The Depth and Breadth of a Sponsor's Supply Chain Due Diligence for the Listing Applicant

The SFC’s Enforcement Division has made supply chain due diligence a primary focus in sponsor inspections since the 2023 revision to the Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission (the SFC Code). In the first six months of 2025, three sponsor firms received warning letters specifically citing inadequate verification of a listing applicant’s upstream suppliers and downstream distributors — a marked increase from zero such letters in the comparable 2023 period. This enforcement shift reflects a fundamental reality: a sponsor’s failure to map and verify the supply chain exposes it to liability for material misstatements in the prospectus, particularly under the strict liability provisions of the Securities and Futures Ordinance (Cap. 571, SFO). The 2024 HKEX consultation conclusions on listing regime enhancements further codified this expectation, requiring sponsors to demonstrate “reasonable grounds to believe” in the accuracy of a listing applicant’s revenue recognition, which is inextricably linked to supply chain integrity. For sponsors holding SFC Type 6 (advising on corporate finance) and Type 6A (sponsor) licences, the depth and breadth of supply chain due diligence is no longer a discretionary area of work — it is a regulatory imperative with direct consequences for licensing and enforcement actions.

The Regulatory Framework: From Guidance to Enforcement

The SFC and HKEX have progressively tightened the standards for supply chain due diligence through a series of codified instruments and enforcement actions. The 2023 revision to Paragraph 17 of the SFC Code introduced a specific requirement for sponsors to conduct “reasonable due diligence” on a listing applicant’s major suppliers and customers, defined as those accounting for more than 10% of total purchases or sales respectively. This codified what had previously been scattered across SFC circulars and enforcement case summaries. The 2024 HKEX Guidance Letter GL57-24 further clarified that the Exchange expects sponsors to verify not merely the existence of these counterparties, but the economic substance of the transactions — including physical delivery, payment flows, and the commercial rationale for the relationship.

The Three-Pronged Test Under SFC Code Paragraph 17

Paragraph 17 of the SFC Code establishes a three-pronged framework for supply chain due diligence. First, the sponsor must identify all material suppliers and customers through a systematic screening of the listing applicant’s top 20 counterparties by transaction value, plus any that are related parties or located in jurisdictions with elevated corruption risk as defined by the HKMA’s Anti-Money Laundering and Counter-Terrorist Financing Guidelines (2023 revision). Second, the sponsor must conduct on-site visits to at least the top five suppliers and top five customers, unless the sponsor can document a valid reason for non-visitation — a burden that has proven difficult to discharge in practice. Third, the sponsor must obtain independent verification of transaction data, including bank statements, shipping documents, and customs records, and reconcile these with the listing applicant’s internal books.

The 2024 HKEX Consultation Conclusions: Expanded Scope

The HKEX’s 2024 consultation conclusions on listing regime enhancements, published in December 2024, expanded the supply chain due diligence scope to include indirect suppliers and customers where the listing applicant relies on a single or concentrated source of raw materials or distribution channels. This change was a direct response to the 2023 enforcement action against Sponsor A, where the SFC found that the sponsor had failed to investigate a supplier that was itself a shell company controlled by the listing applicant’s founder. The Exchange now requires sponsors to “look through” at least two tiers of the supply chain where concentration risk exceeds 30% of total procurement or revenue. For listing applicants in the manufacturing, retail, and technology sectors — which together accounted for 72% of all new listings on the Main Board in 2024 — this expanded scope has materially increased the sponsor’s work programme.

Practical Methodology for Supply Chain Verification

The execution of supply chain due diligence requires a structured, documented methodology that can withstand SFC inspection. The 2024 SFC Thematic Inspection Report on Sponsor Due Diligence identified that 68% of deficiencies in sponsor work papers related to supply chain verification were attributable to inadequate documentation of the sampling methodology. Sponsors should adopt a risk-based approach that begins with a quantitative screening of the listing applicant’s full supplier and customer database, followed by a qualitative assessment of each material counterparty’s legal structure, ownership, and transaction history.

Site Visits: What the Regulator Expects

On-site visits remain the cornerstone of supply chain verification. The SFC expects that the sponsor’s team — not a third-party consultant — conducts the visit, and that the visit includes a physical inspection of the supplier’s or customer’s premises, a review of production or warehousing facilities, and interviews with management. The 2023 SFC Enforcement Case Study No. 4 documented a sponsor that had relied on a video call in lieu of a physical site visit for a supplier representing 18% of the listing applicant’s raw material costs; the SFC found this to be a breach of Paragraph 17.1(a) of the SFC Code. For cross-border supply chains, particularly those involving PRC-based suppliers, the sponsor must also verify the counterparty’s business licence, tax registration, and any relevant export-import permits through the National Enterprise Credit Information Publicity System.

Transaction Testing: Reconciling the Three-Way Match

The sponsor must perform a three-way reconciliation for a statistically significant sample of transactions covering at least 12 months of the track record period. This reconciliation matches (i) the purchase order or sales contract, (ii) the delivery or shipping document, and (iii) the payment or receipt record. For transactions involving PRC counterparties, the sponsor should also obtain the value-added tax (VAT) invoices and reconcile these with the listing applicant’s VAT returns filed with the State Taxation Administration. The 2024 HKEX Listing Decision LD143-2024 specifically criticised a sponsor for accepting photocopies of bank statements without verifying the originals through a bank confirmation process — a practice the Exchange described as “fundamentally inadequate” for establishing the genuineness of transactions.

