Hong Kong

General context, key principles and hot topics

1 Identify the highest-profile corporate investigation under way in your country, describing and commenting on its most noteworthy aspects.

The Hong Kong Securities and Futures Commission (SFC) remains active in pursuing alleged corporate misfeasance by listed companies, as well as members of their current or former senior management. As noted in its 2021 Annual Report, the SFC commenced three civil and market misconduct tribunal proceedings in the reporting year against listed companies suspected of embellishing their financial statements or sales revenue in the listing prospectus and entering into overpriced acquisitions, and against directors allegedly siphoning off assets. In the same year, for similar misconduct, disqualification orders of between three and nine years were obtained against former officers and senior executives in three cases (Shandong Molong, EganaGoldpfeil and Long Success). Shandong Molong was further ordered to reconstitute its audit committee and, as against the relevant directors of EganaGoldpfeil, compensation of HK$622 million was ordered. The Stock Exchange of Hong Kong Limited also revised its Listing Rules to enhance its disciplinary powers and sanctions, including introducing secondary liability on relevant parties such as senior management, and a new sanction in the form of a public statement that, in its opinion, a director is unsuitable to occupy the position, indicating its continued focus on misconduct by individuals. Further, there are developments as far as the Financial Reporting Council (FRC) is concerned, which, among other things, seeks to improve the overall quality of audits performed on Hong Kong-listed companies. In October 2021, the FRC commenced an inquiry into the financial statements of China Evergrande Group and an investigation into the audit carried out by PricewaterhouseCoopers (PwC) identifying questions about the adequacy of going concern reporting.

One of the SFC’s top enforcement priorities in 2020 and 2021 was combating online ‘ramp and dump’ schemes. In March 2021, the SFC and the Hong Kong Police Force (HKPF) conducted a joint operation against a syndicate suspected of operating ramp and dump schemes involving suspected fraud and money laundering offences in addition to market misconduct offences under the Securities and Futures Ordinance (Cap. 571) (SFO). Twelve people, including those believed to be the ringleaders, were arrested during a joint search of 27 premises across Hong Kong. Prior to the operation, 16 restriction notices had been issued and HK$860 million in assets frozen. This was followed by a further joint operation in April 2021 involving a search of office premises of a Hong Kong-listed company. Three senior executives were arrested for allegedly conspiring to use bogus transactions to embezzle funds. Other than money laundering, corruption may also be involved in ramp and dump schemes. This is illustrated by a joint operation in July 2021 conducted by the SFC and the Independent Commission Against Corruption (ICAC) concerning a suspected ramp and dump scheme. A senior executive of a listed company was arrested for suspected associated corruption offences while the operation involved a search of the offices of the listed company and one of its underwriters in its initial public offering.

There continues to be a focus on anti-money laundering (AML) and counter-terrorism financing. A record fine in the region of HK$2.7 billion was imposed by the SFC in October 2020 for serious lapses and deficiencies in AML controls in the context of bond offerings by 1Malaysia Development Berhad. In 2020 and up to July 2021, there were five other cases involving AML control failures leading to fines of between HK$3.7 million and HK$25.2 million.

The SFC works closely with the ICAC. Following a joint operation with the SFC, the ICAC charged a number of former executive directors of Convoy Global Holdings Limited, and managers, with conspiracy to defraud in July 2019. In October 2021, they were convicted and sentenced to between four and seven months’ imprisonment. Two former executive directors were also disqualified from being company directors for three years and two years, respectively.

There is also continued close co-operation between the SFC and the Mainland Chinese regulators, including the China Securities Regulatory Commission (CSRC) and the China Banking Regulatory Commission. As a recent example, the CSRC assisted the SFC in the latter’s investigation of Shandong Molong, as discussed above.

2 Outline the legal framework for corporate liability in your country.

The law of Hong Kong has followed the common law of England and Wales in ascribing corporate liability for criminality, and has developed two main techniques for attributing to a corporate the acts and states of mind of the individuals it employs:

• the ‘identification principle’, whereby, subject to some limited exceptions, a corporate entity may be indicted and convicted for the criminal acts of the directors and managers who represent its directing mind and will, and who control what it does; and
• vicarious liability, under which a corporation is liable for the criminal acts of its employees or agents under statutory offences that impose an absolute duty on the employer.

A number of offences in Hong Kong legislation target corporates and regulate business activity. They include offences provided in the Companies Ordinance, the SFO, the Trade Descriptions Ordinance and the Theft Ordinance.

3 Which law enforcement authorities regulate corporations? How is jurisdiction between the authorities allocated? Do the authorities have policies or protocols relating to the prosecution of corporations?

Corporations are subject to investigation or regulation by a number of authorities, including the ICAC, the HKPF, the Customs and Excise Department, the Companies Registry, the Inland Revenue Department, the SFC, the Hong Kong Monetary Authority (HKMA), the Insurance Authority (IA), the Competition Commission and the Office of the Privacy Commissioner (OPC).

By way of illustration of the allocation of jurisdiction between Hong Kong authorities, regulation by the SFC and the HKMA of registered institutions and their executive officers and management is governed by the 2002 memorandum of understanding, as amended in 2004. For example, the SFC has the statutory power to discipline a former relevant individual. In November 2020, the SFC banned a former relationship manager of two banks from re-entering the industry for 21 months following investigation and referral by the HKMA for failing to disclose personal securities accounts and conducting securities transactions without clearance or reporting. In May and September 2020, following referral by the HKMA, the SFC reprimanded and fined two banks HK$7 million and HK$4.2 million respectively for control failures in relation to the sale of collective investment schemes and the failure to segregate client and proprietary securities in custodian accounts.

Hong Kong’s Department of Justice (DOJ) has overall responsibility for conducting criminal prosecutions; the other authorities named above conduct investigations and sometimes carry out prosecutions, depending on the offences involved. For example, the SFC is only empowered to prosecute offences under the SFO in the magistrates’ courts, where the power to impose penalties is more restricted. The SFC is required to refer cases to the DOJ for prosecution of offences under the SFO in the District Court and the Court of First Instance: in August 2020, criminal prosecution was commenced for offences under the SFO against five individuals involved in alleged false trading of shares of Ching Lee Holdings Limited in the Court of First Instance for a trial by jury, which is the first of its kind. There has also been an increase in co-operation between law enforcement authorities in mounting joint investigations. The SFC signed memorandums of understanding with the IA in September 2020 to cover case referrals, joint investigations and information sharing following the introduction of direct regulation of insurance intermediaries and to facilitate supervision of entities and financial groups of regulatory interest to both regulators, and with the Financial Reporting Council (FRC) in February 2021 to improve the overall quality of audits performed on Hong Kong-listed companies by sharing expertise and resources, including in joint investigations. The FRC (Amendment) Bill 2021 was passed by the Legislative Council on 22 October 2021. It will take effect after it is signed by the Chief Executive and promulgated by way of publication in the Gazette as an ordinance; the date of operation will be a day to be appointed by the Secretary for Financial Services and the Treasury. The Bill transfers regulatory powers from the self-regulating Hong Kong Institute of Certified Public Accountants to the independent FRC, which will become the Accounting and Financial Reporting Council (AFRC). The AFRC will regulate public interest entity or listed company auditors, including exercising powers of inspection, investigation and discipline, and certified public accountants and practice units.

4 What grounds must the authorities have to initiate an investigation? Is a certain threshold of suspicion necessary to trigger an investigation?

In general, criminal authorities must have reasonable grounds to suspect that a crime has been committed before starting an investigation. The threshold of suspicion is relatively low.

5 How can the lawfulness or scope of a notice or subpoena from an authority be challenged in your country?

A challenge to a search and seizure warrant or production order, and a request to exclude evidence gathered as a result, can be made based on scope, the grounds on which the order was obtained, legal professional privilege or public interest grounds through an application to the Hong Kong courts.

6 Does your country make use of co-operative agreements giving immunity or leniency to individuals who assist or co-operate with authorities?

