Hong Kong

General context, key principles and hot topics

1 Identify the highest-profile corporate investigation under way in your country, describing and commenting on its most noteworthy aspects.

The Securities and Futures Commission (SFC) remains active in pursuing alleged corporate fraud and misfeasance by listed companies, as well as members of their current or former senior management. As noted in its 2022 Annual Report, the SFC’s focus is on combating fraud relating to initial public offerings (IPOs) (in particular where it involves other serious white-collar crimes such as bribery, forgery and false accounting), seeking redress for harmed investors, keeping wrongdoers from acting as directors of listed companies, as well as misappropriation of assets such as siphoning off cash reserves through dubious loans to associates and nominees. The SFC (and the Market Misconduct Tribunal) obtained or made disqualification orders against company directors for embellishing their IPO prospectuses or financial statements in three cases (Anxin-China, DBA Telecommunication and Tianhe Chemicals). The SFC also conducted a joint operation with the Commercial Crime Bureau of the Hong Kong Police Force (HKPF) in August 2021 against a listed company and its senior executives in a HK$450 million corporate fraud case involving fictitious transactions, disclosure of false or misleading information, misappropriation of funds and money laundering. Further, the Financial Reporting Council (FRC) (Amendment) Ordinance 2021 (the commencement date of which was 1 October 2022) transfers regulatory powers from the self-regulating Hong Kong Institute of Certified Public Accountants (HKICPA) to the independent FRC, which will become the Accounting and Financial Reporting Council (AFRC). The AFRC will regulate public interest entities or listed company auditors (including exercising powers of inspection, investigation and discipline), and certified public accountants and practice units. The FRC seeks to improve the overall quality of audits performed on Hong Kong-listed companies. It published consultation conclusions in relation to its disciplinary process and sanctions approach in June 2022, and new disciplinary policies and guidelines applicable to listed company auditors came into effect on 24 June 2022. In 2021 and up to July 2022, the FRC issued nine investigation reports regarding failures by auditors of listed entities to obtain sufficient evidence or to identify or address material misstatements. Pursuant to transitional provisions, as the relevant audits were completed before 1 October 2019, the investigation reports were referred to the HKICPA to determine whether disciplinary action would be warranted.

There continues to be a focus on anti-money laundering (AML) and anti-bribery and corruption. A record fine in the region of HK$2.7 billion was imposed by the SFC in October 2020 for serious lapses and deficiencies in AML controls in the context of bond offerings by 1Malaysia Development Berhad. In 2020 and up to July 2022, there have been 11 other cases involving AML control failures leading to fines of between HK$3.6 million and HK$25.2 million.

Regarding anti-bribery and corruption, the SFC works closely with the Independent Commission Against Corruption (ICAC). Following a joint operation with the SFC, the ICAC charged former executive directors and managers of Convoy Global Holdings Limited with conspiracy to defraud in July 2019. In October 2021, they were convicted and sentenced to between four and seven months’ imprisonment. Two former executive directors were also disqualified from being company directors for three years and two years, respectively. In another joint operation with the SFC in August 2021, the ICAC arrested five individuals, including senior executives of a listed company, for suspicious money lending activities and suspected corruption. The FRC also conducted a joint operation with the ICAC in November 2021 under the memorandum of understanding signed between them in September 2021. The offices of a listed company auditor were searched and arrests were made for suspected corruption offences.

One of the SFC’s top enforcement priorities since 2020 has been combating online ‘ramp and dump’ schemes, often conducted using social media platforms and accounting for a significant percentage of SFC’s market manipulation investigations. The SFC issued a circular in June 2021 reminding licensed intermediaries of their obligation under the Code of Conduct to report suspected ramp and dump schemes. In the first joint operation of its kind, it further conducted a simultaneous operation with the Monetary Authority of Singapore and the police forces of both jurisdictions in December 2021 to arrest 10 individuals, including senior executives of Hong Kong listed companies, for being key members or associates of a syndicate suspected of operating cross-border ramp-and-dump schemes. Suspected money laundering was also involved.

Other online, unlicensed or fraudulent activity also gave rise to enforcement action on the part of the SFC. In June 2021 and May and June 2022, it obtained compensation orders against boiler room, pyramid and Ponzi scheme fraudsters (Broadspan Securities, Shepherds Hill Partners, Rich Futures, DFRF Enterprises, Maxim Capital and Maxim Trader). In addition, fractionalised non-fungible tokens and fungible tokens structured in a form similar to securities or collective investment schemes were the subject of a reminder of associated risks to investors in June 2022. Further, unregulated virtual asset platforms have been a concern with stock token trading services offered by Binance, which the SFC considered likely to be securities, being the subject of a warning statement in July 2021. Heightened regulatory scrutiny, if not enforcement, are on the horizon in this area given the recent volatility in the crypto market and with the issue of the joint circular between the SFC and the Hong Kong Monetary Authority (HKMA) in January 2022 providing guidance to intermediaries wishing to engage in virtual asset-related activities, including distributing related products and providing dealing and advisory services, and the proposed introduction of a licensing regime for virtual asset exchange operators in March 2023.

Also relevant to corporate investigation is the SFC’s June 2022 consultation seeking to broaden its enforcement powers (discussed further under question 78). The SFC proposes to extend section 213 of the Securities and Futures Ordinance (SFO) (Cap. 571) to empower it to be able to apply to the court for restoration, damages and other civil remedial orders after its exercise of disciplinary powers under section 194 or section 196 for misconduct or unfitness. This proposal has generated some concern for its potential breadth of application and the need for clarity as to the stated targeting of ‘serious’ misconduct and what this means in terms of the type of misconduct potentially giving rise to investor compensation.

There is continued close co-operation between the SFC and regulators in mainland China, including the China Securities Regulatory Commission (CSRC) and the China Banking Regulatory Commission. As a recent example, the CSRC assisted the SFC in obtaining restoration orders against those engaged in insider dealing in the shares of TeleEye.

