Verification of Regulatory Licences and Permits in Sponsor Due Diligence

The SFC’s December 2024 consultation conclusions on the Code of Conduct for Sponsor and Placing Agents (the “Sponsor Code”) introduced a material shift in the evidentiary standard for verifying regulatory licences and permits held by target companies. No longer is a simple online search or a copy of a business registration certificate considered sufficient. Paragraph 17.1 of the revised Sponsor Code now explicitly requires sponsors to obtain direct confirmation from the issuing regulatory authority, or, where that is not practicable, to document a detailed justification for relying on alternative evidence. This change, effective for all listing applications submitted on or after 1 July 2025, closes a long-standing gap in due diligence practice that the SFC’s enforcement division had flagged in three separate disciplinary actions between 2021 and 2023. For sponsors operating under the SFC’s Type 6 (advising on corporate finance) and Type 6A (sponsor) licences, the cost of non-compliance is now quantified: a maximum fine of HKD 10 million per breach under section 213 of the Securities and Futures Ordinance (Cap. 571), plus potential licence suspension. The following analysis sets out the precise regulatory requirements, the operational mechanics of verification, and the documentation standards that sponsor compliance desks must embed into their standard operating procedures.

The Regulatory Framework for Licence Verification

The revised Sponsor Code does not operate in isolation. It sits within a broader architecture of SFC codes, HKEX Listing Rules, and the SFO that collectively define the sponsor’s duty of care. Understanding how these instruments interact is the first step toward building a compliant verification framework.

Paragraph 17.1 of the Sponsor Code: The New Baseline

Paragraph 17.1 of the Sponsor Code, as amended by the December 2024 consultation conclusions, states that a sponsor must take “all reasonable steps” to verify that the listing applicant holds all regulatory licences and permits material to its business operations. The SFC’s accompanying guidance note (December 2024) clarifies that “reasonable steps” includes, at a minimum, obtaining a written confirmation from the issuing authority. For licences issued by the Hong Kong Monetary Authority (HKMA), the Hong Kong Insurance Authority (IA), or the Hong Kong Securities and Futures Commission (SFC) itself, the sponsor must request a direct letter or email from the relevant licensing department. For licences issued by overseas regulators—such as the China Banking and Insurance Regulatory Commission (CBIRC), the Monetary Authority of Singapore (MAS), or the UK’s Financial Conduct Authority (FCA)—the sponsor must either obtain a similar direct confirmation or, if the regulator does not provide such a service, document the steps taken to verify the licence through the regulator’s official online portal, with a timestamped screenshot and a note explaining why direct confirmation was not available.

Interaction with HKEX Listing Rules

HKEX Listing Rules Chapter 8 (Qualifications for Listing) and Chapter 9 (Procedures and Requirements for Listing) impose parallel obligations on sponsors. Rule 8.04 requires a new applicant to be “suitable for listing,” which the HKEX has consistently interpreted to include compliance with all applicable regulatory licencing requirements. The HKEX’s “Guidance Letter on Sponsor Due Diligence” (GL57-13, updated January 2025) cross-references the Sponsor Code at paragraph 17.1 and explicitly states that the Exchange will consider a sponsor’s failure to verify licences as a factor in suitability assessments. In practice, this means that a sponsor who relies solely on a copy of a licence certificate without direct regulator confirmation may face a deficiency letter from the Listing Division, requiring additional work and potentially delaying the listing timetable by 4–6 weeks.

SFC Enforcement Precedents

Three SFC disciplinary actions between 2021 and 2023 provide concrete examples of what constitutes inadequate licence verification. In SFC v. Sponsor A (2021), the sponsor accepted a photocopy of a PRC internet content provider licence without verifying its validity with the Ministry of Industry and Information Technology (MIIT). The SFC found that the sponsor had failed to take reasonable steps, and imposed a fine of HKD 8 million. In SFC v. Sponsor B (2022), the sponsor relied on an email from the target company’s legal counsel confirming the validity of a Hong Kong Money Lenders Licence (Cap. 163), rather than contacting the Registrar of Money Lenders directly. The SFC fined the sponsor HKD 6 million and suspended its Type 6A licence for six months. In SFC v. Sponsor C (2023), the sponsor failed to verify a Singaporean capital markets services licence held by a subsidiary, relying on a screenshot from the MAS’s online register without documenting the date and time of the search. The SFC imposed a fine of HKD 4 million and required the sponsor to engage an independent compliance consultant for 12 months.

Operational Mechanics of Licence Verification

Translating the regulatory requirements into operational procedures requires a structured approach that accounts for the type of licence, the jurisdiction of issuance, and the materiality of the licence to the target company’s business. The following framework is designed to be embedded into a sponsor’s due diligence checklist.