Deferred prosecution agreements (DPAs) are commonly used by prosecutors and regulators in the United States and the United Kingdom. Although they have not been formally introduced in Hong Kong, different Hong Kong regulators have, in practice, their own co-operation arrangements. For example, the ICAC or the HKPF from time to time grant perpetrators immunity from prosecution in return for co-operation, after consultation with the DOJ. Both the SFC and the HKMA have published guidance notes on co-operation in investigations and enforcement proceedings under which a person may obtain a credit on the disciplinary penalty if they settle with the regulators. These guidance notes do not apply to criminal cases over which the DOJ has sole discretion. It is also common for the SFC or the HKMA to require, as a part of a settlement, the appointment of an independent reviewer, who may perform a role similar to a that of a monitor under DPAs in the United States or the United Kingdom.

7 What are the top priorities for your country’s law enforcement authorities?

The HKPF’s priorities are syndicated and organised crime, money laundering and ‘quick cash’ crime (e.g., theft, extortion and deception). The HKPF is also prioritising cybersecurity and technology crime, particularly through the internet and social media.

The SFC’s enforcement priorities include investment fraud and online investment scams, including ramp and dump schemes, corporate misfeasance and fraud by listed companies or senior management (such as listed companies embellishing their financial results or directors misappropriating assets), intermediary misconduct and money laundering.

The HKMA’s priorities include risk management relating to money laundering and the financing of terrorism, digitalisation including remote customer onboarding and non-face-to-face distribution, operational and cyber resilience, management of online fraud and financial crime risk, green and sustainable banking, smooth transition away from the London Inter-Bank Offered Rate (LIBOR) and credit risk.

The IA focuses on protecting and promoting the rights and interests of policy­holders and facilitating the sustainable development of the insurance industry both in Hong Kong and regionally. From 23 September 2019, the IA took over regulation of insurance intermediaries from three self-regulatory organisations and delegated certain inspection and investigation powers to the HKMA with respect to insurance-related businesses carried on by authorised institutions. The group-wide supervision framework came into effect in March 2021 providing for regulation of multinational insurance groups through power over Hong Kong-incorporated holding companies.

The ICAC continues with a relatively even focus on combating corruption in both the public and private sectors. In terms of corruption complaints recorded in 2020, 41 per cent concerned government departments and public bodies and 59 per cent concerned the private sector. The areas attracting the most complaints in the private sector were building management, construction, finance and insurance. The ICAC also has a proceeds of crime section to deal with restraint, disclosure and confiscation of assets under the Organised and Serious Crimes Ordinance (Cap. 455) and provided input to the HKPF regarding the money laundering threat in respect of the predicate offence of corruption.

8 To what extent do law enforcement authorities in your jurisdiction place importance on a corporation having an effective compliance programme? What guidance exists (in the form of official guidance, speeches or case law) on what makes an effective compliance programme?

Save for the financial industry, which is heavily regulated, and Hong Kong-listed companies (although these are not directly regulated by a law enforcement authority, per se), Hong Kong does not have statutorily mandated compliance programmes that are required of all corporations generally, and there is no statutory leniency offered to corporations with a compliance programme. That notwithstanding, it is good practice to have an effective compliance programme in place, and some law enforcement authorities, such as the ICAC, have published guidance encouraging corporations to set up such programmes.

In respect of the financial industry, for persons licensed by or registered with the SFC, one of the nine general principles in the Code of Conduct is compliance. Paragraph 4.3 of the Code of Conduct provides that a licensed corporation should have internal control procedures that reasonably protect operations, clients and other persons from financial loss occasioned by theft, fraud and other dishonesty, as well as from professional misconduct, and the SFC has issued the Management, Supervision and Internal Control Guidelines (April 2003) to provide further guidance with respect to the SFC’s expectations in relation to internal controls. Similarly, with respect to authorised institutions (i.e., banks and deposit-taking companies), the HKMA has issued a Supervisory Policy Manual on Risk Management Frameworks, which provides that banks are expected to have a programme in place to ensure compliance with applicable statutory provisions, regulatory requirements and codes of conduct.

Listed companies are subject to the Listing Rules, appended to which is the Corporate Governance Code (the CG Code), which covers such areas as board practice and composition; director remuneration and responsibilities; delegation; supply of information to directors; financial reporting; audit committee; company secretary; and communication with shareholders. It sets out the principles of good corporate governance at two levels: code provisions and recommended best practices. The CG Code adopts the comply or explain approach; listed companies must state whether they have complied with the code provisions in their interim and annual reports and, if they have not, give considered reasons. This approach is encouraged, but not required, for recommended best practices. The CG Code provides that the board is responsible for determining the nature and extent of the risks it is willing to take in achieving the listed company’s strategic objectives, and ensuring the listed company establishes and maintains appropriate and effective risk management and internal control systems. The board should oversee management in the design, implementation and monitoring of these systems. The board should ensure that a review of the effectiveness of the systems is conducted at least annually, and report to shareholders that it has done so, and whether the listed company considers the systems effective and adequate in its corporate governance report. The review should cover all material controls such as financial, operational and compliance. Failure to report will be regarded a breach of the Listing Rules.

Cyber-related issues

9 Does your country regulate cybersecurity? Describe the approach of local law enforcement authorities in your country to cybersecurity-related failings.

There is no overarching legal framework for cybersecurity in Hong Kong. Entities regulated by the Hong Kong Securities and Futures Commission (SFC), Hong Kong Monetary Authority (HKMA) and Insurance Authority (IA) must abide by the various guidelines and circulars concerning cyber risk management, resilience testing and management accountability.

In October 2017, the SFC published guidelines requiring all licensed corporations engaged in internet trading to implement 20 baseline requirements covering preventive, detection and internal governance-related controls. At the same time, the SFC issued a circular advising that the guidelines are only minimum standards and senior management should ensure that all systems and controls are commensurate with business needs and operations, and implement additional cybersecurity controls as necessary. Under the April 2003 Management, Supervision and Internal Control Guidelines of the SFC, licensed persons are required to implement an effective business continuity plan appropriate to their size to ensure that they are protected from interruption risk, which may arise from a cyberattack.

The HKMA issued a circular in September 2015 stating that senior management should evaluate periodically the adequacy of an authorised institution’s cybersecurity controls having regard to emerging cyber threats and credible cybersecurity control benchmarks. The circular also pinpointed the need for contingency planning and independent assessment. In May 2021, the HKMA issued a further circular requesting critical assessment of the need for secure tertiary data backup to counter the risk of cyber­attacks. In addition, the HKMA launched a Cybersecurity Fortification Initiative (CFI), one of the pillars of which is the Cyber Resilience Assessment Framework (C-RAF). An upgraded CFI (CFI 2.0) came into effect on 1 January 2021. There is a timeline for authorised institutions to complete their C-RAF 2.0 assessments. C-RAF 2.0 encompasses enhanced control principles reflecting the latest developments in overseas cyber practices in relation to cyber incident response and recovery.

The IA published a guideline on cybersecurity (GL 20) in June 2019, which sets out the minimum standard for cybersecurity that authorised insurers are expected to have in place.

The Personal Data Privacy Ordinance (PDPO) addresses the security of personal data, including data storage and security measures.

Large-scale cybersecurity failings resulting in breach of personal data protection rules are treated seriously by regulators. The Office of the Privacy Commissioner regularly carries out investigations of such failings and issues enforcement notices. Failure to comply with these notices may lead to criminal sanctions.

10 Does your country regulate cybercrime? What is the approach of law enforcement authorities in your country to cybercrime?

There are a number of offences under Hong Kong law targeting cybersecurity-related crimes, including unauthorised access to a computer by telecommunications under the Telecommunications Ordinance and access to a computer with criminal or dishonest intent under the Crimes Ordinance. Other offences that may be applied to prosecute cybercrime include criminal damage under the Crimes Ordinance and theft under the Theft Ordinance.

The Cybersecurity and Technology Crime Bureau (CSTCB) of the Hong Kong Police Force is responsible for carrying out investigations into technology crime, including computer forensic examinations. The CSTCB also liaises closely with local and overseas law enforcement agencies on combating cross-border technology crime. For example, the CSTCB conducted a joint investigation with the Singapore Police Force into a trans­national online credit card fraud syndicate, which stole card details via phishing. Five core members of the syndicate were arrested in July 2020. In terms of exchange of experience, CSTCB and Interpol co-hosted a technology crime investigation workshop in July 2021 and the Chief Superintendent of CSTCB chaired the annual meeting of the Interpol Global Cybercrime Expert Group in the same month.