2 Outline the legal framework for corporate liability in your country.

The law of Hong Kong has followed the common law of England and Wales in ascribing corporate liability for criminality, and has developed two main techniques for attributing to a corporate the acts and states of mind of the individuals it employs:

• the ‘identification principle’, whereby, subject to some limited exceptions, a corporate entity may be indicted and convicted for the criminal acts of the directors and managers who represent its directing mind and will, and who control what it does; and
• vicarious liability, under which a corporation is liable for the criminal acts of its employees or agents under statutory offences that impose an absolute duty on the employer.

A number of offences in Hong Kong legislation target corporates and regulate business activity. They include offences provided in the Companies Ordinance (Cap. 622), SFO (Cap. 571), the Trade Descriptions Ordinance (Cap. 372) and the Theft Ordinance (Cap. 210).

3 Which law enforcement authorities regulate corporations? How is jurisdiction between the authorities allocated? Do the authorities have policies or protocols relating to the prosecution of corporations?

Corporations are subject to investigation or regulation by a number of authorities, including the ICAC, the HKPF, the Customs and Excise Department, the Companies Registry, the Inland Revenue Department, the SFC, the Hong Kong Monetary Authority (HKMA), the Insurance Authority (IA), the Competition Commission and the Office of the Privacy Commissioner (OPC).

By way of illustration of the allocation of jurisdiction between Hong Kong authorities, regulation by the SFC and the HKMA of registered institutions and their executive officers and management is governed by the 2002 memorandum of understanding, as amended in 2004. For example, the SFC has the statutory power to discipline a former relevant individual. In October and December 2021 and March and July 2022, following referral by the HKMA, the SFC banned six former relevant individuals from banks from re-entering the industry for life (in respect of two individuals), 10 years, three years, 27 months and six months, respectively, in separate incidents involving:

• unfitness in cutting and pasting a customer’s signature onto a direct debit authorisation form to deceive the bank and an insurance company into believing that the form was signed by the customer;
• their discretionary operation of client accounts under the guise of pre-signed client instruction forms without actual written client authorisation;
• fraudulently obtaining a quarterly incentive payment in conspiracy with the individual’s mother through making (and subsequently reversing) transfers into newly opened customer payroll accounts without the knowledge of the customers;
• misrepresenting academic qualifications in support of employment applications; and
• two instances of bribery convictions.

In August 2021, the SFC also fined an investment bank following referral by the HKMA for failure to properly disclose financial interests in Hong Kong listed companies, as covered in its research reports, caused by errors in logic in its tracking of shareholding positions and other system and control failures.

Hong Kong’s Department of Justice (DOJ) has overall responsibility for conducting criminal prosecutions; the other authorities named above conduct investigations and sometimes carry out prosecutions, depending on the offences involved. For example, the SFC is empowered only to prosecute offences under SFO (Cap. 571) in the magistrates’ courts, where the power to impose penalties is more restricted. The SFC is required to refer cases to the DOJ for prosecution of offences under SFO (Cap. 571) in the District Court and the Court of First Instance: in August 2020, criminal prosecution was commenced for offences under the SFO against five individuals involved in alleged false trading of shares of Ching Lee Holdings Limited in the Court of First Instance for a trial by jury, which is the first of its kind. There has also been an increase in co-operation between law enforcement authorities in mounting joint investigations.

4 What grounds must the authorities have to initiate an investigation? Is a certain threshold of suspicion necessary to trigger an investigation?

In general, criminal authorities must have reasonable grounds to suspect that a crime has been committed before starting an investigation. The threshold of suspicion is relatively low.

5 How can the lawfulness or scope of a notice or subpoena from an authority be challenged in your country?

A challenge to a search and seizure warrant or production order, and a request to exclude evidence gathered as a result, can be made based on scope, the grounds on which the order was obtained, legal professional privilege or public interest grounds through an application to the Hong Kong courts.

6 Does your country make use of co-operative agreements giving immunity or leniency to individuals who assist or co-operate with authorities?

Deferred prosecution agreements (DPAs) are commonly used by prosecutors and regulators in the United States and the United Kingdom. Although they have not been formally introduced in Hong Kong, different Hong Kong regulators have, in practice, their own co-operation arrangements. For example, the ICAC or the HKPF from time to time grant perpetrators immunity from prosecution in return for co-operation, after consultation with the DOJ. Both the SFC and the HKMA have published guidance notes on co-operation in investigations and enforcement proceedings under which a person may obtain a credit on the disciplinary penalty if they settle with the regulators. These guidance notes do not apply to criminal cases over which the DOJ has sole discretion. It is also common for the SFC or the HKMA to require, as a part of a settlement, the appointment of an independent reviewer, who may perform a role similar to a that of a monitor under DPAs in the United States or the United Kingdom.

7 What are the top priorities for your country’s law enforcement authorities?

The HKPF’s priorities are syndicated and organised crime, money laundering and ‘quick cash’ crime (e.g., theft, extortion and deception). The HKPF is also prioritising cyber­security and technology crime, particularly through the internet and social media.

The SFC’s enforcement priorities include investment fraud and online investment scams, including ramp-and-dump schemes, corporate misfeasance and fraud by companies or their senior management (such as misappropriation of companies’ assets and IPO-related fraud, in particular, that also involving other serious white-collar crimes such as bribery, forgery and false accounting), intermediary misconduct (such as internal control deficiencies, sponsors’ due diligence failures and mis-selling of financial products) and money laundering.

The HKMA’s priorities include market integrity, consumer protection over new and innovative products such as ‘buy now pay later’, insurance products and risk management relating to money laundering and the financing of terrorism, digitalisation and technology, including remote customer onboarding and non-face-to-face distribution (such as dependence on technology service providers and the transition to hybrid working), operational and cyber resilience, prevention of online fraud and financial crime and credit risk management, as well as developmental priorities in the form of upskilling practitioners and building a sustainable future talent pipeline, and green and sustainable banking.

