Hong Kong

General context, key principles and hot topics

1Identify the highest-profile corporate investigation under way in your country, describing and commenting on its most noteworthy aspects.

The Hong Kong Securities and Futures Commission (SFC) remains active in pursuing alleged corporate misfeasance among listed companies, as well as members of their current or former senior management. It works closely with the Independent Commission Against Corruption (ICAC). Following a joint operation with the SFC, in May and July 2019, the ICAC charged a number of former executive directors and managers of Convoy Global Holdings Limited with conspiracy to defraud. In June 2019, the SFC and the ICAC mounted another joint operation and searched the offices of two sponsor firms, two listed companies and a financial printing company. The ICAC arrested a former joint head of the Initial Public Offering Vetting Team of the Listing Department of the Hong Kong Exchanges and Clearing Limited and two of his associates.

Another notable feature is the close co-operation between the SFC and the Mainland Chinese regulators, including the China Securities Regulatory Commission (CSRC) and the China Banking Regulatory Commission. In late 2017, the SFC and the CSRC carried out a joint investigation into an individual (Tang Hanbo) for stock manipulation through the China-Hong Kong Stock Connect programme, leading to administrative penalties imposed by the CSRC and the criminal conviction of Tang in China.

2Outline the legal framework for corporate liability in your country.

The law of Hong Kong has followed the common law of England and Wales in ascribing corporate liability for criminality, and has developed two main techniques for attributing to a corporate the acts and states of mind of the individuals it employs:

• the ‘identification principle’, whereby, subject to some limited exceptions, a corporate entity may be indicted and convicted for the criminal acts of the directors and managers who represent its directing mind and will, and who control what it does; and
• vicarious liability, under which a corporation is liable for the criminal acts of its employees or agents under statutory offences that impose an absolute duty on the employer.

A number of offences in Hong Kong legislation target corporates and regulate business activity. They include offences provided in the Companies Ordinance, the Securities and Futures Ordinance (SFO), the Trade Descriptions Ordinance and the Theft Ordinance.

3Which law enforcement authorities regulate corporations? How is jurisdiction between the authorities allocated? Do the authorities have policies or protocols relating to the prosecution of corporations?

Corporations are subject to investigation or regulation by a number of authorities, including the ICAC, the Hong Kong Police Force (HKPF), the Customs and Excise Department, the Companies Registry, the Inland Revenue Department, the SFC, the Hong Kong Monetary Authority (HKMA), the Insurance Authority (IA), the Competition Commission and the Office of the Privacy Commissioner (OPC).

Hong Kong’s Department of Justice (DOJ) has overall responsibility for conducting criminal prosecutions; the other authorities named above conduct investigations and sometimes carry out prosecutions, depending on the offences involved. There has been an increase in co-operation between law enforcement authorities in mounting joint investigations into suspected misfeasance by listed companies and their directors and officers. See, as an example, the joint operations by the SFC and the ICAC described in question 1.

4What grounds must the authorities have to initiate an investigation? Is a certain threshold of suspicion necessary to trigger an investigation?

In general, criminal authorities must have reasonable grounds to suspect that a crime has been committed before starting an investigation. The threshold of suspicion is relatively low.

5How can the lawfulness or scope of a notice or subpoena from an authority be challenged in your country?

A challenge to a search and seizure warrant or production order, and a request to exclude evidence gathered as a result, can be made based on scope, the grounds on which the order was obtained, legal professional privilege or public interest grounds through an application to the Hong Kong courts.

6Does your country make use of co-operative agreements giving immunity or leniency to individuals who assist or co-operate with authorities?

Deferred prosecution agreements (DPAs) are commonly used by prosecutors and regulators in the United States and the United Kingdom. Although they have not been formally introduced in Hong Kong, different Hong Kong regulators have, in practice, their own co-operation arrangements. For example, the ICAC or the HKPF from time to time grant perpetrators immunity from prosecution in return for co-operation, after consultation with the DOJ. Both the SFC and the HKMA have published guidance notes on co-operation in investigations and enforcement proceedings under which a person may obtain a credit on the disciplinary penalty if they settle with the regulators. These guidance notes do not apply to criminal cases over which the DOJ has sole discretion. It is also common for the SFC or the HKMA to require, as a part of a settlement, the appointment of an independent reviewer, which may perform a role similar to a that of a monitor under DPAs in the United States or the United Kingdom.

7What are the top priorities for your country’s law enforcement authorities?

The HKPF’s priorities are violent crime and domestic violence, triads, syndicated and organised crime, dangerous drugs, public safety and the prevention of terrorism. The HKPF is also prioritising cybersecurity and technology crime, particularly criminal groups engaged in internet and telephone fraud.

The SFC’s enforcement priorities include corporate misfeasance and fraud by listed companies or senior management, insider dealing and market manipulation, intermediary misconduct and money laundering.

The HKMA’s work priorities include risk management relating to operational resilience and technology, money laundering and terrorist financing, misconduct, liquidity and market risk management, and credit.

The IA focuses on protecting and promoting the rights and interests of policy­holders and facilitating the sustainable development of the insurance industry both in Hong Kong and regionally. Starting from 23 September 2019, the IA has delegated certain inspection and investigation powers to the HKMA with respect to insurance-related businesses carried on by authorised institutions.

The ICAC has announced a focus on corruption occurring in connection with the Belt and Road Initiative and helping other countries to strengthen their anti-corruption capabilities. It continues to ensure public sector integrity and to investigate cases that violate the common law offence of misconduct in public office.

Cyber-related issues

8Does your country regulate cybersecurity? Describe the approach of local law enforcement authorities to cybersecurity-related failings.