Cross-border issues and foreign authorities

11 Does local criminal law have general extraterritorial effect? To the extent that extraterritorial effect is limited to specific offences, give details.

The primary basis of criminal jurisdiction in Hong Kong is territorial, and the courts apply a strong presumption against construing statutes as having extraterritorial effect.

The Criminal Jurisdiction Ordinance (CJO) deals with Hong Kong’s extra­territorial criminal jurisdiction. The offences to which the CJO applies are divided into Group A offences, which include theft, fraud, deception, blackmail and offences relating to false instruments, and Group B offences, which cover conspiracy, attempting or incitement to commit a Group A offence, and the offence of conspiracy to defraud.

The CJO allows Hong Kong courts to exercise jurisdiction over offences under both groups in the following circumstances:

• any of the constituent elements of the offence occurs in Hong Kong; or
• there is an attempt to commit the offence in Hong Kong, whether or not the attempt is made in Hong Kong or elsewhere and irrespective of whether it has an effect in Hong Kong; or
• there is an attempt or incitement in Hong Kong to commit the offence outside Hong Kong; and
• the substantive offence was not intended to take place in Hong Kong.

As regards a conspiracy to commit a Group A offence, or conspiracy to defraud, jurisdiction depends on proof that the pursuit of the agreed course of conduct would involve conduct punishable under the law in force in the place where the conduct was intended to take place. The prosecution must also prove that:

• a party to the agreement constituting the conspiracy, or a party’s agent, did something in Hong Kong in relation to the agreement before its formation; or
• a party to the conspiracy became a party in Hong Kong (by joining it either in person or through an agent); or
• a party to the conspiracy, or a party’s agent, did or omitted to do anything in Hong Kong in pursuance of it; and
• the conspiracy would be triable in Hong Kong, but the parties to it had not intended that the offence or fraud would take place in Hong Kong.

In relation to conspiracies to commit all other offences, section 159A of the Crimes Ordinance codifies the general common law rule limiting extraterritorial jurisdiction in conspiracy cases and provides that conspiracies entered into in Hong Kong are triable in Hong Kong only if the agreement is to commit substantive offences that are triable in Hong Kong. Conspiracies entered into abroad to commit substantive offences in Hong Kong would be triable in Hong Kong even before any acts were carried out within the territory in furtherance of the conspiracies. However, conspiracies entered into in Hong Kong to commit offences abroad would not be triable in Hong Kong.

12 Describe the principal challenges that arise in your country in cross-border investigations, and explain whether and how such challenges depend on the other countries involved.

Cross-border investigations may touch on Hong Kong’s data privacy regime, or regimes of other countries in Asia, such that employee or customer consent may be required prior to disclosing certain protected information. Cross-border investigations involving China should be conducted in compliance with the Chinese Law on Guarding State Secrets, Chinese Cybersecurity Law and Chapter VI of the new Civil Code (which concerns personal data privacy), which into effect on 1 January 2021. A new Data Security Law in China has also been passed and takes effect in September 2021. It regulates data activities to protect and promote state security and development. It purports to have extraterritorial effect applying to data activities outside China that may harm national security or public interests, or the legitimate rights of Chinese citizens or entities. Further, the new Personal Information Protection Law takes effect in November 2021, which also purports to have extraterritorial effect governing offshore processing of personal information of individuals in China in relation to the provision of goods or services to, or analysis of activities of, such individuals. In certain cases, investigators may need to undertake their work on site in China with strict protocols in place to prevent the prohibited export of information to Hong Kong or elsewhere.

In July 2019, the Chinese Ministry of Finance (MOF), the China Securities Regulatory Commission (CSRC) and the Hong Kong Securities and Futures Commission (SFC) entered into a memorandum of understanding concerning the obtaining of audit working papers in China. The aim of this is to facilitate the SFC’s access to these documents when conducting investigations into Chinese companies listed in Hong Kong and their related entities or persons. Under the memorandum of understanding, the MOF and the CSRC will provide the fullest assistance in response to requests by the SFC for investigative assistance regarding the provision of audit working papers. The Financial Reporting Council (FRC) also has a May 2019 memorandum of understanding with the Supervision and Evaluation Bureau of the MOF under which it may obtain assistance for the provision of audit working papers. In July 2021, the FRC completed its first investigation report using audit working papers obtained thereunder in relation to a failure by the auditor of a listed entity to identify a material misstatement in the consolidated financial statements. A second investigation report using audit working papers similarly obtained was completed in August 2021, involving a similar failure.

13 Does double jeopardy, or a similar concept, apply to prevent a corporation from facing criminal exposure in your country after it resolves charges on the same core set of facts in another? Is there anything analogous in your jurisdiction to the ‘anti-piling on’ policy as exists in the United States (the Policy on Coordination of Corporate Resolution Penalties) to prevent multiple authorities seeking to penalise companies for the same conduct?

The right of an accused to advance double jeopardy is found in the Hong Kong Bill of Rights Ordinance and the Criminal Procedure Ordinance. This protection extends to corporations convicted or acquitted of an offence abroad. There is no express or specific legislation or regulation analogous to the ‘anti-piling on’ policy as exists in the United States.

14 Are ‘global’ settlements common in your country? What are the practical considerations?

Regarding global settlements involving more than one country, there are no published figures on their prevalence. The SFC has co-operative arrangements for investigatory assistance and exchange of information with many overseas regulators. In particular, the CSRC and the SFC have maintained a close strategic partnership to tackle cross-border trading misconduct. The Hong Kong Monetary Authority has co-operative arrangements with the People’s Bank of China and the China Banking and Insurance Regulatory Commission to ensure cross-border banking operations are effectively controlled and prudently conducted. The Insurance Authority has co-operative arrangements with the China Insurance Regulatory Commission to enhance insurance supervision and co-operation against insurance fraud.

When handling ‘global’ settlements, practical considerations include ensuring information parity between regulators and coordinating the timing of publishing or announcing the settlement in different jurisdictions.

15 What bearing do the decisions of foreign authorities have on an investigation of the same matter in your country?

To facilitate investigation of the same matter, the Hong Kong authorities generally try to co-operate with their counterparts in foreign jurisdictions and in China. For example, in October 2014, the SFC and the CSRC entered into a memorandum of understanding on strengthening cross-boundary regulatory and enforcement co-operation with a view to tackling market manipulation in China and Hong Kong. Furthermore, the MOF, the CSRC, the SFC and the FRC entered into memoranda of understanding on audit working papers.

In addition, Hong Kong has mutual legal assistance agreements with a number of countries, and a number of international treaties provide for cross-border co-operation.

Economic sanctions enforcement

16 Describe your country’s sanctions programme and any recent sanctions imposed by your jurisdiction.

Hong Kong generally adheres to United Nations Security Council sanctions, including pursuant to the Weapons of Mass Destruction (Control of Provisions of Services) Ordinance, the United Nations Sanctions Ordinance and the United Nations (Anti-Terrorism Measures) Ordinance with oversight by the Chinese Ministry of Foreign Affairs. Hong Kong does not impose unilateral or autonomous sanctions. There was some discussion in August 2021 that China’s Anti-Foreign Sanctions Law would be introduced into the laws of Hong Kong but that had not happened at the time of writing. It was reported that China’s government had decided not to proceed with the plan for the time being.

17 What is your country’s approach to sanctions enforcement? Has there been an increase in sanctions enforcement activity in recent years, for example?

Multiple agencies share responsibility for the administration and enforcement of Hong Kong sanctions, including the Chief Executive, the Hong Kong Department of Justice, the Hong Kong Monetary Authority, the Hong Kong Securities and Futures Commission, the Commerce and Economic Development Bureau, the Customs and Excise Department, and the Trade and Industry Department. Although regulatory focus has increased, particularly for the financial sector, there have been no notable cases of criminal enforcement of sanctions breaches in Hong Kong in recent years.

18 Do the authorities responsible for sanctions compliance and enforcement in your country co-operate with their counterparts in other countries for the purposes of enforcement?

Hong Kong has a variety of mutual legal assistance arrangements with foreign jurisdictions, which may be used in support of sanctions-related investigations.