The Insurance Authority (IA) focuses on protecting and promoting the rights and interests of policy­holders and facilitating the sustainable development of the insurance industry both in Hong Kong and regionally. From 23 September 2019, the IA took over regulation of insurance intermediaries from three self-regulatory organisations and delegated certain inspection and investigation powers to the HKMA with respect to insurance-related businesses carried on by authorised institutions. The group-wide supervision framework came into effect in March 2021 providing for regulation of multinational insurance groups through power over Hong Kong-incorporated holding companies. The architecture for the IA’s disciplinary processes was put in place in November 2020 with the establishment of the Disciplinary Panel Pool (DPP) and the Expert Advisor Panel (EAP). Three-person disciplinary panels are formed from the DPP to decide disciplinary cases on behalf of the IA. EAP members assist the IA by giving advice on technical insurance matters during investigations. The IA started taking the first disciplinary actions against three insurance intermediaries in May and December 2021. The IA has been focusing on money laundering risks, including during virtual onboarding made more common during the covid-19 pandemic. In January 2022, the IA fined two insurance companies HK$7 million for AML control failures.

With a relatively even focus on combating corruption in both the public and private sectors in 2020, private sector corruption complaints rose in 2021, with 35 per cent of total complaints concerning government departments and public bodies and 65 per cent concerning the private sector; 80 per cent of those prosecuted in 2021 were from the private sector. The areas of focus were building management, construction, finance and insurance. The ICAC also has a proceeds of crime section to deal with restraint, disclosure and confiscation of assets under the Organised and Serious Crimes Ordinance (Cap. 455) and, as at the end of 2021, assets valued at HK$1.062 billion continued to remain restrained and the Court of First Instance granted two confiscation orders resulting in the confiscation of HK$12 million worth of assets.

8 To what extent do law enforcement authorities in your jurisdiction place importance on a corporation having an effective compliance programme? What guidance exists (in the form of official guidance, speeches or case law) on what makes an effective compliance programme?

Save for the financial industry, which is heavily regulated, and Hong Kong-listed companies (although these are not directly regulated by a law enforcement authority, per se), Hong Kong does not have statutorily mandated compliance programmes that are required of all corporations generally, and there is no statutory leniency offered to corporations with a compliance programme. That notwithstanding, it is good practice to have an effective compliance programme in place, and some law enforcement authorities, such as the ICAC, have published guidance encouraging corporations to set up such programmes.

In respect of the financial industry, for persons licensed by or registered with the SFC, one of the nine general principles in the Code of Conduct is compliance. Paragraph 4.3 of the Code of Conduct provides that a licensed corporation should have internal control procedures that reasonably protect operations, clients and other persons from financial loss occasioned by theft, fraud and other dishonesty, as well as from professional misconduct, and the SFC has issued the Management, Supervision and Internal Control Guidelines (April 2003) to provide further guidance with respect to the SFC’s expectations in relation to internal controls. Similarly, with respect to authorised institutions (i.e., banks and deposit-taking companies), the HKMA has issued a Supervisory Policy Manual on Risk Management Frameworks, which provides that banks are expected to have a programme in place to ensure compliance with applicable statutory provisions, regulatory requirements and codes of conduct.

Listed companies are subject to the Listing Rules, appended to which is the Corporate Governance Code (the CG Code), which covers such areas as board practice and composition; director remuneration and responsibilities; delegation; supply of information to directors; financial reporting; audit committee; company secretary; and communication with shareholders. It sets out the principles of good corporate governance at two levels: code provisions and recommended best practices. The CG Code adopts the comply or explain approach; listed companies must state whether they have complied with the code provisions in their interim and annual reports and, if they have not, give considered reasons. This approach is encouraged, but not required, for recommended best practices. The CG Code provides that the board is responsible for determining the nature and extent of the risks it is willing to take in achieving the listed company’s strategic objectives, and ensuring the listed company establishes and maintains appropriate and effective risk management and internal control systems. The board should oversee management in the design, implementation and monitoring of these systems. The board should ensure that a review of the effectiveness of the systems is conducted at least annually, and report to shareholders that it has done so, and whether the listed company considers the systems effective and adequate in its corporate governance report. The review should cover all material controls such as financial, operational and compliance. Failure to report will be regarded a breach of the Listing Rules.

Cyber-related issues

9 Does your country regulate cybersecurity? Describe the approach of local law enforcement authorities to cybersecurity-related failings.

There is no overarching legal framework for cybersecurity in Hong Kong. Entities regulated by the Securities and Futures Commission (SFC), the Hong Kong Monetary Authority (HKMA) and the Insurance Authority (IA) must abide by the various guidelines and circulars concerning cyber risk management, resilience testing and management accountability.

In October 2017, the SFC published guidelines requiring all licensed corporations engaged in internet trading to implement 20 baseline requirements covering preventive, detection and internal governance-related controls. At the same time, the SFC issued a circular advising that the guidelines are only minimum standards and senior management should ensure that all systems and controls are commensurate with business needs and operations, and implement additional cybersecurity controls as necessary. Under the April 2003 Management, Supervision and Internal Control Guidelines of the SFC, licensed persons are required to implement an effective business continuity plan appropriate to their size to ensure that they are protected from interruption risk, which may arise from a cyberattack. In March 2022, a circular was issued regarding managing the risks of business email compromise as a reminder of the SFC’s expectations to monitor such risks vigilantly and to have internal control procedures and financial and operational capabilities in place that can reasonably protect operations and clients from financial losses.

The HKMA issued a circular in September 2015 stating that senior management should evaluate periodically the adequacy of an authorised institution’s cybersecurity controls having regard to emerging cyber threats and credible cybersecurity control benchmarks. The circular also pinpointed the need for contingency planning and independent assessment. In May 2021, the HKMA issued a further circular requesting critical assessment of the need for secure tertiary data backup to counter the risk of cyber­attacks. In addition, the HKMA launched a Cybersecurity Fortification Initiative (CFI), one of the pillars of which is the Cyber Resilience Assessment Framework (C-RAF). An upgraded CFI (CFI 2.0) came into effect on 1 January 2021. There is a timeline for authorised institutions to complete their C-RAF 2.0 assessments by the end of 2023. C-RAF 2.0 encompasses enhanced control principles reflecting the latest developments in overseas cyber practices in relation to cyber incident response and recovery.