There is no overarching legal framework for cybersecurity in Hong Kong. Entities regulated by the HKMA and the SFC must abide by the regulatory guidance issued, including the various guidelines and circulars concerning cyber risk management, resilience testing and management accountability. The Personal Data Privacy Ordinance (PDPO) addresses the security of personal data, including data storage and security measures.

Large-scale cybersecurity failings resulting in breach of personal data protection rules are treated seriously by regulators. The OPC regularly carries out investigations of such failings and issues enforcement notices, which, if not complied with, may lead to criminal sanctions.

9Does your country regulate cybercrime? What is the approach of law enforcement authorities in your country to cybercrime?

There are a number of offences under Hong Kong law targeting cybersecurity-related crimes, including unauthorised access to a computer by telecommunications under the Telecommunications Ordinance and access to a computer with criminal or dishonest intent under the Crimes Ordinance. Other offences that may be applied to prosecute cybercrime include criminal damage under the Crimes Ordinance and theft under the Theft Ordinance.

The Cybersecurity and Technology Crime Bureau (CSTCB) of the HKPF is responsible for handling cybersecurity issues, carrying out investigations into technology crime and computer forensic examinations, and the prevention of technology crime. The CSTCB also liaises closely with local and overseas law enforcement agencies for combating cross-border technology crime and to exchange experience.

Cross-border issues and foreign authorities

10Does local criminal law have general extraterritorial effect? To the extent that extraterritorial effect is limited to specific offences, give details.

The primary basis of criminal jurisdiction in Hong Kong is territorial, and the courts apply a strong presumption against construing statutes as having extraterritorial effect.

The Criminal Jurisdiction Ordinance (CJO) deals with Hong Kong’s extra­territorial criminal jurisdiction. The offences to which the CJO applies are divided into Group A offences, which include theft, fraud, deception, blackmail and offences relating to false instruments, and Group B offences, which cover conspiracy, attempting or incitement to commit a Group A offence, and the offence of conspiracy to defraud.

The CJO allows Hong Kong courts to exercise jurisdiction over offences under Groups A and B in the following circumstances:

• any one of the constituent elements of the offence occurs in Hong Kong;
• there is an attempt to commit the offence in Hong Kong, whether or not the attempt is made in Hong Kong or elsewhere and irrespective of whether it has an effect in Hong Kong;
• there is an attempt or incitement in Hong Kong to commit the offence outside Hong Kong; and
• the substantive offence was not intended to take place in Hong Kong.

As regards a conspiracy to commit a Group A offence, or conspiracy to defraud, jurisdiction depends on proof that the pursuit of the agreed course of conduct would involve conduct punishable under the law in force in the place where the conduct was intended to take place. The prosecution must also prove that:

• a party to the agreement constituting the conspiracy, or a party’s agent, did something in Hong Kong in relation to the agreement before its formation;
• a party to the conspiracy became a party in Hong Kong (by joining it either in person or through an agent); or
• a party to the conspiracy, or a party’s agent, did or omitted to do anything in Hong Kong in pursuance of it; and
• the conspiracy would be triable in Hong Kong, but the parties to it had not intended that the offence or fraud would take place in Hong Kong.

In relation to conspiracies to commit all other offences, section 159A of the Crimes Ordinance codifies the general common law rule limiting extraterritorial jurisdiction in conspiracy cases and provides that conspiracies entered into in Hong Kong are triable in Hong Kong only if the agreement is to commit substantive offences triable in Hong Kong. Conspiracies entered into abroad to commit substantive offences in Hong Kong would be triable in Hong Kong even before any acts were carried out in Hong Kong in furtherance of the conspiracies. However, conspiracies entered into in Hong Kong to commit offences abroad would not be triable in Hong Kong.

11Describe the principal challenges that arise in your country in cross-border investigations, and explain whether and how such challenges depend on the other countries involved.

Cross-border investigations may touch upon Hong Kong’s data privacy regime, or those of other countries in Asia, such that employee or customer consent may be required prior to disclosing certain protected information. Cross-border investigations involving China should be conducted in compliance with the Chinese Law on Guarding State Secrets and the new Chinese Cybersecurity Law. In certain cases, investigators may need to undertake their work on site in China with strict protocols in place to prevent the prohibited export of information to Hong Kong or elsewhere.

In July 2019, the Chinese Ministry of Finance (MOF), the CSRC and the SFC entered into a memorandum of understanding concerning the obtaining of audit working papers in China. The aim of this is to facilitate the SFC’s access to these documents when conducting investigations into Chinese companies listed in Hong Kong and their related entities or persons. Under the memorandum of understanding, the MOF and the CSRC will provide the fullest assistance in response to requests by the SFC for investigative assistance regarding the provision of audit working papers.

12Does double jeopardy, or a similar concept, apply to prevent a corporation from facing criminal exposure in your country after it resolves charges on the same core set of facts in another? Is there anything analogous in your jurisdiction to the ‘anti-piling on’ policy as exists in the United States (the Policy on Coordination of Corporate Resolution Penalties) to prevent multiple authorities seeking to penalise companies for the same conduct?

The right of an accused to advance double jeopardy is found in the Hong Kong Bill of Rights Ordinance and the Criminal Procedure Ordinance. This protection extends to corporations convicted or acquitted of an offence abroad. There is no express or specific legislation or regulation analogous to the ‘anti-piling on’ policy as exists in the United States.

13Are ‘global’ settlements common in your country? What are the practical considerations?

Generally, settlements involving more than one Hong Kong agency do not occur because one agency will have primacy to resolve the case. There is some uncertainty as to whether this will remain the case with the increased joint operation between law enforcement authorities (see question 1). With regard to global settlements involving more than one country, there are no published figures on their prevalence. The SFC has co-operative arrangements for investigatory assistance and exchange of information with many overseas regulators. In particular, the CSRC and the SFC have maintained a close strategic partnership to tackle cross-border trading misconduct. See, for example, the joint investigation into Tang Hanbo referred to in question 1.

