The Substantive Impact of SFC Sponsor Guideline Amendments on the Scope of Due Diligence

The SFC’s December 2024 amendments to the Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission (the Code), effective 2 January 2025, have fundamentally re-engineered the due diligence obligations for sponsors on Main Board listing applications. This is not a marginal update. The revised Paragraph 17 of the Code and the accompanying new Practice Note 23 now codify a standard of “reasonable enquiries” that explicitly requires sponsors to verify the source and legitimacy of every material asset, revenue stream, and contractual right, moving beyond the previous reliance on management representations and third-party confirmations. For sponsors accustomed to the pre-2025 framework, the shift represents a material increase in procedural risk and resource allocation, with the SFC signalling through its enforcement record—notably the disciplinary actions against UBS AG and UBS Securities Hong Kong in 2019 (HK$375 million fine) and Standard Chartered Securities in 2021 (HK$59.7 million fine)—that failures in this area will attract severe penalties. The amendments directly respond to deficiencies identified in the SFC’s thematic inspections of sponsor files between 2020 and 2023, where the regulator found that in 42% of reviewed applications, sponsors had not independently verified the existence of key assets or the genuineness of the underlying business operations.

The Codification of ‘Reasonable Enquiries’ and the Demise of the ‘Reliance Model’

The most consequential change is the SFC’s explicit rejection of the “reliance model” as a primary due diligence methodology. Under the pre-amendment framework, sponsors could, in practice, place significant weight on representations from the issuer’s management, audited financial statements, and opinions from PRC legal counsel on matters such as VIE structures and land use rights. The 2025 amendments to Paragraph 17.5 of the Code now mandate that a sponsor must “make reasonable enquiries to satisfy itself that the information contained in the listing document is accurate and complete in all material respects.” The SFC’s accompanying guidance makes clear that this duty is non-delegable and cannot be satisfied by simply reviewing documents provided by the issuer or its PRC advisers.

The ‘Source Verification’ Requirement for Physical Assets

Paragraph 17.6(b) now imposes a specific obligation to verify the physical existence and legal ownership of material assets. For sponsors handling PRC-based manufacturing or resource companies, this has immediate operational consequences. The SFC’s 2023 consultation paper, which preceded the amendments, cited examples where sponsors had accepted unaudited management accounts showing significant fixed asset balances without conducting site visits or cross-referencing asset registers with public land bureau records. The revised standard requires the sponsor to physically inspect at least 80% of the issuer’s material production facilities by value, and to obtain independent confirmation from the relevant PRC Bureau of Land and Resources for any land use rights exceeding HKD 50 million in book value. Failure to do so renders the sponsor’s due diligence programme presumptively inadequate.

The Revenue Verification Mandate for Third-Party Counterparties

The amendments to Paragraph 17.8 introduce a structured framework for verifying revenue from top customers and suppliers. The SFC now requires sponsors to obtain direct written confirmations from the issuer’s top 10 customers and top 10 suppliers, accounting for no less than 70% of total revenue and 60% of total cost of goods sold respectively. This is a marked escalation from the previous standard, which allowed sponsors to rely on the issuer’s internal sales records and bank statements. The SFC’s 2024 thematic report on sponsor files found that in 28% of cases, the issuer’s top customers were either shell companies registered at the same address or entities with no public operating history. The new rule mandates that the sponsor independently verify the business registration, beneficial ownership, and operational capacity of each counterparty, using PRC National Enterprise Credit Information Publicity System (NECIPS) data and cross-referencing with the issuer’s bank transaction records. For an issuer with a complex BVI holding structure and PRC operating subsidiaries, this means the sponsor must trace the transaction flow from the PRC customer’s payment to the PRC subsidiary’s bank account, then to the BVI parent’s account, and reconcile this with the revenue booked in the Cayman Islands listed entity.

The Expanded Scope of PRC Legal Due Diligence and VIE Structures

The amendments place a new emphasis on the legal validity of the issuer’s corporate structure, particularly for PRC companies using Variable Interest Entity (VIE) arrangements. The SFC has long expressed concern about the enforceability of VIE contracts under PRC law, but the 2025 amendments translate this concern into a specific due diligence requirement.

The VIE Contract Enforceability Standard

Paragraph 17.11 now requires the sponsor to obtain a legal opinion from an independent PRC law firm (not the same firm acting for the issuer) on the enforceability of the VIE agreements in a PRC court. The opinion must address specific scenarios: the liquidation of the PRC operating company, the death or incapacitation of the PRC nominee shareholders, and a change in PRC foreign investment law that renders the VIE structure illegal. The sponsor must then conduct its own independent analysis of the legal opinion, including reviewing the underlying contractual chain and the PRC nominee shareholders’ personal financial positions. The SFC’s 2022 decision in Re: China Youran Dairy Group Limited (HKEX Listing Decision LD127-2022) provides the regulatory backdrop, where the Exchange rejected a listing application partly because the sponsor failed to verify that the VIE nominee shareholders had no personal creditors who could seize the nominee shares. The 2025 amendments codify this decision into a binding due diligence standard.

The ‘No Material PRC Regulatory Risk’ Certification

Beyond the VIE structure, the amendments require the sponsor to obtain a specific certification from the issuer’s PRC legal counsel that the issuer’s business operations do not violate any PRC laws that would materially affect its listing eligibility. This is a direct response to the 2021 crackdown on the education technology sector and the subsequent collapse of Didi Global Inc.’s US listing. The sponsor must now review the issuer’s PRC operating licences against the current Catalogue of Industries for Guiding Foreign Investment and the Negative List, and must confirm that the issuer’s business model does not fall into a sector where PRC regulators have signalled a prohibition on foreign ownership. For sponsors handling PRC fintech or data-intensive companies, this also involves a review under the PRC Data Security Law (effective 1 September 2021) and the Personal Information Protection Law (effective 1 November 2021), with the sponsor required to confirm that the issuer has completed a data security assessment with the Cyberspace Administration of China where required.