19 Has your country enacted any blocking legislation in relation to the sanctions measures of third countries? Describe how such legislation operates.

Hong Kong has no such legislation, albeit China enacted its Anti-Foreign Sanctions Law in June 2021. There was some discussion in August 2021 that China’s Anti-Foreign Sanctions Law would be introduced into Hong Kong’s Basic Law by the Standing Committee of the National People’s Congress in that month, but that had not happened at the time of writing. It was reported that China’s government had decided not to proceed with the plan for the time being.

20 To the extent that your country has enacted any sanctions blocking legislation, how is compliance enforced by local authorities in practice?

Not applicable.

Before an internal investigation

21 How do allegations of misconduct most often come to light in companies in your country?

Whistleblower complaints, both internal and external, are a frequent source of allegations of misconduct leading to investigations, particularly with respect to bribery and corruption. The role of the Independent Commission Against Corruption (ICAC) in receiving and investigating complaints made against individuals is critical. Enquiries by the ICAC to companies regarding their employees’ conduct will often lead to an internal investigation to identify potential breaches of internal policy even when there is no corporate liability under the law.

Where there is known or suspected money laundering or terrorist financing, suspicious transaction reports (STRs) are required to be filed with the Joint Financial Intelligence Unit (JFIU). The JFIU, jointly run by the Hong Kong Police Force and Hong Kong Customs and Excise Department, manages the STR regime, receiving and analysing reports and disseminating them to appropriate law enforcement agencies (and financial intelligence units) in and outside Hong Kong.

Regulatory reviews by the Hong Kong Securities and Futures Commission (SFC), the Hong Kong Monetary Authority (HKMA) or other regulators are another source of allegations of misconduct. Further, corporations and institutions licensed by the SFC or the HKMA have an obligation to report material breaches (or suspected breaches) of any law, rules or regulations (including suspected misconduct) to their regulators. Specifically, corporations licensed by the SFC are expressly required to report material breaches (or suspected breaches) of market misconduct provisions under the Securities and Futures Ordinance (Cap. 571) by their clients.

Information gathering

22 Does your country have a data protection regime?

Hong Kong has a data protection regime that has been given statutory force through the Personal Data Privacy Ordinance (PDPO). The PDPO applies to any data relating directly or indirectly to a living person from which it is possible to identify that person and the data is in a form in which access or processing is practicable. The PDPO contains six data protection principles (DPPs) that govern the purpose and manner of collection, the accuracy and duration of retention, the use and security of personal data, and rights of access and correction.

23 To the extent not dealt with above at question 9, how is the data protection regime enforced?

Contravening a DPP may give rise to a complaint to be investigated by the Office of the Privacy Commissioner (OPC). A data user may be punished under the PDPO for failing to comply with an enforcement notice issued by the Privacy Commissioner for Personal Data, after a finding of a contravention. An enforcement notice may direct the data user to take steps to remedy the contravention and prevent a recurrence. A data user may separately bring a civil claim for damages on the basis of a contravention of a DPP, whether or not the Privacy Commissioner has issued an enforcement notice.

24 Are there any data protection issues that cause particular concern in internal investigations in your country?

The provisions of the PDPO cover the monitoring and gathering of data in the context of internal investigations, whether this be by monitoring the internet, public social media posts, telephone calls, chats, emails or other internal communication channels. An individual who suffers damage (including ‘injured feelings’) by reason of a breach may sue. The Personal Data (Privacy) (Amendment) Ordinance 2021 (PDPAO), which criminalises doxxing, came into effect on 8 October 2021. The new offences cover criminalisation of the disclosure of personal data without the data subject’s consent where the disclosing party has an intent to cause harm, or is reckless in regard to causing harm, such as harassment or pestering, bodily or psychological harm, or damage to property. The PDPAO also empowers the OPC to serve notices to cease or restrict disclosure of doxxing content and carry out criminal investigation, and failure to comply or co-operate with the same may lead to a criminal offence. Further guidance from the OPC on the application of the law in the context of legitimate whistleblowing and employment-related internal investigations would be helpful.

25 Does your country regulate or otherwise restrict the interception of employees’ communications? What are its features and how is the regime enforced?

Interception of communications and covert surveillance are regulated by the Interception of Communications and Surveillance Ordinance and can only be exercised by the Customs and Excise Department, the Hong Kong Police Force and the Independent Commission Against Corruption with prescribed authorisation.

Monitoring and surveillance of employee communications is regulated by the PDPO. Prior to implementing any surveillance system, an employer must take such steps as are reasonable, in the circumstances, to ensure its employees are aware of (among other things) the fact that the information is being collected and the purpose of collection.

Dawn raids and search warrants

26 Are search warrants or dawn raids on companies a feature of law enforcement in your country? Describe any legal limitations on authorities executing search warrants or dawn raids, and what redress a company has if those limits are exceeded.

Dawn raids are used by the Securities and Futures Commission (SFC) and the Hong Kong Monetary Authority (HKMA) in the context of regulatory investigations, by the Independent Commission Against Corruption in bribery investigations and by the Hong Kong Police Force in relation to the commission of any offence. Dawn raids may also be used by the Competition Commission in investigating offences under the Competition Ordinance. They can take place either with a warrant issued by a magistrate or without a warrant in limited circumstances. The Office of the Privacy Commissioner has been given dawn raid powers for certain offences relating to disclosure of personal data without consent and with specified harmful intent under the proposed Personal Data (Privacy) (Amendment) Ordinance 2021, which came into effect on 8 October 2021.

27 How can privileged material be lawfully protected from seizure during a dawn raid or in response to a search warrant in your country?

Generally, privileged material cannot be seized during a dawn raid or in response to a search warrant. To protect privileged material from seizure, a claim of privilege should be made, and if there is a dispute as to whether certain material is privileged, the material should be sealed until the dispute is resolved. However, privilege may be overridden by a court order. Privilege will also not attach to material created for the purpose of committing a crime.

28 Under what circumstances may an individual’s testimony be compelled in your country? What consequences flow from such compelled testimony? Are there any privileges that would prevent an individual or company from providing testimony?

Privilege against self-incrimination is recognised in Hong Kong. A person may decline to provide information in an investigation that may lead to self-incrimination.

An exception is that authorities such as the SFC and the HKMA may issue a notice under relevant statutory provisions compelling a witness to answer questions or produce documents, and self-incrimination is not a reason for non-compliance. However, the information provided by the person compelled by the notice will be inadmissible in evidence against the person in criminal proceedings except for certain offences, such as perjury.

Whistleblowing and employee rights

29 Describe the whistleblowing framework in your country. What financial incentive schemes exist for whistleblowers? What legal protections are in place for whistleblowers?

Hong Kong currently does not have a comprehensive or overarching framework to protect whistleblowers and the legal protections for whistleblowers are limited. There are no financial incentive schemes for whistleblowers to volunteer information. However, listed companies are encouraged to adopt a whistleblowing policy as ‘recommended best practice’ under the Corporate Governance Code (the CG Code) of the Stock Exchange of Hong Kong Limited (the Exchange). In the Exchange’s April 2021 consultation paper, it proposed that the adoption of a whistleblowing policy be upgraded from a recommended best practice to a provision in the CG Code. The Hong Kong Monetary Authority (HKMA) also advised in its March 2017 bank culture reform circular that authorised institutions should put in place a whistleblowing mechanism to facilitate timely reporting of any illegal, unethical or questionable practices in a confidential setting without the risk of reprisals. This message was repeated in the HKMA’s May 2020 circular reporting on its review of bank culture self-assessments, with the HKMA stating that more work was needed to promote an environment that provides psychological safety to encourage staff to speak out without fear of adverse consequences.

Under the Employment Ordinance, an employee giving evidence in proceedings or in response to enquiries in connection with the enforcement of the Employment Ordinance, work accidents or breach of work safety legislation is protected from dismissal and discrimination.

Other ordinances covering race, gender, family status and disability also protect individuals who act against discrimination or assist with investigations against victimisation.

Hong Kong law protects individuals who disclose suspected money laundering or other crimes by preventing the disclosure from being treated as a breach of any restrictions imposed by contract, enactment or rule of conduct. Similarly, there is protection for a whistleblower against any civil liability for reporting financial irregularities or non-compliance with financial resources rules (and for listed company auditor whistleblowers for reporting fraud) under the Securities and Futures Ordinance (Cap. 571).