The IA published a guideline on cybersecurity (GL 20) in June 2019, which sets out the minimum standard for cybersecurity that authorised insurers are expected to have in place.

The Personal Data Privacy Ordinance (Cap. 486) addresses the security of personal data, including data storage and security measures.

Large-scale cybersecurity failings resulting in breach of personal data protection rules are treated seriously by regulators. The Office of the Privacy Commissioner regularly carries out investigations of such failings and issues enforcement notices. Failure to comply with these notices may lead to criminal sanctions.

10 Does your country regulate cybercrime? What is the approach of law enforcement authorities in your country to cybercrime?

There are a number of offences under Hong Kong law targeting cybersecurity-related crimes, including unauthorised access to a computer by telecommunications under the Telecommunications Ordinance (Cap. 106) and access to a computer with criminal or dishonest intent under the Crimes Ordinance (Cap. 200). Other offences that may be applied to prosecute cybercrime include criminal damage under the Crimes Ordinance and theft under the Theft Ordinance (Cap. 210).

In July 2022, the Law Reform Commission published a consultation paper recommending a new single ordinance to deal specifically with cybercrime and the introduction of five cybercrimes into Hong Kong law, comprising illegal access to a program or data; illegal interception of computer data; illegal interference with computer data; illegal interference with a computer system; and making available or possessing a device or data for committing a crime. This would bring Hong Kong in line with the position globally. It is proposed that the breadth of existing law be retained subject to some existing offences being refined and consolidated into the recommended new ordinance. Extraterritorial application is suggested when there is a connection with Hong Kong and serious damage to Hong Kong may be caused. Views on the availability of defences and exemptions are being sought. The consultation period ended on 19 October 2022.

The Cybersecurity and Technology Crime Bureau (CSTCB) of the Hong Kong Police Force is responsible for carrying out investigations into technology crime, including computer forensic examinations. The CSTCB also liaises closely with local and overseas law enforcement agencies on combating cross-border technology crime.

Cross-border issues and foreign authorities

11 Does local criminal law have general extraterritorial effect? To the extent that extraterritorial effect is limited to specific offences, give details.

The primary basis of criminal jurisdiction in Hong Kong is territorial, and the courts apply a strong presumption against construing statutes as having extraterritorial effect.

The Criminal Jurisdiction Ordinance (Cap. 461) deals with Hong Kong’s extra­territorial criminal jurisdiction. The offences to which Cap. 461 applies are divided into Group A offences, which include theft, fraud, deception, blackmail and offences relating to false instruments, and Group B offences, which cover conspiracy, attempting or incitement to commit a Group A offence, and the offence of conspiracy to defraud.

Cap. 461 allows Hong Kong courts to exercise jurisdiction over offences under both groups in the following circumstances:

• any of the constituent elements of the offence occurs in Hong Kong; or
• there is an attempt to commit the offence in Hong Kong, whether or not the attempt is made in Hong Kong or elsewhere and irrespective of whether it has an effect in Hong Kong; or
• there is an attempt or incitement in Hong Kong to commit the offence outside Hong Kong; and
• the substantive offence was not intended to take place in Hong Kong.

As regards a conspiracy to commit a Group A offence, or conspiracy to defraud, jurisdiction depends on proof that the pursuit of the agreed course of conduct would involve conduct punishable under the law in force in the place where the conduct was intended to take place. The prosecution must also prove that:

• a party to the agreement constituting the conspiracy, or a party’s agent, did something in Hong Kong in relation to the agreement before its formation; or
• a party to the conspiracy became a party in Hong Kong (by joining it either in person or through an agent); or
• a party to the conspiracy, or a party’s agent, did or omitted to do anything in Hong Kong in pursuance of it; and
• the conspiracy would be triable in Hong Kong, but the parties to it had not intended that the offence or fraud would take place in Hong Kong.

In relation to conspiracies to commit all other offences, section 159A of the Crimes Ordinance (Cap. 200) codifies the general common law rule limiting extraterritorial jurisdiction in conspiracy cases and provides that conspiracies entered into in Hong Kong are triable in Hong Kong only if the agreement is to commit substantive offences that are triable in Hong Kong. Conspiracies entered into abroad to commit substantive offences in Hong Kong would be triable in Hong Kong even before any acts were carried out within the territory in furtherance of the conspiracies. However, conspiracies entered into in Hong Kong to commit offences abroad would not be triable in Hong Kong.

12 Describe the principal challenges that arise in your country in cross-border investigations, and explain whether and how such challenges depend on the other countries involved.

Cross-border investigations may touch on Hong Kong’s data privacy regime, or regimes of other countries in Asia, such that employee or customer consent may be required prior to disclosing certain protected information. Cross-border investigations involving China should be conducted in compliance with the Chinese Law on Guarding State Secrets, the Chinese Cybersecurity Law (CSL) and Chapter VI of the new Civil Code (which concerns personal data privacy), which came into effect on 1 January 2021. A new Data Security Law (DSL) in China has also been passed and took effect in September 2021. It regulates data activities to protect and promote state security and development. It purports to have extraterritorial effect applying to data activities outside China that may harm national security or public interests, or the legitimate rights of Chinese citizens or entities. Further, the new Personal Information Protection Law (PIPL) took effect in November 2021, which also purports to have extraterritorial effect governing offshore processing of personal information of individuals in China in relation to the provision of goods or services to, or analysis of activities of, such individuals. In certain cases, investigators may need to undertake their work on site in China with strict protocols in place to prevent the prohibited export of information to Hong Kong or elsewhere. Even if export is not prohibited, those conducting investigations will need to consider the need for security assessment by the Cyberspace Administration of China (CAC) for the export of certain data as required by the CSL, DSL and PIPL. In this regard, the Security Assessment Measures for Data Export published by the CAC took effect on 1 September 2022. These Measures confirm that security assessment is required for the export of important data and personal information by critical information infrastructure operators and data processors that process or export above certain thresholds.