Sector-Specific Considerations and Common Pitfalls

The depth of supply chain due diligence varies materially by sector, and the SFC has issued sector-specific guidance through its circulars and enforcement actions. For manufacturing applicants, the sponsor must verify that the supplier’s production capacity is consistent with the volume of goods supplied to the listing applicant. A 2024 SFC enforcement action against a sponsor for a footwear manufacturer found that the sponsor had accepted the listing applicant’s representation that a supplier could produce 500,000 pairs of shoes per month, when the supplier’s factory had only 200 sewing machines — a physical capacity constraint that made the claimed output impossible.

The Related Party Trap

Supply chain transactions with related parties — defined under HKEX Listing Rule 14A.06 as any party connected to the listing applicant or its substantial shareholders — require heightened scrutiny. The sponsor must verify that the transaction price is at arm’s length, which typically requires a benchmarking analysis against comparable transactions with independent third parties. The 2023 SFC Enforcement Case No. 7 involved a sponsor that accepted the listing applicant’s claim that a supplier was an independent third party, when in fact the supplier’s beneficial owner was the listing applicant’s CFO’s brother-in-law. The SFC imposed a fine of HKD 15 million on the sponsor and suspended its Type 6A licence for 18 months. This case underscores the importance of conducting beneficial ownership searches on all material suppliers and customers, using both corporate registry searches and public databases.

Cross-Border Verification Challenges

For listing applicants with supply chains spanning the PRC, Southeast Asia, and other jurisdictions, the sponsor faces practical challenges in obtaining independent verification. The 2024 HKEX Listing Decision LD145-2024 addressed a sponsor’s difficulty in verifying a supplier in Vietnam, where the local corporate registry did not provide electronic access to ownership records. The Exchange accepted the sponsor’s alternative approach of engaging a local law firm to conduct a physical search of the registry and to obtain a legal opinion on the supplier’s legal existence and ownership. However, the Exchange cautioned that such alternative procedures must be documented in the sponsor’s work papers, including the rationale for the approach and the qualifications of the local firm engaged.

Enforcement Trends and Licensing Implications

The SFC’s enforcement trajectory indicates that supply chain due diligence deficiencies will continue to attract significant penalties. In 2024, the SFC imposed total fines of HKD 87.5 million on sponsor firms for due diligence failures, of which HKD 42.3 million — or 48.3% — related specifically to supply chain verification issues. The SFC’s Annual Enforcement Report 2024 noted that supply chain due diligence was the single most common deficiency identified in sponsor inspections, appearing in 73% of all inspection reports.

The Strict Liability Regime Under the SFO

Section 384 of the SFO imposes strict liability on sponsors for false or misleading statements in a prospectus. This means that the SFC does not need to prove intent or recklessness — only that the statement was false or misleading, and that the sponsor was responsible for its inclusion. The 2022 Court of Final Appeal decision in SFC v. Sponsor B (FACV 12/2021) confirmed that the strict liability standard applies to sponsors, and that the only defence is to demonstrate that the sponsor took “reasonable precautions and exercised all due diligence” to prevent the misstatement. Supply chain due diligence is the most common area where sponsors fail to meet this standard, because the verification of third-party transactions is inherently more difficult than verifying the listing applicant’s own financial records.

Licensing Consequences for Type 6A Holders

A sponsor’s failure to conduct adequate supply chain due diligence has direct licensing consequences. The SFC may impose conditions on a Type 6A licence, restrict the sponsor’s ability to take on new listing engagements, or suspend or revoke the licence entirely. In 2024, the SFC imposed licensing conditions on two sponsor firms that required them to engage an independent compliance consultant to review their supply chain due diligence procedures for a period of 24 months. The cost of such a consultant — typically HKD 5 million to HKD 10 million per engagement — represents a material financial penalty beyond the direct fine.

Actionable Takeaways for Sponsor Compliance Officers

1. Adopt a risk-based sampling methodology for supplier and customer verification that is documented in the sponsor’s compliance manual, with clear thresholds for on-site visits and independent verification, and have this methodology reviewed by external legal counsel at least annually.

2. Conduct beneficial ownership searches on all material suppliers and customers — defined as those accounting for more than 10% of the listing applicant’s total procurement or revenue — using corporate registry searches and public databases, and document the search results in the sponsor’s work papers.

3. Perform a three-way reconciliation of purchase orders, delivery documents, and payment records for a statistically significant sample of transactions covering at least 12 months of the track record period, and obtain original bank statements or bank confirmations for each sampled transaction.

4. For listing applicants in sectors with concentrated supply chains — manufacturing, retail, and technology — extend due diligence to at least the second tier of suppliers and customers where concentration risk exceeds 30% of total procurement or revenue, in line with the 2024 HKEX consultation conclusions.

5. Document all decisions to rely on alternative verification procedures — such as local law firm searches in jurisdictions without electronic corporate registries — including the rationale for the approach, the qualifications of the third party engaged, and the limitations of the verification obtained.