Under the Prevention of Bribery Ordinance, the name or address of an informer is not to be disclosed and any document that might lead to discovery of the informer must be redacted prior to disclosure in civil or criminal proceedings. The Independent Commission Against Corruption (and police) informers are entitled to witness protection under the Witness Protection Ordinance.

In April 2020, the Competition Commission in Hong Kong revised its Leniency Policy, updating the one applying to undertakings and publishing a new one for individuals. The policies are designed to encourage companies and individuals that may have engaged in illegal activity, such as bid rigging or price-fixing, to report it in exchange for leniency.

30 What rights does local employment law confer on employees whose conduct is within the scope of an investigation? Is there any distinction between officers and directors of the company for these purposes?

Employees have limited rights under local employment laws if a company conducts an investigation and may be suspended with pay if the employment contract so provides. An employee may also be suspended without pay in the limited circumstances specified in the Employment Ordinance for generally no more than 14 days. Employees are protected against wrongful, unreasonable or constructive dismissal under local legislation.

Employees have the right to a disciplinary hearing if the company handbook, manual or policy provides for it in relation to employee misconduct. Employees of government or public bodies have the right to a fair hearing.

Executive directors owe additional duties under the Companies Ordinance, the company’s articles and common law. In addition to the rights they have as an employee of the company, directors also have rights under the Companies Ordinance and their company’s articles with respect to the potential threat of removal or disqualification if they breach directors’ duties.

31 Do employees’ rights under local employment law differ if a person is deemed to have engaged in misconduct? Are there disciplinary or other steps that a company must take when an employee is implicated or suspected of misconduct, such as suspension or in relation to compensation?

There are no statutory requirements for companies to take disciplinary steps when an employee is suspected of misconduct. However, companies’ internal policies and employment contracts may adopt disciplinary procedures for their employees, which must be adhered to. Companies in regulated industries may be required to suspend or take disciplinary action against employees who carry out regulated activities. Aside from their mandatory obligations, companies may take disciplinary action or steps to investigate misconduct as part of their proper internal controls and good corporate governance.

32 Can an employee be dismissed for refusing to participate in an internal investigation?

An employee may potentially be dismissed for refusing to participate in an internal investigation after failing to heed the employer’s lawful and reasonable instructions and absent any protected circumstances, such as the employee taking sick leave, maternity leave, paternity leave or work injury leave.

Commencing an internal investigation

33 Is it common practice in your country to prepare a document setting out terms of reference or investigatory scope before commencing an internal investigation? What issues would it cover?

It is common practice for an internal investigation to begin with the drafting of an investigation plan detailing the objectives, scope, roles and responsibilities for the investigation. A clearly defined communications plan and the protocol for maintaining legal professional privilege are also essential from the earliest stages. Increasingly, scoping documents will also identify data custodians and outline procedures for electronic document review.

34 If an issue comes to light prior to the authorities in your country becoming aware or engaged, what internal steps should a company take? Are there internal steps that a company is legally or ethically required to take?

Depending on the nature of the issue, necessary internal steps could be managed by a company’s compliance or legal department in less serious cases, or senior management and the board of directors in more serious cases. Under the supervision of legal counsel to ensure the protection of legal professional privilege, a company should gather and secure any relevant documents and data, and interview key employees to ensure the continued availability of critical information. Corrective action plans or disciplinary measures should be adopted to address gaps or breaches in compliance controls, which may earn a company mitigation credit in any related enforcement actions. Although the authorities may not be aware of an internal issue, it is important to pay particular regard to the self-reporting obligations by corporations and institutions licensed by the Hong Kong Securities and Futures Commission (SFC) or the Hong Kong Monetary Authority (HKMA).

35 What internal steps should a company in your country take if it receives a notice or subpoena from a law enforcement authority seeking the production or preservation of documents or data?

Ideally, a company should have an established protocol for responding to law enforcement requests, subpoenas or dawn raids, including procedures for the preservation of relevant documents and data. The legal department should issue a preservation notice to all relevant employees immediately upon receiving a law enforcement request, or if it believes that such a request or legal proceedings may be forthcoming. Paper documents and electronic data on servers, laptops, mobile devices or other media should be collected from relevant custodians and logged under the supervision of legal counsel and the company’s information technology department. Privileged communications should be segregated and clearly stamped to help prevent accidental disclosure.

36 At what point must a company in your country publicly disclose the existence of an internal investigation or contact from a law enforcement authority?

There is no general duty to publicly disclose the existence of an internal investigation or contact from law enforcement (indeed, most agencies impose a secrecy obligation on the subject of an investigation). The exception is in the case of a listed company when such facts would constitute price-sensitive information, as defined under the Securities and Futures Ordinance (Cap. 571) (SFO), unless exempted or when the SFC has granted a waiver (e.g., in cases involving disclosure restrictions imposed by a foreign government authority). Conversely, there are strict prohibitions against publicly reporting details of investigations by the Independent Commission Against Corruption for both listed and unlisted companies.

37 How are internal investigations viewed by local enforcement bodies in your country?

In most cases, the authorities recognise the need for, and welcome, at least initial or preliminary internal investigations carried out by corporations. Those corporations and institutions licensed by the SFC or the HKMA have a regulatory duty to self-report when there is a material breach (or suspected breach) by their employees of any law, rules or regulations (including suspected misconduct), or when there is a material breach (or suspected breach) by their clients of any market misconduct provisions under the SFO (in the case of corporations licensed by the SFC). Particular care must be taken to avoid tipping off, whereby corporations are prohibited (except with the authorities’ consent) from disclosing the existence of the authorities’ investigations to a third party, which may include their employees and their clients.

Attorney–client privilege

38 Can the attorney–client privilege be claimed over any aspects of internal investigations in your country? What steps should a company take in your country to protect the privilege or confidentiality of an internal investigation?

Legal professional privilege can be claimed over various aspects of an internal investigation.

Case law holds that the whole process of obtaining and giving legal advice should be privileged. Therefore, internal communications (including those between employees of a non-legal function) and materials generated during the information-gathering process of an internal investigation (such as minutes of meetings and interview notes), for the dominant purpose of obtaining and giving legal advice, could be privileged. However, legal advice privilege will not attach to communications with, or materials prepared by, a third party (unless the communications or materials are for the dominant purpose of obtaining or seeking legal advice), nor will it cover legal advice given by persons who are not legally qualified (e.g., tax accountants).

During an internal investigation, confidential communications or documents prepared for the dominant purpose of obtaining information or evidence for use in actual or reasonably contemplated litigation – even if the communications are merely for the purpose of establishing facts – will be covered by litigation privilege. To protect privilege, a company should:

• involve lawyers (whether in-house or external counsel) as soon as it is apparent that legal advice is likely to be required;
• avoid creating unnecessary records (where there is no prospect of litigation) that summarise, quote or amend the legal advice received;
• limit circulation of privileged documents on a strictly need-to-know basis;
• manage documents effectively by separating privileged and non-privileged documents; and
• ensure that all documents that are considered to be protected by legal professional privilege are clearly marked ‘privileged and confidential’.

39 Set out the key principles or elements of the attorney–client privilege in your country as it relates to corporations. Who is the holder of the privilege? Are there any differences when the client is an individual?

Under Hong Kong law, legal professional privilege falls into two categories:

• Legal advice privilege attaches to communications between a client and his or her legal adviser for the purposes of giving and receiving legal advice.
• Litigation privilege attaches to confidential communications between a legal adviser and his or her client, and to communications between a legal adviser or client and a third party if three conditions are met: (1) litigation is in progress or reasonably in contemplation; (2) the communications are made with the sole or dominant purpose of conducting the actual or anticipated litigation; and (3) the litigation is adversarial, not investigative or inquisitorial.

The privilege belongs to, and can only be waived by, the client and not his or her legal adviser.

In the corporate context, it is advisable to identify the employees authorised to act for the company to seek legal advice for the purposes of claiming legal advice privilege, as English and Hong Kong law have diverged in recent years on this issue.

40 Does the attorney–client privilege apply equally to in-house and external counsel in your country?

Legal professional privilege applies equally to in-house and external counsel. However, privilege will only cover communications made by an in-house lawyer acting in a legal (not a managerial) capacity.