Categorising Licences by Materiality and Jurisdiction

Not all licences require the same level of verification effort. The SFC’s guidance note (December 2024) introduces a triage system based on materiality. A licence is deemed “material” if its revocation would have a “significant adverse effect” on the target company’s operations, defined as a reduction of more than 20% in revenue or a cessation of a core business line. For material licences, the sponsor must obtain direct regulator confirmation. For non-material licences—such as general business registration certificates, food and beverage licences, or standard trade permits—the sponsor may rely on a copy of the licence certificate plus a cross-check against the issuing authority’s online register, provided that the register is updated at least monthly. For licences issued by regulators in jurisdictions with no online verification system—such as certain provincial-level regulators in the PRC or regulators in Myanmar or Cambodia—the sponsor must engage a local law firm to physically attend the regulator’s office and obtain a stamped confirmation letter, with the cost borne by the sponsor as part of its due diligence budget.

The Verification Process: Step-by-Step

The verification process for a material licence follows a five-step sequence. First, the sponsor identifies all licences held by the target company and its material subsidiaries, using a standardised licence inventory template that includes the licence number, issuing authority, date of issue, expiry date, and scope of authorisation. Second, the sponsor requests the target company to provide a written authorisation letter, signed by a director, permitting the regulator to disclose information to the sponsor. Third, the sponsor submits a formal enquiry to the issuing regulator, using the regulator’s prescribed form (if available) or a standardised letter drafted by the sponsor’s legal counsel. Fourth, the sponsor receives the regulator’s response and compares it against the licence inventory, noting any discrepancies in scope, expiry date, or conditions. Fifth, the sponsor documents the entire process in a verification memorandum, which includes copies of the authorisation letter, the enquiry, the response, and a reconciliation statement. This memorandum must be signed off by the sponsor’s compliance officer and kept on file for at least seven years after the listing application is withdrawn or the listing is completed, as required by the SFC’s record-keeping rules under the Code of Conduct for Persons Licensed by or Registered with the SFC (paragraph 16.3).

Handling Regulator Non-Response

A practical challenge that sponsors frequently encounter is regulator non-response. Some regulators, particularly in jurisdictions with limited resources, do not respond to enquiries from third parties. The SFC’s guidance note (December 2024) provides a fallback procedure for such cases. If the sponsor has made at least two written enquiries to the regulator, spaced at least 14 days apart, and has received no response within 30 days of the first enquiry, the sponsor may proceed with alternative verification. The alternative must include: (i) a written confirmation from the target company’s board of directors, signed by all directors, confirming that the licence is valid and that no revocation proceedings are pending; (ii) a legal opinion from a qualified law firm in the relevant jurisdiction, confirming that the licence appears valid based on publicly available information; and (iii) a timestamped screenshot of the regulator’s online register (if available) showing the licence as active. The sponsor must document the reasons for regulator non-response and the steps taken to obtain alternative evidence, and must flag this to the HKEX in the listing application as a “material due diligence limitation” under the HKEX’s Guidance Letter GL57-13.

Documentation Standards and Record-Keeping

The SFC’s enforcement actions have consistently highlighted inadequate documentation as a contributing factor to sanctions. In all three cases cited above, the sponsors had performed some form of verification but had failed to document it in a manner that satisfied the SFC’s evidentiary standards. The following documentation requirements are derived directly from the SFC’s December 2024 guidance.

The Verification Memorandum

The verification memorandum must contain six mandatory sections. Section one identifies the licence being verified, including its full name, number, issuing authority, and date of issue. Section two describes the verification methodology, specifying whether direct regulator confirmation, online register search, or alternative evidence was used. Section three attaches all supporting documents, including the regulator’s response (if any), the authorisation letter, the screenshot of the online register, and the legal opinion (if applicable). Section four reconciles the verified information against the licence inventory, noting any discrepancies and explaining how they were resolved. Section five states the sponsor’s conclusion on whether the licence is valid and current, and whether any conditions or limitations apply. Section six is signed by the sponsor’s responsible officer and the compliance officer, with the date of sign-off. The memorandum must be prepared in English, or in Chinese with an English translation, as the SFC’s working language is English for all formal submissions.

Record Retention and Audit Trail

The SFC’s Code of Conduct (paragraph 16.3) requires licensed persons to retain records for at least seven years after the transaction is completed or the licence is terminated. For sponsors, this means that the verification memorandum and all supporting documents must be retained for seven years from the date of listing or, if the listing application is withdrawn, from the date of withdrawal. The records must be stored in a format that is easily retrievable and must be indexed by licence type and jurisdiction. The SFC has the power to request these records at any time during a routine inspection or a specific investigation, and failure to produce them within 14 days of a written request is itself a breach of the Code of Conduct, carrying a maximum fine of HKD 5 million under section 193 of the SFO.