14What bearing do the decisions of foreign authorities have on an investigation of the same matter in your country?

To facilitate investigation of the same matter, the Hong Kong authorities generally try to co-operate with their counterparts in foreign jurisdictions and in China. For example, in October 2014, the SFC and the CSRC entered into a memorandum of understanding on strengthening cross-boundary regulatory and enforcement co-operation with a view to tackling market manipulation in China and Hong Kong. See also the memorandum of understanding entered into between the MOF, the CSRC and the SFC on audit working papers referred to in question 11.

In addition, Hong Kong has mutual legal assistance agreements with a number of countries, and a number of international treaties provide for cross-border co-operation.

Economic sanctions enforcement

15Describe your country’s sanctions programme and any recent sanctions imposed by your jurisdiction.

Hong Kong generally adheres to United Nations Security Council sanctions, including pursuant to the Weapons of Mass Destruction (Control of Provisions of Services) Ordinance, the United Nations Sanctions Ordinance and the United Nations (Anti-Terrorism Measures) Ordinance with oversight by the Chinese Ministry of Foreign Affairs. Hong Kong does not currently impose unilateral or autonomous sanctions. Of note, in June 2018, Hong Kong amended the United Nations Sanctions (Democratic People’s Republic of Korea) Regulation to incorporate United Nations Security Council resolutions adopted since December 2014.

16What is your country’s approach to sanctions enforcement? Has there been an increase in sanctions enforcement activity in recent years, for example?

Multiple agencies share responsibility for the administration and enforcement of Hong Kong sanctions, including the Chief Executive, the DOJ, the HKMA, the SFC, the Commerce and Economic Development Bureau, the Customs and Excise Department, and the Trade and Industry Department. Although regulatory focus has increased, particularly for the financial sector, there have been no notable cases of criminal enforcement of Hong Kong sanctions in recent years.

17Do the authorities responsible for sanctions compliance and enforcement in your country co-operate with their counterparts in other countries for the purposes of enforcement?

Hong Kong has a variety of mutual legal assistance arrangements with foreign jurisdictions, which may be used in support of sanctions-related investigations.

18Has your country enacted any blocking legislation in relation to the sanctions measures of third countries? Describe how such legislation operates.

Hong Kong has no such legislation.

19To the extent that your country has enacted any sanctions blocking legislation, how is compliance enforced by local authorities in practice?

Not applicable.

Before an internal investigation

20How do allegations of misconduct most often come to light in companies in your country?

Whistleblower complaints, both internal and external, are a frequent source of allegations of misconduct leading to investigations, particularly with respect to bribery and corruption. The ICAC plays a critical role in receiving and investigating complaints made against individuals. Enquiries by the ICAC to companies regarding their employees’ conduct will often lead to an internal investigation to identify potential breaches of internal policy even when there is no corporate liability under the law.

Regulatory reviews by the SFC, the HKMA or other regulators are another source of allegations of misconduct. Further, corporations and institutions licensed by the SFC or the HKMA have an obligation to report material breaches (or suspected breaches) of any law, rules or regulations (including suspected misconduct) to their regulators. Specifically, corporations licensed by the SFC are expressly required to report material breaches (or suspected breaches) of market misconduct provisions under the SFO by their clients.

Information gathering

21Does your country have a data protection regime?

Hong Kong has a data protection regime that has been given statutory force through the PDPO. The PDPO applies to any data relating directly or indirectly to a living person from which it is possible to identify that person and the data is in a form in which access to or processing is practicable. The PDPO contains six data protection principles (DPPs) that govern the purpose and manner of collection, the accuracy and duration of retention, the use and security of personal data, and rights of access and correction.

22To the extent not dealt with above at question 8, how is the data protection regime enforced?

Contravening a DPP may give rise to a complaint to be investigated by the OPC. A data user may be punished under the PDPO for failing to comply with an enforcement notice issued by the Privacy Commissioner for Personal Data, after a finding of a contravention. An enforcement notice may direct the data user to take steps to remedy the contravention and prevent a recurrence. A data user may separately bring a civil claim for damages on the basis of a contravention of a DPP, whether or not the Privacy Commissioner has issued an enforcement notice.

23Are there any data protection issues that cause particular concern in internal investigations in your country?

The provisions of the PDPO cover the monitoring and gathering of data in the context of internal investigations, whether this be by monitoring the internet, telephone calls or email. An individual who suffers damage (including ‘injured feelings’) by reason of a breach may sue.

24Does your country regulate or otherwise restrict the interception of employees’ communications? What are its features and how is the regime enforced?

Interception of communications and covert surveillance are regulated by the Interception of Communications and Surveillance Ordinance and can only be exercised by the Customs and Excise Department, the HKPF and the ICAC with prescribed authorisation.

Monitoring and surveillance of employee communication is regulated by the PDPO. Prior to implementing any surveillance system, the employer must take such steps as are reasonable, in the circumstances, to ensure the employees are aware of (among other things) the fact that the information is being collected and the purpose of collection.

Dawn raids and search warrants

25Are search warrants or dawn raids on companies a feature of law enforcement in your country? Describe any legal limitations on authorities executing search warrants or dawn raids, and what redress a company has if those limits are exceeded.

Dawn raids are used by the SFC and the HKMA in the context of regulatory investigations, by the ICAC in bribery investigations and by the HKPF in relation to the commission of any offence. Dawn raids may also be used by the Competition Commission in investigating offences under the Competition Ordinance. They can take place either with a warrant issued by a magistrate or without a warrant in limited circumstances.