41 Does the attorney–client privilege apply equally to advice sought from foreign lawyers in relation to investigations in your country?

Legal professional privilege applies equally to advice sought from foreign lawyers if the advice is given in Hong Kong. If the advice is given from outside Hong Kong, it is possible that privilege can be asserted under Hong Kong law even if the home jurisdiction of the foreign lawyer does not recognise legal professional privilege.

42 To what extent is waiver of the attorney–client privilege regarded as a co-operative step in your country? Are there any contexts where privilege waiver is mandatory or required?

Waiver of legal professional privilege (usually on a limited basis) is generally regarded as a sign of co-operation by authorities in a regulatory investigation. This is not mandatory.

43 Does the concept of limited waiver of privilege exist as a concept in your jurisdiction? What is its scope?

The Court of Appeal in Hong Kong has confirmed that a waiver of privilege with respect to one party does not automatically mean that privilege has been waived at large and that privilege is not waived because a privileged document has been disclosed for a limited purpose. The scope of the waiver is determined by the party waiving the privilege. Where privilege is waived for a limited purpose, it is important to ensure that the terms and scope of the limited waiver are clear.

44 If privilege has been waived on a limited basis in another country, can privilege be maintained in your own country?

Generally, privilege will not be lost because a privileged document has been disclosed for a limited purpose.

Whether privilege can be maintained if it has been partly waived in another country will depend on several factors, including, but not limited to:

• whether the concept of limited or partial waiver is recognised in the country where privilege has been waived;
• the scope and terms of the waiver; and
• whether any statutory provision overrides privilege.

45 Do common interest privileges exist as concepts in your country? What are the requirements and scope?

Common interest privilege exists in Hong Kong. Privilege will not be waived if privileged material is disclosed to a third party who shares a common interest in the subject matter of the privileged material. Common interest must exist at the time when the privileged material is disclosed to the third party.

46 Can privilege be claimed over the assistance given by third parties to lawyers?

Communications between a third party and the lawyer (or the client) are protected from disclosure by litigation privilege if they are made for the dominant purpose of obtaining information or evidence for use in actual or reasonably contemplated litigation. However, legal advice privilege will generally not apply to communications with third parties.

Witness interviews

47 Does your country permit the interviewing of witnesses as part of an internal investigation?

Yes. There is no general prohibition under Hong Kong law against interviewing witnesses as part of the information-gathering process in an internal investigation.

48 Can a company claim the attorney–client privilege over internal witness interviews or attorney reports?

Legal advice privilege is often claimed for the records of internal witness interviews, if the interviews are conducted at the direction of an in-house or external legal adviser. Case law in Hong Kong suggests that a corporation may argue that legal advice privilege exists regarding such records if the interviews are conducted (or the reports are compiled) for the dominant purpose of obtaining and giving legal advice during the internal investigation. This is in contrast to the position in England, which applies a more limited definition of ‘client’, for example.

Litigation privilege may only be claimed if it is established that the witness interviews are conducted for the dominant purpose of use in an actual or reasonably contemplated litigation.

49 When conducting a witness interview of an employee in your country, what legal or ethical requirements or guidance must be adhered to? Are there different requirements when interviewing third parties?

Whether the interviewee is an employee or a third party, it is recommended that they be informed that:

• the interview is part of a fact-finding exercise;
• the lawyer conducting the interview represents the company, not the interviewee;
• the interview is protected by legal professional privilege belonging to the company, which can choose to disclose the contents of the interview to third parties, including regulators and authorities, without the interviewee’s permission;
• the interviewee may provide personal information covered by data protection laws, which will be used only for the fact-finding or review exercise. This exercise may involve sharing the interviewee’s personal information with other advisers working for the company, regulators and authorities; and
• the contents of the interview are confidential and should not be shared with any other person (including other employees).

50 How is an internal interview typically conducted in your country? Are documents put to the witness? May or must employees in your country have their own legal representation at the interview?

The internal interview will typically be attended by in-house legal counsel and any specialised investigation team with or without external counsel (depending on the nature and seriousness of the issues involved). Relevant documents are typically put to the witness at the internal interview for reference, comment and explanation, as necessary. There is no legal requirement that employees have their own legal representation at an internal interview, and this is not common in practice.

Reporting to the authorities

51 Are there circumstances under which reporting misconduct to law enforcement authorities is mandatory in your country?

Generally, a person is under no positive obligation to report crimes or provide assistance to law enforcement authorities, save for suspicious transaction reports under anti-money laundering laws, which are mandatory, and certain exceptions for licensed corporations and financial institutions.

52 In what circumstances might you advise a company to self-report to law enforcement even if it has no legal obligation to do so? In what circumstances would that advice to self-report extend to countries beyond your country?

Although there is no formal arrangement or mechanism for deferred prosecution agreements in Hong Kong, it may be advisable for a company to self-report with a view to demonstrating its proactive and full co-operation with the authorities, which may militate against a decision to prosecute or be considered as a mitigating factor in sentencing.

Whether the self-report should extend to foreign countries will depend on the nature and extent of the issues involved, in particular whether it has a cross-border, regional or global element.

53 What are the practical steps you need to take to self-report to law enforcement in your country?

A company should undertake appropriate internal investigations to ascertain the nature and extent of the issues, and to ensure the contents of any self-report are correct and not misleading (including through any material omission). It should also seek legal advice on the applicable self-reporting obligations.

For licensed corporations and financial institutions that are under a regulatory duty to self-report, a balance needs to be struck between making timely self-reports and ensuring that reports are correct and not misleading.

Responding to the authorities

54 In practice, how does a company in your country respond to a notice or subpoena from a law enforcement authority? Is it possible to enter into dialogue with the authorities to address their concerns before or even after charges are brought? How?

Hong Kong enforcement agencies, such as the Independent Commission Against Corruption and the Hong Kong Securities and Futures Commission (SFC), have extensive powers to compel information to be provided to them by corporations involved in investigations, and there is very little that can be done to challenge requests for information when they are made.

However, it would be unusual for criminal charges to be brought against a corporation without it having an opportunity to discuss the circumstances of the allegations with the enforcement agency. In financial misconduct investigations, the twin regulatory and criminal nature of the supervisory jurisdiction of the SFC and the Hong Kong Monetary Authority (HKMA) means that there would be an opportunity for representations to be made by the corporation, through its lawyers, as to the circumstances, and the proposed remediation, prior to criminal charges being brought.

55 Are ongoing authority investigations subject to challenge before the courts?

The circumstances under which an ongoing investigation could be challenged in the courts are difficult to envisage, short of provable mala fides on the part of the enforcement agency.

56 In the event that authorities in your country and one or more other countries issue separate notices or subpoenas regarding the same facts or allegations, how should the company approach this?

These circumstances are most likely to arise in the context of financial regulatory investigations by regulators in different jurisdictions, or international anti-bribery enforcement under the US Foreign Corrupt Practices Act or the United Kingdom’s Bribery Act. In circumstances in which the notices or subpoenas have been issued validly, justify substantive responses and relate to identical subject matter, it is advisable to adopt consistent disclosure with each agency. Further, assuming that a financial institution’s operations are international in nature, coupled with self-reporting obligations imposed in other countries (most notably the United States and the United Kingdom), this usually means that some form of notification or reporting to overseas regulators would be required even in the context of an investigation that primarily concerns Hong Kong, and in the absence of any separate notices or subpoenas being issued by overseas regulators. Given the increasing prevalence of international co-operation between regulators and criminal enforcement agencies, a failure to disclose certain matters in one jurisdiction may well be apparent and seized on as an indication of inadequate compliance or co-operation.

Assuming that the investigation primarily concerns Hong Kong, it is advisable to adopt the disclosure made to the local regulators (e.g., the SFC or the HKMA) as a ‘base’ document in framing the appropriate disclosure to overseas regulators with reference made to the nexus with other countries (e.g., by reason of the institution’s or an individual’s licensing status, client impact, and so on). Care should also be taken to ensure that notification has been given to and, in appropriate cases, consent obtained from the local regulators, before overseas notification or disclosure is made. In particular, the SFC almost always insists that its written consent be obtained before a licensed corporation can disclose the existence or content of an ongoing investigation, even to an overseas regulator.