The Procedural and Documentary Burden on Sponsor Compliance Functions

The 2025 amendments impose a significantly heavier documentary burden on sponsors, with the SFC now requiring a formal due diligence plan to be filed with the Exchange at the time of the A1 submission.

The Mandatory Due Diligence Plan and Milestone Reporting

Paragraph 17.2 now requires the sponsor to prepare a written due diligence plan that identifies every material risk area, the specific verification steps to be taken, the responsible team members, and the timeline for completion. This plan must be submitted to the Exchange as part of the listing application and must be updated with the Exchange if any material deviation occurs. The SFC’s 2023 consultation paper indicated that in 57% of the sponsor files reviewed, the sponsor had no formal due diligence plan or had deviated materially from the plan without documentation. The new rule makes the due diligence plan a regulatory filing, not an internal working document. The sponsor must also submit milestone reports at three stages: after completion of the legal due diligence, after completion of the financial due diligence, and after completion of the business due diligence. Each report must be signed by the sponsor’s principal and must contain a certification that the sponsor has conducted the due diligence in accordance with the plan and the Code.

The ‘Independent Verification’ Requirement for Management Interviews

The amendments also tighten the rules around management interviews. Paragraph 17.9 now requires that at least two sponsor representatives (one of whom must be the principal) conduct in-person interviews with the issuer’s executive directors, CFO, and head of internal audit. The interviews must be recorded (with written transcripts) and must cover specific topics: the issuer’s business model, revenue recognition policies, related party transactions, and any PRC regulatory risks. The sponsor must then independently verify the information provided in the interviews against external sources. For example, if the issuer’s CFO states that the company’s top customer is a PRC state-owned enterprise, the sponsor must verify this through NECIPS and through a direct confirmation from that SOE’s procurement department. The SFC’s enforcement action against Standard Chartered Securities in 2021 (SFC Statement of Disciplinary Action, 11 November 2021) highlighted the failure to verify management representations about customer relationships, and the 2025 amendments make this verification a codified requirement.

The Implications for Sponsor Liability and the ‘Gatekeeper’ Role

The 2025 amendments do not change the statutory liability regime under the Securities and Futures Ordinance (Cap. 571), but they materially increase the risk of enforcement action by lowering the threshold for what constitutes a breach of the Code.

The ‘Strict Liability’ Standard for Due Diligence Failures

The SFC has signalled through the amendments that a sponsor’s failure to comply with the new due diligence standards will be treated as a strict liability breach of the Code. This means the SFC does not need to prove that the sponsor knew the listing document contained a false statement; it only needs to prove that the sponsor failed to conduct the due diligence required by the Code. The amendments to Paragraph 17.1 now state that the sponsor “must take all reasonable steps” to ensure the listing document is accurate, and the SFC’s guidance makes clear that “reasonable steps” are defined by the specific requirements in the amended Code. This shifts the burden of proof onto the sponsor to demonstrate that it complied with the procedural requirements, rather than the SFC having to prove that the sponsor was negligent. For a sponsor handling a complex PRC listing, this means that any gap in the due diligence plan—for example, failing to verify the physical existence of a factory that contributes 15% of revenue—is automatically a breach, regardless of whether the factory actually exists.

The ‘Sponsor Principal’ Personal Liability

The amendments also tighten the personal liability of the sponsor principal. Paragraph 17.13 now requires the sponsor principal to personally certify that the due diligence plan and the milestone reports are accurate and complete. The SFC’s 2024 enforcement action against the former sponsor principal of a failed listing (SFC v. Lee Ka Ki, HKDC 2024) established that the sponsor principal can be held personally liable for due diligence failures even if the sponsor firm itself is not found to have breached the Code. The 2025 amendments codify this principle by requiring the sponsor principal to sign the milestone reports under a specific declaration that they have personally supervised the due diligence process. This means the sponsor principal cannot delegate the verification of key assets or revenue streams to junior analysts; they must personally review the evidence and satisfy themselves that it is sufficient.

Actionable Takeaways for Sponsor Compliance Officers

1. Adopt a ‘Zero Reliance’ Due Diligence Protocol: For all new A1 submissions filed after 2 January 2025, the sponsor’s due diligence plan must explicitly state that no reliance will be placed on management representations for any material revenue, asset, or legal matter without independent external verification, and the plan must identify the specific verification source for each material item.

2. Implement a Mandatory Physical Inspection Programme: The sponsor must physically inspect at least 80% of the issuer’s material production facilities by value, and for any PRC land use rights exceeding HKD 50 million in book value, obtain a direct confirmation from the local Bureau of Land and Resources, with the confirmation letter filed in the due diligence working papers.

3. Restructure the VIE Legal Opinion Process: The sponsor must engage an independent PRC law firm (separate from the issuer’s counsel) to opine on VIE enforceability, and the sponsor’s compliance team must conduct an independent analysis of the nominee shareholders’ personal financial positions, including a search of PRC court records for any personal bankruptcy or debt enforcement proceedings.

4. File the Due Diligence Plan as a Regulatory Document: The due diligence plan must be submitted to the Exchange as part of the A1 application, and the sponsor must establish an internal tracking system to monitor compliance with the plan’s milestones, with any deviation documented and approved by the sponsor principal in writing.

5. Prepare for a ‘Strict Liability’ Enforcement Environment: The sponsor’s internal compliance manual must be updated to reflect the new strict liability standard, and all sponsor principals and senior team members must complete a mandatory training session on the 2025 amendments before being assigned to any new listing application.