26How can privileged material be lawfully protected from seizure during a dawn raid or in response to a search warrant in your country?

Generally, privileged material cannot be seized during a dawn raid or in response to a search warrant. To protect privileged material from seizure, a claim of privilege should be made, and if there is a dispute as to whether certain material is privileged, the material should be sealed until the dispute is resolved. However, privilege may be overridden by a court order. Privilege will also not attach to material created for the purpose of committing a crime.

27Under what circumstances may an individual’s testimony be compelled in your country? What consequences flow from such compelled testimony? Are there any privileges that would prevent an individual or company from providing testimony?

Privilege against self-incrimination is recognised in Hong Kong. A person may decline to provide information in an investigation that may lead to self-incrimination.

An exception is that authorities such as the SFC and the HKMA may issue a notice under relevant statutory provisions compelling a witness to answer questions or produce documents, and self-incrimination is not a reason for non-compliance. However, the information provided by the person compelled by the notice will be inadmissible in evidence against the person in criminal proceedings except for certain offences, such as perjury.

Whistleblowing and employee rights

28Describe the whistleblowing framework in your country. What financial incentive schemes exist for whistleblowers? What legal protections are in place for whistleblowers?

Hong Kong currently does not have a comprehensive or overarching framework to protect whistleblowers. There exist no financial incentive schemes for whistleblowers to volunteer information. However, listed companies are encouraged to adopt a whistleblowing policy as ‘recommended best practice’ under the Hong Kong Exchanges and Clearing Limited Corporate Governance Code. The legal protections for whistleblowers are limited.

Under the Employment Ordinance, an employee giving evidence in proceedings or in response to enquiries in connection with the enforcement of the Employment Ordinance, work accidents or breach of work safety legislation is protected from dismissal and discrimination.

Other ordinances covering race, gender, family status and disability also protect individuals who act against discrimination or assist with investigations against victimisation.

Hong Kong law protects individuals who disclose suspected money laundering or other crimes by preventing the disclosure from being treated as a breach of any restrictions imposed by contract, enactment or rule of conduct.

The Competition Commission in Hong Kong has also published its Leniency Policy, which is designed to encourage companies that may have engaged in illegal activity, such as bid rigging or price-fixing, to report it in exchange for leniency.

29What rights does local employment law confer on employees whose conduct is within the scope of an investigation? Is there any distinction between officers and directors of the company for these purposes?

Employees have limited rights under local employment laws if a company conducts an investigation and may be suspended with pay if the employment contract so provides. An employee may also be suspended without pay in the limited circumstances specified in the Employment Ordinance for generally no more than 14 days. Employees are protected against wrongful, unreasonable or constructive dismissal under local legislation.

Employees have the right to a disciplinary hearing if the company handbook, manual or policy provides for such in relation to employee misconduct. Employees of government or public bodies have the right to a fair hearing.

Executive directors owe additional duties under the Companies Ordinance, the company’s articles and common law. In addition to rights they have as an employee of the company, directors also have rights under the Companies Ordinance and articles with respect to the potential threat of removal or disqualification in the case of breach of directors’ duties.

30Do employees’ rights under local employment law differ if a person is deemed to have engaged in misconduct? Are there disciplinary or other steps that a company must take when an employee is implicated or suspected of misconduct, such as suspension or in relation to compensation?

There are no statutory requirements for companies to take disciplinary steps when an employee is suspected of misconduct. However, companies’ internal policies and employment contracts may adopt disciplinary procedures for their employees. Companies in regulated industries may be required to suspend or take disciplinary action against employees who carry out regulated activities. Aside from their mandatory obligations, companies may take disciplinary action or steps to investigate misconduct as part of the company’s proper internal controls and good corporate governance.

31Can an employee be dismissed for refusing to participate in an internal investigation?

An employee may potentially be dismissed for refusing to participate in an internal investigation after failing to heed the employer’s lawful and reasonable instructions and absent any protected circumstances, such as the employee taking sick leave, maternity leave, paternity leave or work injury leave.

Commencing an internal investigation

32Is it common practice in your country to prepare a document setting out terms of reference or investigatory scope before commencing an internal investigation? What issues would it cover?

It is common practice for an internal investigation to begin with the drafting of an investigation plan detailing the objectives, scope, roles and responsibilities for the investigation. A clearly defined communications plan and the protocol for maintaining legal professional privilege are also essential from the earliest stages. Increasingly, scoping documents will also identify data custodians and outline procedures for electronic document review.

33If an issue comes to light prior to the authorities in your country becoming aware or engaged, what internal steps should a company take? Are there internal steps that a company is legally or ethically required to take?

Depending on the nature of the issue, necessary internal steps could be managed by a company’s compliance or legal department in less serious cases, or senior management and the board of directors in the more serious cases. Under the supervision of legal counsel to ensure the protection of legal professional privilege, a company should gather and secure any relevant documents and data, and interview key employees to ensure the continued availability of critical information. Corrective action plans or disciplinary measures should be adopted to address gaps or breaches in compliance controls, which may earn a company mitigation credit in any related enforcement actions.

34What internal steps should a company in your country take if it receives a notice or subpoena from a law enforcement authority seeking the production or preservation of documents or data?

Ideally, a company should have an established protocol for responding to law enforcement requests, subpoenas or dawn raids, including procedures for the preservation of relevant documents and data. The legal department should issue a preservation notice to all relevant employees immediately upon receiving a law enforcement request, or if it believes that such a request or legal proceedings may be forthcoming. Paper documents and electronic data on servers, laptops, mobile devices or other media should be collected from relevant custodians and logged under the supervision of legal counsel and the company’s information technology department. Privileged communications should be segregated and clearly stamped to help prevent accidental disclosure.