Cross-Border Considerations for PRC Licences

For listings of PRC companies, the verification of PRC regulatory licences presents unique challenges. The PRC’s State Administration for Market Regulation (SAMR), the MIIT, and the China Securities Regulatory Commission (CSRC) each have their own procedures for licence verification. The MIIT, for example, maintains an online portal for verifying internet content provider (ICP) licences, but the portal only shows the licence number and the company name, not the full scope of authorised activities. The SFC’s guidance note (December 2024) specifically addresses this issue: for PRC licences where the online portal does not show the full scope, the sponsor must engage a PRC law firm to obtain a written confirmation from the relevant local bureau of the MIIT or SAMR, with a stamped official seal. The cost of this engagement is typically HKD 50,000 to HKD 100,000 per licence, depending on the location and complexity. The sponsor must also verify that the PRC company’s VIE structure, if applicable, does not violate any licencing conditions. The HKEX’s “Guidance Letter on VIE Structures” (GL94-18, updated January 2025) requires sponsors to obtain a legal opinion confirming that the VIE arrangement does not circumvent any PRC licencing requirements, and this opinion must be cross-referenced with the licence verification memorandum.

Practical Implications for Sponsor Compliance Desks

The revised regulatory framework imposes tangible operational changes on sponsor compliance desks. The following are the key implications that compliance officers must address in their internal procedures.

Resource Allocation and Budgeting

The direct regulator confirmation requirement for material licences adds an estimated 40–60 hours of work per listing application, based on data from the SFC’s 2024 consultation paper (paragraph 3.14). For a typical Main Board listing with 15–20 material licences, this translates to an additional HKD 200,000 to HKD 300,000 in professional fees, assuming a blended hourly rate of HKD 5,000 for sponsor staff and external counsel. Sponsors must budget for this cost in their engagement letters and must not pass it on to the listing applicant as a separate fee, as the SFC’s Code of Conduct prohibits sponsors from charging fees that are contingent on the outcome of the listing application (paragraph 17.2). The compliance desk should include a line item for licence verification costs in the sponsor’s annual budget, with a contingency of 20% for unexpected regulator non-response or additional licences identified during due diligence.

Training and Competency Requirements

The SFC’s December 2024 consultation conclusions also introduce a new training requirement for sponsor staff involved in due diligence. Paragraph 17.3 of the revised Sponsor Code requires sponsors to ensure that all staff who perform licence verification have completed a training programme that covers the specific verification procedures for each major jurisdiction. The training programme must be updated at least annually and must include case studies from recent SFC enforcement actions. The compliance desk must maintain a training register for each staff member, showing the date of completion and the topics covered. Failure to comply with this training requirement is a breach of the Sponsor Code and can result in a fine of up to HKD 5 million under section 193 of the SFO.

Technology and Automation

Several sponsors have begun using technology to automate parts of the licence verification process. The SFC’s guidance note (December 2024) does not prohibit the use of automated tools, provided that the sponsor can demonstrate that the tool has been validated and that the results are reviewed by a qualified human. For example, a sponsor may use a web scraping tool to capture timestamped screenshots of online regulator registers, but the sponsor must manually verify that the tool is capturing the correct data and that the register is the official one maintained by the regulator. The compliance desk should implement a validation protocol for any automated tool, including a quarterly test of the tool’s accuracy against a sample of manually verified licences. The results of the validation must be documented and retained for seven years.

Actionable Takeaways

1. Embed a direct regulator confirmation requirement into your sponsor due diligence checklist for all material licences, effective for any listing application submitted after 1 July 2025, with a fallback procedure for regulator non-response that includes board confirmation, legal opinion, and online register screenshot.
2. Prepare a standardised licence inventory template and verification memorandum format, signed off by the compliance officer, and retain all records for seven years from the date of listing or application withdrawal, indexed by licence type and jurisdiction.
3. Budget an additional HKD 200,000 to HKD 300,000 per Main Board listing for licence verification costs, and ensure that the engagement letter explicitly excludes any outcome-contingent fees for this work.
4. Implement an annual training programme for all sponsor staff involved in due diligence, covering jurisdiction-specific verification procedures and using case studies from the SFC’s 2021–2023 enforcement actions, with a training register maintained for each staff member.
5. Validate any automated licence verification tools quarterly against a sample of manually verified licences, and document the validation results in a protocol retained for seven years.