In July 2019, the Chinese Ministry of Finance (MOF), the China Securities Regulatory Commission (CSRC) and the Securities and Futures Commission (SFC) entered into a memorandum of understanding concerning the obtaining of audit working papers in China. The aim of this is to facilitate the SFC’s access to these documents when conducting investigations into Chinese companies listed in Hong Kong and their related entities or persons. Under the memorandum of understanding, the MOF and the CSRC will provide the fullest assistance in response to requests by the SFC for investigative assistance regarding the provision of audit working papers. The Financial Reporting Council (FRC) also has a May 2019 memorandum of understanding with the Supervision and Evaluation Bureau of the MOF under which it may obtain assistance for the provision of audit working papers. In July 2021, the FRC completed its first investigation report using audit working papers obtained thereunder in relation to a failure by the auditor of a listed entity to identify a material misstatement in the consolidated financial statements. A second investigation report using audit working papers similarly obtained was completed in August 2021, involving a similar failure.

13 Does double jeopardy, or a similar concept, apply to prevent a corporation from facing criminal exposure in your country after it resolves charges on the same core set of facts in another? Is there anything analogous in your jurisdiction to the ‘anti-piling on’ policy as exists in the United States (the Policy on Coordination of Corporate Resolution Penalties) to prevent multiple authorities seeking to penalise companies for the same conduct?

The right of an accused to advance double jeopardy is found in the Hong Kong Bill of Rights Ordinance (Cap. 383) and the Criminal Procedure Ordinance (Cap. 221). This protection extends to corporations convicted or acquitted of an offence abroad. There is no express or specific legislation or regulation analogous to the ‘anti-piling on’ policy as exists in the United States.

14 Are ‘global’ settlements common in your country? What are the practical considerations?

Regarding global settlements involving more than one country, there are no published figures on their prevalence. The SFC has co-operative arrangements for investigatory assistance and exchange of information with many overseas regulators. In particular, the CSRC and the SFC have maintained a close strategic partnership to tackle cross-border trading misconduct. The Hong Kong Monetary Authority has co-operative arrangements with the People’s Bank of China and the China Banking and Insurance Regulatory Commission to ensure cross-border banking operations are effectively controlled and prudently conducted. The Insurance Authority has co-operative arrangements with the China Insurance Regulatory Commission to enhance insurance supervision and co-operation against insurance fraud.

When handling ‘global’ settlements, practical considerations include ensuring information parity between regulators and coordinating the timing of publishing or announcing the settlement in different jurisdictions.

15 What bearing do the decisions of foreign authorities have on an investigation of the same matter in your country?

To facilitate investigation of the same matter, the Hong Kong authorities generally try to co-operate with their counterparts in foreign jurisdictions and in China. For example, in October 2014, the SFC and the CSRC entered into a memorandum of understanding on strengthening cross-boundary regulatory and enforcement co-operation with a view to tackling market manipulation in China and Hong Kong. Furthermore, the MOF, the CSRC, the SFC and the FRC entered into memoranda of understanding on audit working papers.

In addition, Hong Kong has mutual legal assistance agreements with a number of countries, and a number of international treaties provide for cross-border co-operation.

Economic sanctions enforcement

16 Describe your country’s sanctions programme and any recent sanctions imposed by your jurisdiction.

Hong Kong generally adheres to United Nations Security Council sanctions, including pursuant to the Weapons of Mass Destruction (Control of Provisions of Services) Ordinance (Cap. 526), the United Nations Sanctions Ordinance (Cap. 537) and the United Nations (Anti-Terrorism Measures) Ordinance (Cap. 575) with oversight by the Chinese Ministry of Foreign Affairs. Hong Kong does not impose unilateral or autonomous sanctions.

17 What is your country’s approach to sanctions enforcement? Has there been an increase in sanctions enforcement activity in recent years, for example?

Multiple agencies share responsibility for the administration and enforcement of Hong Kong sanctions, including the Chief Executive, the Hong Kong Department of Justice, the Hong Kong Monetary Authority, the Hong Kong Securities and Futures Commission, the Commerce and Economic Development Bureau, the Customs and Excise Department, and the Trade and Industry Department. Although regulatory focus has increased, particularly for the financial sector, there have been no notable cases of criminal enforcement of sanctions breaches in Hong Kong in recent years.

18 Do the authorities responsible for sanctions compliance and enforcement in your country co-operate with their counterparts in other countries for the purposes of enforcement?

Hong Kong has a variety of mutual legal assistance arrangements with foreign jurisdictions, which may be used in support of sanctions-related investigations.

19 Has your country enacted any blocking legislation in relation to the sanctions measures of third countries? Describe how such legislation operates.

Hong Kong has no such legislation, albeit China enacted its Anti-Foreign Sanctions Law in June 2021. There was some discussion in August 2021 that China’s Anti-Foreign Sanctions Law would be introduced into Hong Kong’s Basic Law by the Standing Committee of the National People’s Congress. It was later reported that China’s government had decided not to proceed with the plan for the time being.

20 To the extent that your country has enacted any sanctions blocking legislation, how is compliance enforced by local authorities in practice?

Not applicable.

Before an internal investigation

21 How do allegations of misconduct most often come to light in companies in your country?

Whistleblower complaints, both internal and external, are a frequent source of allegations of misconduct leading to investigations, particularly with respect to bribery and corruption. The role of the Independent Commission Against Corruption (ICAC) in receiving and investigating complaints made against individuals is critical. Enquiries by the ICAC to companies regarding their employees’ conduct will often lead to an internal investigation to identify potential breaches of internal policy even when there is no corporate liability under the law.

Where there is known or suspected money laundering or terrorist financing, suspicious transaction reports (STRs) are required to be filed with the Joint Financial Intelligence Unit. The Unit, jointly run by the Hong Kong Police Force and Hong Kong Customs and Excise Department, manages the STR regime, receiving and analysing reports and disseminating them to appropriate law enforcement agencies (and financial intelligence units) in and outside Hong Kong.