35At what point must a company in your country publicly disclose the existence of an internal investigation or contact from a law enforcement authority?

There is no general duty to publicly disclose the existence of an internal investigation or contact from law enforcement (indeed, most agencies impose a secrecy obligation on the subjects of an investigation). The exception is in the case of a listed company when such facts would constitute price-sensitive information, as defined under the SFO, unless exempted or when the SFC has granted a waiver (e.g., in cases involving disclosure restrictions imposed by a foreign government authority). Conversely, there are strict prohibitions against publicly reporting details of investigations by the ICAC for both listed and unlisted companies.

36How are internal investigations viewed by local enforcement bodies in your country?

In most cases, the authorities recognise the need for, and welcome, at least initial or preliminary internal investigations carried out by corporations. Those corporations licensed by the SFC have a regulatory duty to self-report when there is a material breach (or suspected breach) by their employees of any rules administered by the SFC, or when there is a material breach (or suspected breach) by their clients of any market misconduct provisions under the SFO. Particular care must be taken to avoid tipping off, whereby corporations are prohibited (except with the authorities’ consent) from disclosing the existence of the authorities’ investigations to a third party, which may include their employees and their clients.

Attorney–client privilege

37Can attorney–client privilege be claimed over any aspects of internal investigations in your country? What steps should a company take in your country to protect the privilege or confidentiality of an internal investigation?

Legal professional privilege can be claimed over various aspects of an internal investigation.

Case law holds that the whole process of obtaining and giving legal advice should be privileged. Therefore, internal communications (including those between employees of a non-legal function) and materials generated during the information-gathering process of an internal investigation (such as minutes of meetings and interview notes) for the dominant purpose of obtaining and giving legal advice could be privileged. However, legal advice privilege will not attach to communications with, or materials prepared by, a third party (unless the communications or materials are for the dominant purpose of obtaining or seeking legal advice), nor will it cover legal advice given by persons who are not legally qualified (e.g., tax accountants).

During an internal investigation, confidential communications or documents prepared for the dominant purpose of obtaining information or evidence for use in actual or reasonably contemplated litigation – even if the communications are merely for the purpose of establishing facts – will be covered by litigation privilege. To protect privilege, the company should:

• involve lawyers (whether in-house or external counsel) as soon as it is apparent that legal advice is likely to be required;
• avoid creating unnecessary records (where there is no prospect of litigation) that summarise, quote or amend the legal advice received;
• limit circulation of privileged documents on a strictly need-to-know basis;
• manage documents effectively by separating privileged and non-privileged documents; and
• ensure that all documents that are considered to be protected by legal professional privilege are clearly marked ‘privileged and confidential’.

38Set out the key principles or elements of the attorney–client privilege in your country as it relates to corporations. Who is the holder of the privilege? Are there any differences when the client is an individual?

Under Hong Kong law, legal professional privilege falls into two categories:

• Legal advice privilege attaches to communications between a client and his or her legal adviser for the purposes of giving and receiving legal advice.
• Litigation privilege attaches to confidential communications between a legal adviser and the client, and to communications between a legal adviser or client and a third party if three conditions are met: litigation is in progress or reasonably in contemplation; the communications are made with the sole or dominant purpose of conducting the actual or anticipated litigation; and the litigation is adversarial, not investigative or inquisitorial.

The privilege belongs to, and can only be waived by, the client and not his or her legal adviser.

In the corporate context, it is advisable to identify the employees authorised to act for the company to seek legal advice for the purposes of claiming legal advice privilege, as English and Hong Kong law have diverged in recent years on this issue.

39Does the attorney–client privilege apply equally to in-house and external counsel in your country?

Legal professional privilege applies equally to in-house and external counsel. However, privilege will only cover communications made by an in-house lawyer acting in a legal (not a managerial) capacity.

40Does the attorney–client privilege apply equally to advice sought from foreign lawyers in relation to (internal or external) investigations in your country?

Legal professional privilege applies equally to advice sought from foreign lawyers if the advice is given in Hong Kong. If the advice is given from outside Hong Kong, it is possible that privilege can be asserted under Hong Kong law even if the home jurisdiction of the foreign lawyer does not recognise legal professional privilege.

41To what extent is waiver of the attorney–client privilege regarded as a co-operative step in your country? Are there any contexts where privilege waiver is mandatory or required?

Waiver of legal professional privilege (usually limited) is generally regarded as a sign of co-operation by authorities in a regulatory investigation, although it is not mandatory.

42Does the concept of limited waiver of privilege exist as a concept in your jurisdiction? What is its scope?

The Court of Appeal has confirmed that a waiver of privilege with regard to one party does not automatically mean that privilege has been waived at large and that privilege is not waived because a privileged document has been disclosed for a limited purpose. The scope of the waiver is determined by the party waiving the privilege. Where privilege is waived for a limited purpose, it is important to ensure that the terms and scope of the limited waiver are clear.

43If privilege has been waived on a limited basis in another country, can privilege be maintained in your own country?

Generally, privilege will not be lost because a privileged document has been disclosed for a limited purpose.

Whether privilege can be maintained if it has been partly waived in another country will depend on a number of factors, including, but not limited to:

• whether the concept of limited or partial waiver is recognised in the country where privilege has been waived;
• the scope and terms of the waiver; and
• whether any statutory provision overrides privilege.

44Do common interest privileges exist as concepts in your country? What are the requirements and scope?

Common interest privilege exists in Hong Kong. Privilege will not be waived if privileged material is disclosed to a third party who shares a common interest in the subject matter of the privileged material. Common interest must exist at the time when the privileged material is disclosed to the third party.

45Can privilege be claimed over the assistance given by third parties to lawyers?

