 5 business days of receipt.
Convene the sponsor’s internal risk committee within 24 hours of receiving a whistleblower report after the listing hearing, and consider requesting a postponement of the listing date from the HKEX if the allegation is material to the listing applicant’s suitability for listing.