Regulatory reviews by the Securities and Futures Commission (SFC), the Hong Kong Monetary Authority (HKMA) or other regulators are another source of allegations of misconduct. Further, corporations and institutions licensed by the SFC or the HKMA have an obligation to report material breaches (or suspected breaches) of any law, rules or regulations (including suspected misconduct) to their regulators. Specifically, corporations licensed by the SFC are expressly required to report material breaches (or suspected breaches) of market misconduct provisions under the Securities and Futures Ordinance (Cap. 571) by their clients.

Information gathering

22 Does your country have a data protection regime?

Hong Kong has a data protection regime that has been given statutory force through the Personal Data Privacy Ordinance (Cap. 486) (PDPO). The PDPO applies to any data relating directly or indirectly to a living person from which it is possible to identify that person and the data is in a form in which access or processing is practicable. The PDPO contains six data protection principles (DPPs) that govern the purpose and manner of collection, the accuracy and duration of retention, the use and security of personal data, and rights of access and correction.

23 To the extent not dealt with above at question 9, how is the data protection regime enforced?

Contravening a DPP may give rise to a complaint to be investigated by the Office of the Privacy Commissioner (OPC). A data user may be punished under the PDPO (Cap. 486) for failing to comply with an enforcement notice issued by the OPC, after a finding of a contravention. An enforcement notice may direct the data user to take steps to remedy the contravention and prevent a recurrence. The OPC also has power to prosecute suspected doxxing offences. A data user may separately bring a civil claim for damages on the basis of a contravention of a DPP, whether or not the OPC has issued an enforcement notice.

24 Are there any data protection issues that cause particular concern in internal investigations in your country?

The provisions of the PDPO (Cap. 486) cover the monitoring and gathering of data in the context of internal investigations, whether this be by monitoring the internet, public social media posts, telephone calls, chats, emails or other internal communication channels. An individual who suffers damage (including ‘injured feelings’) by reason of a breach may sue. The PDPO also criminalises doxxing. The offences cover criminalisation of the disclosure of personal data without the data subject’s consent where the disclosing party has an intent to cause harm, or is reckless in regard to causing harm, such as harassment or pestering, bodily or psychological harm, or damage to property. The PDPO also empowers the OPC to serve notices to cease or restrict disclosure of doxxing content and carry out criminal investigation, and failure to comply or co-operate with the same may lead to a criminal offence. Arrests have been made and charges have been laid for doxxing for suspected disclosure of personal data on a social media platform amid monetary disputes and personal relationship disputes.

25 Does your country regulate or otherwise restrict the interception of employees’ communications? What are its features and how is the regime enforced?

Interception of communications and covert surveillance are regulated by the Interception of Communications and Surveillance Ordinance (Cap. 589) and can only be exercised by the Customs and Excise Department, the Hong Kong Police Force and the Independent Commission Against Corruption with prescribed authorisation.

Monitoring and surveillance of employee communications is regulated by the PDPO (Cap. 486). Prior to implementing any surveillance system, an employer must take such steps as are reasonable, in the circumstances, to ensure its employees are aware of (among other things) the fact that the information is being collected and the purpose of collection.

Dawn raids and search warrants

26 Are search warrants or dawn raids on companies a feature of law enforcement in your country? Describe any legal limitations on authorities executing search warrants or dawn raids, and what redress a company has if those limits are exceeded.

Dawn raids are used by the Securities and Futures Commission (SFC) and the Hong Kong Monetary Authority (HKMA) in the context of regulatory investigations, by the Independent Commission Against Corruption in bribery investigations and by the Hong Kong Police Force in relation to the commission of any offence. Dawn raids may also be used by the Competition Commission in investigating offences under the Competition Ordinance (Cap. 619). They can take place either with a warrant issued by a magistrate or without a warrant in limited circumstances. The Office of the Privacy Commissioner has been given dawn raid powers for certain offences relating to disclosure of personal data without consent and with specified harmful intent following changes made to the PDPO (Cap. 586), which came into effect on 8 October 2021.

27 How can privileged material be lawfully protected from seizure during a dawn raid or in response to a search warrant in your country?

Generally, privileged material cannot be seized during a dawn raid or in response to a search warrant. To protect privileged material from seizure, a claim of privilege should be made, and if there is a dispute as to whether certain material is privileged, the material should be sealed until the dispute is resolved. However, privilege may be overridden by a court order. Privilege will also not attach to material created for the purpose of committing a crime.

28 Under what circumstances may an individual’s testimony be compelled in your country? What consequences flow from such compelled testimony? Are there any privileges that would prevent an individual or company from providing testimony?

Privilege against self-incrimination is recognised in Hong Kong. A person may decline to provide information in an investigation that may lead to self-incrimination.

An exception is that authorities such as the SFC and the HKMA may issue a notice under relevant statutory provisions compelling a witness to answer questions or produce documents, and self-incrimination is not a reason for non-compliance. However, the information provided by the person compelled by the notice will be inadmissible in evidence against the person in criminal proceedings except for certain offences, such as perjury.

Whistleblowing and employee rights

29 Describe the whistleblowing framework in your country. What financial incentive schemes exist for whistleblowers? What legal protections are in place for whistleblowers?