Communications between a third party and the lawyer (or the client) are protected from disclosure by litigation privilege if they are made for the dominant purpose of obtaining information or evidence for use in actual or reasonably contemplated litigation. However, legal advice privilege will generally not apply to communications with third parties (see question 37).

Witness interviews

46Does your country permit the interviewing of witnesses as part of an internal investigation?

Yes. There is no general prohibition under Hong Kong law against interviewing witnesses as part of the information-gathering process in an internal investigation.

47Can a company claim attorney–client privilege over internal witness interviews or attorney reports?

Legal advice privilege is often claimed for the records of internal witness interviews. Case law in Hong Kong suggests that a corporation may argue that legal advice privilege exists regarding such records if the interviews are conducted (or the reports are compiled) for the dominant purpose of obtaining and giving legal advice during the internal investigation. This is in contrast to the position in England, for example.

Litigation privilege may only be claimed if it is established that the witness interviews are conducted for the dominant purpose of use in an actual or reasonably contemplated litigation.

48When conducting a witness interview of an employee in your country, what legal or ethical requirements or guidance must be adhered to? Are there different requirements when interviewing third parties?

Whether the interviewee is an employee or a third party, it is recommended that they be informed that:

• the interview is part of a fact-finding exercise;
• the lawyer conducting the interview represents the company, not the interviewee;
• the interview is protected by legal professional privilege belonging to the company, which can choose to disclose the contents of the interview to third parties, including regulators and authorities, without the interviewee’s permission;
• the interviewee may provide personal information covered by data protection laws, which will only be used for the fact-finding or review exercise. This exercise may involve sharing the interviewee’s personal information with other advisers working for the company, regulators and authorities; and
• the contents of the interview are confidential and should not be shared with any other person (including other employees).

49How is an internal interview typically conducted in your country? Are documents put to the witness? May or must employees in your country have their own legal representation at the interview?

The internal interview will typically be attended by in-house legal counsel and any specialised investigation team with or without external counsel (depending on the nature and seriousness of the issues involved). Relevant documents are typically put to the witness at the internal interview for reference, comment and explanation, as necessary. There is no legal requirement that employees have their own legal representation at an internal interview, and this is not common in practice.

Reporting to the authorities

50Are there circumstances under which reporting misconduct to law enforcement authorities is mandatory in your country?

Generally, a person is under no positive obligation to report crimes or provide assistance to law enforcement authorities, aside from suspicious transaction reports under anti-money laundering laws, which are mandatory, and certain exceptions for licensed corporations and financial institutions.

51In what circumstances might you advise a company to self-report to law enforcement even if it has no legal obligation to do so? In what circumstances would that advice to self-report extend to countries beyond your country?

While there is no formal arrangement or mechanism for deferred prosecution agreements in Hong Kong, it may be advisable for a company to self-report with a view to demonstrating its proactive and full co-operation with the authorities, which may militate against a decision to prosecute or be considered as a mitigating factor in sentencing.

Whether the self-report should extend to foreign countries will depend on the nature and extent of the issues involved, in particular whether it has a cross-border, regional or global element.

52What are the practical steps you need to take to self-report to law enforcement in your country?

A company should undertake appropriate internal investigations to ascertain the nature and extent of the issues, and to ensure the contents of any self-report are correct and not misleading (including through any material omission). It should also seek legal advice on the applicable self-reporting obligations.

For licensed corporations and financial institutions that are under a regulatory duty to self-report, a balance needs to be struck between making timely self-reports and ensuring that reports are correct and not misleading.

Responding to the authorities

53In practice, how does a company in your country respond to a notice or subpoena from a law enforcement authority? Is it possible to enter into dialogue with the authorities to address their concerns before or even after charges are brought? How?

Hong Kong enforcement agencies, such as the ICAC and the SFC, have extensive powers to compel information to be provided to them by corporations involved in investigations, and there is very little that can be done to challenge requests for information when they are made.

However, it would be unusual for criminal charges to be brought against a corporation without it having an opportunity to discuss the circumstances of the allegations with the enforcement agency. In financial misconduct investigations, the twin regulatory and criminal nature of the supervisory jurisdiction of the SFC and the HKMA means that there would be an opportunity for representations to be made by the corporation, through its lawyers, as to the circumstances, and the proposed remediation, prior to criminal charges being brought.

54Are ongoing authority investigations subject to challenge before the courts?

The circumstances under which an ongoing investigation could be challenged in the courts are difficult to envisage, short of provable mala fides on the part of the enforcement agency.

55In the event that authorities in your country and one or more other countries issue separate notices or subpoenas regarding the same facts or allegations, how should the company approach this?

These circumstances are most likely to arise in the context of financial regulatory investigations by regulators in different jurisdictions, or international anti-bribery enforcement under the US Foreign Corrupt Practices Act or the Bribery Act in the United Kingdom. In circumstances in which the notices or subpoenas have been validly issued, warrant substantive responses and relate to identical subject matter, it is advisable to adopt consistent disclosure with each agency. Further, assuming that a financial institution’s operations are international in nature, coupled with self-reporting obligations imposed in other countries (most notably the United States and the United Kingdom), this usually means that some form of notification or reporting to overseas regulators would be required even in the context of an investigation that primarily concerns Hong Kong, and in the absence of any separate notices or subpoenas being issued by overseas regulators. Given the increasing prevalence of international co-operation between regulators and criminal enforcement agencies, a failure to disclose certain matters in one jurisdiction may well be apparent and seized on as an indication of inadequate compliance or co-operation.