57 If a notice or subpoena from the authorities in your country seeks production of material relating to a particular matter that crosses borders, must the company search for, and produce material, in other countries to satisfy the request? What are the difficulties in that regard?

Under notices issued by the various Hong Kong enforcement agencies, companies may be required to produce material in their possession, custody, control or power, whether this is located in other countries or solely in Hong Kong, subject to having a reasonable excuse not to do so.

This may give rise to issues in some foreign jurisdictions, where the transmission of certain types of information outside that country may be prohibited by local law. In Hong Kong, exposure to criminal liability under foreign law would not constitute a reasonable excuse for non-compliance with a notice or subpoena. This applies in circumstances where a reasonable person would conclude that the Hong Kong public interest in the investigation of criminal activities outweighs any public or private interest in compliance with the foreign law. However, if there are alternative means of obtaining the documents without materially adverse consequences to the investigation, a real and appreciable risk of prosecution under foreign law would constitute a reasonable excuse for non-compliance.

A related issue arises as to the extent that the company is required to produce relevant material in the possession, custody or power of its parent, subsidiary or an associated company (which may be incorporated in other countries). In general terms, this depends on whether the company subject to investigation (the subject company) has a presently enforceable legal right to obtain the documents from such other companies without the need to obtain the consent of anyone else. This is a question of fact, which depends on whether the subject company has sufficient control over the other companies such that the documents in the possession, custody or power of the other companies can be said to be within the power of the subject company.

58 Does law enforcement in your country routinely share information or investigative materials with law enforcement in other countries? What framework is in place in your country for co-operation with foreign authorities?

Hong Kong regulators, including the HKMA and the SFC, have signed memoranda of understanding to establish co-operative arrangements that include the sharing of information with foreign counterparts, including those in China. One of the most important of these is the International Organisation of Securities Commissions Multilateral Memorandum of Understanding, which was the first global information-sharing arrangement among securities regulators.

Hong Kong authorities may co-operate with their foreign counterparts reciprocally in criminal matters under the framework established in the Mutual Legal Assistance in Criminal Matters Ordinance. However, this particular legislation is not applicable to China, Macao or Taiwan.

59 Do law enforcement authorities in your country have any confidentiality obligations in relation to information received during an investigation or onward disclosure and use of that information by third parties?

Information provided to enforcement authorities in Hong Kong confidentially during an investigation will remain confidential, except to the extent that its use is necessary within an investigation, prosecution or regulatory enforcement. Although it may be shared with other enforcement agencies or regulators under information-sharing agreements, it would not be disclosed to other third parties without an order from a court.

60 How would you advise a company that has received a request from a law enforcement authority in your country seeking documents from another country, where production would violate the laws of that other country?

It may be possible to refuse production on the grounds that the foreign illegality constituted a reasonable excuse not to produce the documents under the relevant legislation. It is also not uncommon that the documents are in the possession, custody or power of a parent, subsidiary or associated company incorporated or operating in another country. These issues should be brought to the attention of the enforcement agency, which should consider whether assistance could be sought under formal channels from the agency in the foreign jurisdiction, to allow the documents to be produced without violating foreign law.

61 Does your country have secrecy or blocking statutes? What related issues arise from compliance with a notice or subpoena?

There are no blocking statutes as such in Hong Kong. There was some discussion in August 2021 that China’s Anti-Foreign Sanctions Law would be introduced into the laws of Hong Kong but that had not happened at the time of writing. It was reported that China’s government had decided not to proceed with the plan for the time being.

The jurisdiction to order corporations and individuals to provide evidence in aid of foreign proceedings is derived from Part VIII of the Evidence Ordinance. Section 75 of the Evidence Ordinance requires the application to be made pursuant to a ‘request issued by or on behalf of a court’ outside Hong Kong. In terms of procedure, therefore, a letter of request is required and Order 70 of the Rules of the High Court provides the procedural framework for taking evidence or obtaining documents from a Hong Kong entity.

62 What are the risks in voluntary production versus compelled production of material to authorities in your country? Is this material discoverable by third parties? Is there any confidentiality attached to productions to law enforcement in your country?

Care must be taken to ensure compliance with a company’s confidentiality obligations in relation to information. If disclosure to an authority is voluntary, rather than compelled, then the disclosure may violate these obligations.

Law enforcement authorities in Hong Kong must maintain the confidentiality of confidential disclosures made to them (whether voluntary or compelled), except to the extent that they choose to share them with other enforcement authorities, or use the information in an investigation, prosecution or regulatory enforcement action.

Prosecution and penalties

63 What types of penalties may companies or their directors, officers or employees face for misconduct in your country?

Companies or their directors, officers or employees may face disciplinary action – and disqualification, in the case of directors – and attract potential civil or criminal liability for misconduct in Hong Kong. For entities regulated by the Hong Kong Securities and Futures Commission (SFC), misconduct would include breaches of the Securities and Futures Ordinance (Cap. 571) (SFO), contravention of the terms of any SFC licence or any act prejudicial to the public interest. Sanctions may include a private or public reprimand, a fine of up to HK$10 million or three times the profit gained or loss avoided, revocation or suspension of licences or registrations, and a ban on regulated persons from applying to be licensed or approved as a responsible officer.

The SFC has powers under the SFO to seek criminal prosecution by the Hong Kong Department of Justice (DOJ) and, in practice, the SFC refers all market misconduct cases to the DOJ for advice. The maximum penalties for a person convicted of a market misconduct offence are imprisonment for 10 years and a fine of HK$10 million.

The SFC may also institute civil proceedings before the High Court or the Market Misconduct Tribunal.

64 Where there is a risk of a corporate’s suspension, debarment or other restrictions on continuing business in your country, what options or restrictions apply to a corporate wanting to settle in another country?

It depends on the laws of the other country in which the corporate wants to settle. The risk of a corporate’s suspension, debarment or other restrictions on continuing business in Hong Kong does not, as a matter of Hong Kong law, restrict the corporate from settling in another country; however, there may be legal requirements in that other country (e.g., disclosure obligations) that allow a regulator or law enforcement agency in that country to reopen a settlement if it subsequently discovers the restrictions on the corporate in Hong Kong of which it has not been previously informed.

65 What do the authorities in your country take into account when fixing penalties?

The authorities will consider all the circumstances of the case, including (1) the nature and seriousness of the conduct, (2) the value of profits accrued or loss avoided, (3) other circumstances of the firm or individual, and (4) other relevant factors.

In considering the nature and seriousness of market misconduct, the SFC will have regard to the effects of the conduct on market integrity, the costs of the conduct caused to clients or the investing public, the duration and frequency of the conduct, whether there is a breach of fiduciary duty and whether any serious or systematic management or internal control failures are revealed. The SFC will also consider the degree of co-operation with the SFC and other authorities.

Resolution and settlements short of trial

66 Are non-prosecution agreements or deferred prosecution agreements available in your jurisdiction for corporations?

There are no formal mechanisms in Hong Kong for the negotiated settlement of criminal investigations or proceedings that are equivalent to deferred prosecution agreements in the United Kingdom or the United States. However, in some limited circumstances, negotiations with, or representations made to, the Hong Kong Securities and Futures Commission (SFC) and the Hong Kong Department of Justice may result in a decision being taken not to prosecute.

67 Does your jurisdiction provide for reporting restrictions or anonymity for corporates that have entered into non-prosecution agreements or deferred prosecution agreements until the conclusion of criminal proceedings in relation to connected individuals to ensure fairness in those proceedings?

Not applicable.

68 Prior to any settlement with a law enforcement authority in your country, what considerations should companies be aware of?

The SFC has wide powers to enter into settlement agreements under the Securities and Futures Ordinance (Cap. 571) (SFO) and may do so if this is in the public interest. In considering settlement, aside from considering factors such as the strength of the prosecution and defence cases, the costs and reputational damage of a lengthy investigation and potential subsequent legal proceedings, and possible penalties, institutions should also be aware that the SFC may insist on a public reprimand of the financial institution via an announcement on the SFC’s website. The SFC will take into account the degree of co-operation in considering the settlement package.

69 To what extent do law enforcement authorities in your country use external corporate compliance monitors as an enforcement tool?