Hong Kong currently does not have a comprehensive or overarching framework to protect whistleblowers and the legal protections for whistleblowers are limited. There are no financial incentive schemes for whistleblowers to volunteer information. However, listed companies are encouraged to adopt a whistleblowing policy as ‘recommended best practice’ under the Corporate Governance Code (CG Code) of the Stock Exchange of Hong Kong Limited (the Exchange). In the Exchange’s December 2021 consultation conclusions, it confirmed the adoption of a whistleblowing policy being upgraded from a recommended best practice to a provision in the CG Code; the upgrade came into effect on 1 January 2022. Guidance can be found in the Exchange’s Corporate Governance Guide for Boards and Directors published in December 2021, which is to be read with the Listing Rules and the CG Code. The Hong Kong Monetary Authority (HKMA) also advised in its March 2017 bank culture reform circular that authorised institutions should put in place a whistleblowing mechanism to facilitate timely reporting of any illegal, unethical or questionable practices in a confidential setting without the risk of reprisals. This message was repeated in the HKMA’s May 2020 circular reporting on its review of bank culture self-assessments, with the HKMA stating that more work was needed to promote an environment that provides psychological safety to encourage staff to speak out without fear of adverse consequences. The Financial Reporting Council launched a new whistleblowing policy in December 2021 to encourage whistleblowers to make reports about potential misconduct or wrongdoing in financial reporting or audits of listed entities. The new policy emphasises that a whistleblower may choose to remain anonymous and any personal information shared by whistleblowers will not be disclosed to third parties unless there is a legal obligation to do so.

Under the Employment Ordinance (Cap. 57), an employee giving evidence in proceedings or in response to enquiries in connection with the enforcement of the Employment Ordinance, work accidents or breach of work safety legislation is protected from dismissal and discrimination.

Other ordinances covering race, gender, pregnancy, breastfeeding, marital status, family status and disability also protect individuals who act against discrimination and harassment, or assist with investigations against victimisation.

Hong Kong law protects individuals who disclose suspected money laundering or other crimes by preventing the disclosure from being treated as a breach of any restrictions imposed by contract, enactment or rule of conduct. Similarly, there is protection for a whistleblower against any civil liability for reporting financial irregularities or non-compliance with financial resources rules (and for listed company auditor whistleblowers for reporting fraud) under the Securities and Futures Ordinance (Cap. 571).

Under the Prevention of Bribery Ordinance (Cap. 201), the name or address of an informer is not to be disclosed and any document that might lead to discovery of the informer must be redacted prior to disclosure in civil or criminal proceedings. The Independent Commission Against Corruption (and police) informers are entitled to witness protection under the Witness Protection Ordinance (Cap. 564).

In April 2020, the Competition Commission in Hong Kong revised its Leniency Policy, updating the one applying to undertakings and publishing a new one for individuals. The policies are designed to encourage companies and individuals that may have engaged in illegal activity, such as bid rigging or price-fixing, to report it in exchange for leniency.

30 What rights does local employment law confer on employees whose conduct is within the scope of an investigation? Is there any distinction between officers and directors of the company for these purposes?

Employees have limited rights under local employment laws if a company conducts an investigation and may be suspended with pay if the employment contract so provides. An employee may also be suspended without pay in the limited circumstances specified in the Employment Ordinance for generally no more than 14 days. Employees are protected against wrongful, unreasonable or constructive dismissal under local legislation.

Employees have the right to a disciplinary hearing if the company handbook, manual or policy provides for it in relation to employee misconduct. Employees of government or public bodies have the right to a fair hearing.

Executive directors owe additional duties under the Companies Ordinance (Cap. 622), the company’s articles and common law. In addition to the rights they have as an employee of the company, directors also have rights under the Companies Ordinance and their company’s articles with respect to the potential threat of removal or disqualification if they breach directors’ duties.

31 Do employees’ rights under local employment law differ if a person is deemed to have engaged in misconduct? Are there disciplinary or other steps that a company must take when an employee is implicated or suspected of misconduct, such as suspension or in relation to compensation?

There are no statutory requirements for companies to take disciplinary steps when an employee is suspected of misconduct. However, companies’ internal policies and employment contracts may adopt disciplinary procedures for their employees, which must be adhered to. Companies in regulated industries may be required to suspend or take disciplinary action against employees who carry out regulated activities. Aside from their mandatory obligations, companies may take disciplinary action or steps to investigate misconduct as part of their proper internal controls and good corporate governance.

32 Can an employee be dismissed for refusing to participate in an internal investigation?

An employee may potentially be dismissed for refusing to participate in an internal investigation after failing to heed the employer’s lawful and reasonable instructions and absent any protected circumstances, such as the employee taking sick leave, maternity leave, paternity leave or work injury leave.

Commencing an internal investigation

33 Is it common practice in your country to prepare a document setting out terms of reference or investigatory scope before commencing an internal investigation? What issues would it cover?

It is common practice for an internal investigation to begin with the drafting of an investigation plan detailing the objectives, scope, roles and responsibilities for the investigation. A clearly defined communications plan and the protocol for maintaining legal professional privilege are also essential from the earliest stages. Increasingly, scoping documents will also identify data custodians and outline procedures for electronic document review.

34 If an issue comes to light prior to the authorities in your country becoming aware or engaged, what internal steps should a company take? Are there internal steps that a company is legally or ethically required to take?

Depending on the nature of the issue, necessary internal steps could be managed by a company’s compliance or legal department in less serious cases, or senior management and the board of directors in more serious cases. Under the supervision of legal counsel to ensure the protection of legal professional privilege, a company should gather and secure any relevant documents and data, and interview key employees to ensure the continued availability of critical information. Corrective action plans or disciplinary measures should be adopted to address gaps or breaches in compliance controls, which may earn a company mitigation credit in any related enforcement actions. Although the authorities may not be aware of an internal issue, it is important to pay particular regard to the self-reporting obligations by corporations and institutions licensed by the Hong Kong Securities and Futures Commission (SFC) or the Hong Kong Monetary Authority (HKMA).

35 What internal steps should a company in your country take if it receives a notice or subpoena from a law enforcement authority seeking the production or preservation of documents or data?

Ideally, a company should have an established protocol for responding to law enforcement requests, subpoenas or dawn raids, including procedures for the preservation of relevant documents and data. The legal department should issue a preservation notice to all relevant employees immediately upon receiving a law enforcement request, or if it believes that such a request or legal proceedings may be forthcoming. Paper documents and electronic data on servers, laptops, mobile devices or other media should be collected from relevant custodians and logged under the supervision of legal counsel and the company’s information technology department. Privileged communications should be segregated and clearly stamped to help prevent accidental disclosure.