Assuming that the investigation primarily concerns Hong Kong, it is advisable to adopt the disclosure made to the local regulators (e.g., the SFC or the HKMA) as a ‘base’ document in framing the appropriate disclosure to overseas regulators with reference made to the nexus with other countries (e.g., by reason of the institution’s or an individual’s licensing status, client impact, and so on). Care should also be taken to ensure that notification has been given to, and in appropriate cases, consent obtained from, the local regulators, before overseas notification or disclosure is made. In particular, the SFC almost always insists that its written consent be obtained before a licensed corporation can disclose the existence or content of an ongoing investigation, even to an overseas regulator.

56If a notice or subpoena from the authorities in your country seeks production of material relating to a particular matter that crosses borders, must the company search for, and produce material, in other countries to satisfy the request? What are the difficulties in that regard?

Under notices issued by the various Hong Kong enforcement agencies, companies may be required to produce material in their possession, custody, control or power, whether this is located in other countries or solely in Hong Kong, subject to having a reasonable excuse not to do so.

This may give rise to issues in some foreign jurisdictions, where the transmission of certain types of information outside that country may be prohibited by local law. In Hong Kong, exposure to criminal liability under foreign law would not constitute a reasonable excuse for non-compliance with a notice or subpoena. This applies in circumstances where a reasonable person would conclude that the Hong Kong public interest in the investigation of criminal activities outweighs any public or private interest in compliance with the foreign law. However, if there are alternative means of obtaining the documents without materially adverse consequences to the investigation, a real and appreciable risk of prosecution under foreign law would constitute a reasonable excuse for non-compliance.

A related issue arises as to the extent that the company is required to produce relevant material in the possession, custody or power of its parent, subsidiary or an associated company (which may be incorporated in other countries). In general terms, this depends on whether the company subject to investigation (the subject company) has a presently enforceable legal right to obtain the documents from such other companies without the need to obtain the consent of anyone else. This is a question of fact, which depends on whether the subject company has sufficient control over the other companies such that the documents in the possession, custody or power of such other companies can be said to be in fact within the power of the subject company.

57Does law enforcement in your country routinely share information or investigative materials with law enforcement in other countries? What framework is in place in your country for co-operation with foreign authorities?

Hong Kong regulators, including the HKMA and the SFC, have signed memoranda of understanding to establish co-operative arrangements that include the sharing of information with foreign counterparts, including those in China (see questions 11 and 14). One of the most important of these is the International Organisation of Securities Commissions Multilateral Memorandum of Understanding, which was the first global information-sharing arrangement among securities regulators.

Hong Kong authorities routinely co-operate with their foreign counterparts reciprocally in criminal matters under the framework established in the Mutual Legal Assistance in Criminal Matters Ordinance. However, this particular legislation is not applicable to China, Macao or Taiwan, and there was a failed attempt in June 2019 by the Hong Kong government to expand a modified regime to cover these jurisdictions.

58Do law enforcement authorities in your country have any confidentiality obligations in relation to information received during an investigation or onward disclosure and use of that information by third parties?

Information provided to enforcement authorities in Hong Kong confidentially during an investigation will remain confidential, except to the extent that its use is necessary within an investigation, prosecution or regulatory enforcement. While it may be shared with other enforcement agencies or regulators under the information-sharing agreements referred to in question 57, it would not be disclosed to other third parties without an order from a court.

59How would you advise a company that has received a request from a law enforcement authority in your country seeking documents from another country, where production would violate the laws of that other country?

It may be possible to refuse production on the grounds that the foreign illegality constituted a reasonable excuse not to produce the documents under the relevant legislation. However, this would be a difficult argument on which to succeed. These issues should be brought to the attention of the enforcement agency, which should consider whether assistance could be sought under formal channels from the agency in the foreign jurisdiction, to allow the documents to be produced without violating foreign law.

60Does your country have secrecy or blocking statutes? What related issues arise from compliance with a notice or subpoena?

There are no blocking statutes as such in Hong Kong.

The jurisdiction to order corporations and individuals to provide evidence in aid of foreign proceedings is derived from Part VIII of the Evidence Ordinance. Section 75 of the Evidence Ordinance requires the application to be made pursuant to a ‘request issued by or on behalf of a court’ outside Hong Kong. In terms of procedure, therefore, a letter of request is required and order 70 of the Rules of the High Court provides the procedural framework for taking evidence or obtaining documents from a Hong Kong entity.

61What are the risks in voluntary production versus compelled production of material to authorities in your country? Is this material discoverable by third parties? Is there any confidentiality attached to productions to law enforcement in your country?

Care must be taken to ensure compliance with a company’s confidentiality obligations in relation to information. If disclosure to an authority is voluntary, rather than compelled, then the disclosure may violate these obligations.

Law enforcement authorities in Hong Kong must maintain the confidentiality of confidential disclosures made to them (whether voluntary or compelled), except to the extent that they choose to share them with other enforcement authorities, or use the information in an investigation, prosecution or regulatory enforcement action.

Prosecution and penalties

62What types of penalties may companies or their directors, officers or employees face for misconduct in your country?

Companies or their directors, officers or employees may face disciplinary action – and, in the case of directors, disqualification – and attract potential civil or criminal liability for misconduct in Hong Kong. For entities regulated by the SFC, misconduct would include breaches of the SFO, contravention of the terms of any SFC licence or any act prejudicial to the public interest. Sanctions may include a private or public reprimand, a fine of up to HK$10 million or three times the profit gained or loss avoided, revocation or suspension of licences or registrations, and a ban on regulated persons from applying to be licensed or approved as a responsible officer.

The SFC has powers under the SFO to seek criminal prosecution by the DOJ and, in practice, the SFC refers all market misconduct cases to the DOJ for advice. The maximum penalties for a person convicted of a market misconduct offence are imprisonment for 10 years and a fine of HK$10 million.