Not applicable.

70 Are parallel private actions allowed? May private plaintiffs gain access to the authorities’ files?

The SFO gives a person who has suffered pecuniary loss as a result of market misconduct the right to bring a civil action to seek compensation. Compensation will only be payable if it is fair, just and reasonable in the circumstances of the case. Findings of the Market Misconduct Tribunal in relation to market misconduct will be admissible as prima facie evidence in the private action, though proceedings before the tribunal are not a prerequisite for bringing civil proceedings. The SFC will not intervene in private legal proceedings.

Publicity and reputational issues

71 Outline the law in your country surrounding publicity of criminal cases at the investigatory stage and once a case is before a court.

In practice, law enforcement agencies do not normally publish the commencement of investigations of criminal cases (although they sometimes announce high-profile arrests or dawn raids). Publicity usually follows when a decision has been made to charge an individual or during criminal proceedings once instituted. Criminal trials in Hong Kong are conducted in open court. Some agencies, such as the Hong Kong Securities and Futures Commission and the Independent Commission Against Corruption, publicise the outcome of enforcement proceedings they have initiated on their websites from time to time.

72 What steps do you take to manage corporate communications in your country? Is it common for companies to use a public relations firm to manage a corporate crisis in your country?

There are no particular factors specific to Hong Kong in managing corporate communications in Hong Kong. The steps are likely to be similar to those that would be taken to manage corporate communications in other jurisdictions, for example, timely, accurate and effective messages using the right media channels, while being sensitive and perceptive to the geo­political environment. Public relations and media companies can be and have been used in Hong Kong to manage certain corporate crises.

73 How is publicity managed when there are ongoing related proceedings?

Publicity is usually managed by a press officer or communications department that will monitor media reports and suggest the making of public statements as and when necessary. Any public statements made by the company should be carefully drafted and any prejudicial effects on ongoing proceedings should be taken into consideration.

Duty to the market

74 Is disclosure to the market in circumstances where a settlement has been agreed but not yet made public mandatory?

For a listed corporation, settlement of a regulatory investigation may constitute inside information (depending on the nature and severity of the underlying offence or misconduct) and thus require disclosure as soon as reasonably practicable. In practice, the corporation and the authorities will usually agree on a press release being issued as part of the settlement and will agree on the timing for the release.

By way of context, inside information is defined to include specific information about the corporation that is not generally known to the public but would, if generally known, be likely to materially affect the price of the listed securities. Under Part XIVA of the the Securities and Futures Ordinance (Cap. 571), a listed corporation must, as soon as is reasonably practicable after it becomes aware or is notified of any inside information, disclose the information to the public (subject to certain exceptions).

Environmental, Social and Corporate Governance (ESG)

75 Does your country regulate ESG matters?

In terms of ESG reporting, there are mandatory disclosure requirements and disclosures required on a ‘comply or explain’ basis for Hong Kong-listed companies, which were put in place in 2016 and enhanced in 2020.

There are also requirements under the Companies Ordinance that companies registered in Hong Kong include in their annual directors’ report a ‘discussion’ on the company’s environmental policies (although there are no clear rules around what that discussion should include).

In April 2019, the Hong Kong Securities and Futures Commission (SFC) introduced high-level disclosure requirements for green and ESG SFC-authorised funds, of which there are now more than 40. Notably, the SFC states that it has obtained ‘confirmations and representations’ from fund managers but has not independently verified the criteria used to achieve the stated green or ESG investment focuses adopted (in other words, this has been ‘light touch’ regulation based on what the SFC has been told). This 2019 circular will be superseded on 1 January 2022 by a circular issued on 29 June 2021, which contains requirements in relation to:

• the ESG fund’s name;
• offering documents in respect of disclosure of the ESG focus, ESG investment strategy, asset allocation, reference benchmark (such as index fund) and risks or limitations associated with the ESG focus;
• additional disclosure; and
• periodic (at least annual) assessment and disclosure of the attainment of the ESG focus.

76 Do you expect to see any key regulatory or legislative changes emerge in the next year or so designed to address ESG matters?

In April 2021, the Stock Exchange of Hong Kong Limited issued a consultation paper on proposed amendments to its Corporate Governance Code, ESG Reporting Guide and Listing Rules to elaborate on the link between corporate governance and the ESG reporting regime, including making clear boards’ responsibility for governance and oversight of ESG matters, and assessment and management of ESG risks together with appropriate internal controls. It is also proposed that ESG reports be required to be published at the same time as annual reports effective for the financial year commencing 1 January 2022 (the current requirement is for ESG reports to be published no later than five months after the end of the financial year).

The Fund Manager Code of Conduct is also proposed to be revised to address ESG-related issues; specifically, in October 2020, the SFC issued a consultation paper on Management and Disclosure of Climate-related Risks by Fund Managers, which proposes to introduce requirements that fund managers take climate-related risks into consideration in their investment and risk management processes, make appropriate disclosures to meet investors’ growing demand for climate risk information and to combat greenwashing (exaggeration of green credentials).

77 Has there been an increase in ESG-related litigation, investigations or enforcement activity in recent years in your country?

It remains to be seen how, from which regulators and in which sectors we will see enforcement activity, although ‘greenwashing’ is a stated target. Taking that stated focus, looking back at Hong Kong regulatory enforcement trends in the past decade or so, and extrapolating forward, in the shorter term and given the more mature ESG disclosure requirements for listed companies, enforcement might be expected against listed companies and their directors (1) in respect of false or misleading disclosures inducing share trans­actions (Securities and Futures Ordinance (Cap. 571) (SFO), section 277) and (2) inside information disclosure failures by listed companies in connection with their ESG reporting (assuming ESG matters are price sensitive for a given company; SFO, Part XIVA). In the medium term, there might be disciplinary action taken by the SFC and other regulators in relation to ESG disclosure failures in respect of their obligations as regulated entities, or breaches of ESG-specific regulatory obligations, for example, in connection with the proposed ESG-related enhancements to the Fund Manager Code of Conduct.

Anticipated developments

78 Do you expect to see any key regulatory or legislative changes emerge in the next year or so designed to address corporate misconduct?

Corporate misconduct, in particular, by listed companies and their directors, will remain a key enforcement priority of the Hong Kong Securities and Futures Commission (SFC), the Independent Commission Against Corruption and the Hong Kong Police Force, as well as the Stock Exchange of Hong Kong Limited (the Exchange). The priorities are to tackle overstatement or embellishing of revenue or financial results and misappropriation of assets. The Exchange has enhanced its disciplinary powers and sanctions, which will have a direct impact on Hong Kong-listed companies and their directors.

In 2020 and 2021, the SFC issued circulars to address misconduct in the context of the operation of bank accounts (June 2021), anti-bribery guidance (December 2020) and leveraged foreign exchange trading activities (April 2020). It launched a consultation in February 2021 to address intermediaries’ conduct issues in their carrying out of equity and debt capital raisings in terms of book-building, pricing, allocation and placing activities. In June 2021, consultation conclusions were published for the enhancement of the competency framework for intermediaries, including updating academic and experience entry requirements as well as ongoing competency and training. The revisions are to become effective on 1 January 2022. Another key expected change is the introduction of the investor identification regime (in the second half of 2022) and the over-the-counter securities transactions reporting regime (in the first half of 2023), as indicated in the Consultation Conclusions published in August 2021. This will make the detection of market misconduct more efficient and have a significant effect on enforcement, apart from saving the SFC’s time in issuing section 181 notices to firms asking about the information of underlying clients who conduct certain trades.

We also expect closer co-operation between the SFC and the China Securities Regulatory Commission in cross-border investigations, in particular concerning market manipulation in the context of the China–Hong Kong Stock Connect programme, and increased joint operations between enforcement agencies within Hong Kong, apparent from the memoranda of understanding signed between the SFC and the Financial Reporting Council, and between the SFC and the Insurance Authority in 2020 and 2021.

Footnotes

Donna Wacker and Jonathan Wong are partners, and Anita Lam, William Wong and Michael Wang are consultants at Clifford Chance. They acknowledge the assistance of colleague Felicia Cheng, a professional support lawyer at Clifford Chance. This chapter does not consider the implications of the Hong Kong National Security Law.