The SFC may also institute civil proceedings before the High Court or the Market Misconduct Tribunal (MMT).

63Where there is a risk of a corporate’s suspension, debarment or other restrictions on continuing business in your country, what options or restrictions apply to a corporate wanting to settle in another country?

It depends on the laws of the other country in which the corporate wants to settle. The risk of a corporate’s suspension, debarment or other restrictions on continuing business in Hong Kong does not, as a matter of Hong Kong law, restrict the corporate from settling in another country; however, there may be legal requirements in that other country (e.g., disclosure obligations) that allow a regulator or law enforcement agency in that country to reopen a settlement if it subsequently discovers the restrictions on the corporate in Hong Kong of which it has not been previously informed.

64What do the authorities in your country take into account when fixing penalties?

The authorities will consider all the circumstances of the case, including (1) the nature and seriousness of the conduct, (2) the value of profits accrued or loss avoided, (3) other circumstances of the firm or individual, and (4) other relevant factors.

In considering the nature and seriousness of market misconduct, the SFC will have regard to the effects of the conduct on market integrity, the costs of the conduct caused to clients or the investing public, the duration and frequency of the conduct, whether there is a breach of fiduciary duty and whether any serious or systematic management or internal control failures are revealed. The SFC will also consider the degree of co-operation with the SFC and other authorities.

Resolution and settlements short of trial

65Are non-prosecution agreements or deferred prosecution agreements available in your jurisdiction for corporations?

There are no formal mechanisms in Hong Kong for the negotiated settlement of criminal investigations or proceedings that are equivalent to DPAs in the United Kingdom or the United States. However, in some limited circumstances, negotiations with, or representations made to, the SFC and the DOJ may result in a decision being taken not to prosecute.

66Does your jurisdiction provide for reporting restrictions or anonymity for corporates that have entered into non-prosecution agreements or deferred prosecution agreements until the conclusion of criminal proceedings in relation to connected individuals to ensure fairness in those proceedings?

Not applicable.

67Prior to any settlement with a law enforcement authority in your country, what considerations should companies be aware of?

The SFC has wide powers to enter into settlement agreements under the SFO, and may do so if this is in the public interest. In considering settlement, aside from considering factors such as the strength of the prosecution and defence cases, the costs and reputational damage of a lengthy investigation and potential subsequent legal proceedings, and possible penalties, institutions should also be aware that the SFC may insist on a public reprimand of the financial institution via an announcement on the SFC’s website. The SFC will take into account the degree of co-operation in considering the settlement package.

68To what extent do law enforcement authorities in your country use external corporate compliance monitors as an enforcement tool?

Not applicable.

69Are parallel private actions allowed? May private plaintiffs gain access to the authorities’ files?

The SFO gives a person who has suffered pecuniary loss as a result of market misconduct the right to bring a civil action to seek compensation. Compensation will only be payable if it is fair, just and reasonable in the circumstances of the case. Findings of the MMT in relation to market misconduct will be admissible as prima facie evidence in the private action, though proceedings before the tribunal are not a prerequisite for bringing civil proceedings. The SFC will not intervene in private legal proceedings.

Publicity and reputational issues

70Outline the law in your country surrounding publicity of criminal cases at the investigatory stage and once a case is before a court.

In practice, law enforcement agencies do not normally publish the commencement of investigations of criminal cases (although they sometimes announce high-profile arrests or dawn raids). Publicity usually follows when a decision has been made to charge an individual or during criminal proceedings once instituted. Criminal trials in Hong Kong are conducted in open court. Some agencies, such as the SFC or the ICAC, publicise the outcome of enforcement proceedings they have initiated on their websites from time to time.

71What steps do you take to manage corporate communications in your country? Is it common for companies to use a public relations firm to manage a corporate crisis in your country?

There are no particular factors specific to Hong Kong in managing corporate communications in Hong Kong. The steps are likely to be similar to those that would be taken to manage corporate communications in other jurisdictions, for example, timely, accurate and effective messages using the right media channels, while being sensitive and perceptive to the geo­political environment. Public relations and media companies can be and have been used in Hong Kong to manage certain corporate crises.

72How is publicity managed when there are ongoing related proceedings?

Publicity is usually managed by a press officer or communications department that will monitor media reports and suggest the making of public statements as and when necessary. Any public statements made by the company should be carefully drafted and any prejudicial effects on ongoing proceedings should be taken into consideration.

Duty to the market

73Is disclosure to the market in circumstances where a settlement has been agreed but not yet made public mandatory?

For a listed corporation, settlement of a regulatory investigation may constitute inside information (depending on the nature and severity of the underlying offence or misconduct) and thus require disclosure as soon as reasonably practicable. In practice, the corporation and the authorities will usually agree on a press release being issued as part of the settlement and will agree on the timing for the release.

By way of context, inside information is defined to include specific information about the corporation that is not generally known to the public but would, if generally known, be likely to materially affect the price of the listed securities. Under Part XIVA of the SFO, a listed corporation must, as soon as is reasonably practicable after it becomes aware or is notified of any inside information, disclose the information to the public (subject to certain exceptions).

Anticipated developments

74Do you expect to see any key regulatory or legislative changes emerge in the next year or so designed to address corporate misconduct?

We do not expect the formalisation of DPAs in the next year or so in Hong Kong. Corporate misconduct, in particular, by listed companies, will remain a key enforcement priority of the SFC, the ICAC and the HKPF.

We also expect closer co-operation between the SFC and the CSRC in cross-border investigations, in particular concerning market manipulation in the context of the China-Hong Kong Stock Connect programme, and increased joint operations between enforcement agencies within Hong Kong, such as those mounted by the SFC and the ICAC into corporate misfeasance (see question 1).

Footnotes