36 At what point must a company in your country publicly disclose the existence of an internal investigation or contact from a law enforcement authority?

There is no general duty to publicly disclose the existence of an internal investigation or contact from law enforcement (indeed, most agencies impose a secrecy obligation on the subject of an investigation). The exception is in the case of a listed company when such facts would constitute price-sensitive information, as defined under the Securities and Futures Ordinance (Cap. 571) (SFO), unless exempted or when the SFC has granted a waiver (e.g., in cases involving disclosure restrictions imposed by a foreign government authority). Conversely, there are strict prohibitions against publicly reporting details of investigations by the Independent Commission Against Corruption for both listed and unlisted companies.

37 How are internal investigations viewed by local enforcement bodies in your country?

In most cases, the authorities recognise the need for, and welcome, at least initial or preliminary internal investigations carried out by corporations. Those corporations and institutions licensed by the SFC or the HKMA have a regulatory duty to self-report when there is a material breach (or suspected breach) by their employees of any law, rules or regulations (including suspected misconduct), or when there is a material breach (or suspected breach) by their clients of any market misconduct provisions under the Securities and Futures Ordinance (Cap. 571) (in the case of corporations licensed by the SFC). Particular care must be taken to avoid tipping off, whereby corporations are prohibited (except with the authorities’ consent) from disclosing the existence of the authorities’ investigations to a third party, which may include their employees and their clients.

Attorney–client privilege

38 Can the attorney–client privilege be claimed over any aspects of internal investigations in your country? What steps should a company take in your country to protect the privilege or confidentiality of an internal investigation?

Legal professional privilege can be claimed over various aspects of an internal investigation.

Case law holds that the whole process of obtaining and giving legal advice should be privileged. Therefore, internal communications (including those between employees of a non-legal function) and materials generated during the information-gathering process of an internal investigation (such as minutes of meetings and interview notes), for the dominant purpose of obtaining and giving legal advice, could be privileged. However, legal advice privilege will not attach to communications with, or materials prepared by, a third party (unless the communications or materials are for the dominant purpose of obtaining or seeking legal advice), nor will it cover legal advice given by persons who are not legally qualified (e.g., tax accountants).

During an internal investigation, confidential communications or documents prepared for the dominant purpose of obtaining information or evidence for use in actual or reasonably contemplated litigation – even if the communications are merely for the purpose of establishing facts – will be covered by litigation privilege. To protect privilege, a company should:

• involve lawyers (whether in-house or external counsel) as soon as it is apparent that legal advice is likely to be required;
• avoid creating unnecessary records (where there is no prospect of litigation) that summarise, quote or amend the legal advice received;
• limit circulation of privileged documents on a strictly need-to-know basis;
• manage documents effectively by separating privileged and non-privileged documents; and
• ensure that all documents that are considered to be protected by legal professional privilege are clearly marked ‘privileged and confidential’.

39 Set out the key principles or elements of the attorney–client privilege in your country as it relates to corporations. Who is the holder of the privilege? Are there any differences when the client is an individual?

Under Hong Kong law, legal professional privilege falls into two categories:

• Legal advice privilege attaches to communications between a client and his or her legal adviser for the purposes of giving and receiving legal advice.
• Litigation privilege attaches to confidential communications between a legal adviser and his or her client, and to communications between a legal adviser or client and a third party if three conditions are met: (1) litigation is in progress or reasonably in contemplation; (2) the communications are made with the sole or dominant purpose of conducting the actual or anticipated litigation; and (3) the litigation is adversarial, not investigative or inquisitorial.

The privilege belongs to, and can only be waived by, the client and not his or her legal adviser.

In the corporate context, it is advisable to identify the employees authorised to act for the company to seek legal advice for the purposes of claiming legal advice privilege, as English and Hong Kong law have diverged in recent years on this issue.

40 Does the attorney–client privilege apply equally to in-house and external counsel in your country?

Legal professional privilege applies equally to in-house and external counsel. However, privilege will only cover communications made by an in-house lawyer acting in a legal (not a managerial) capacity.

41 Does the attorney–client privilege apply equally to advice sought from foreign lawyers in relation to investigations in your country?

Legal professional privilege applies equally to advice sought from foreign lawyers if the advice is given in Hong Kong. If the advice is given from outside Hong Kong, it is possible that privilege can be asserted under Hong Kong law even if the home jurisdiction of the foreign lawyer does not recognise legal professional privilege.

42 To what extent is waiver of the attorney–client privilege regarded as a co-operative step in your country? Are there any contexts where privilege waiver is mandatory or required?

Waiver of legal professional privilege (usually on a limited basis) is generally regarded as a sign of co-operation by authorities in a regulatory investigation. This is not mandatory.

43 Does the concept of limited waiver of privilege exist as a concept in your jurisdiction? What is its scope?

The Court of Appeal in Hong Kong has confirmed that a waiver of privilege with respect to one party does not automatically mean that privilege has been waived at large and that privilege is not waived because a privileged document has been disclosed for a limited purpose. The scope of the waiver is determined by the party waiving the privilege. Where privilege is waived for a limited purpose, it is important to ensure that the terms and scope of the limited waiver are clear.

44 If privilege has been waived on a limited basis in another country, can privilege be maintained in your own country?

Generally, privilege will not be lost because a privileged document has been disclosed for a limited purpose.

Whether privilege can be maintained if it has been partly waived in another country will depend on several factors, including, but not limited to:

• whether the concept of limited or partial waiver is recognised in the country where privilege has been waived;
• the scope and terms of the waiver; and
• whether any statutory provision overrides privilege.

45 Do common interest privileges exist as concepts in your country? What are the requirements and scope?

Common interest privilege exists in Hong Kong. Privilege will not be waived if privileged material is disclosed to a third party who shares a common interest in the subject matter of the privileged material. Common interest must exist at the time when the privileged material is disclosed to the third party.

46 Can privilege be claimed over the assistance given by third parties to lawyers?

Communications between a third party and the lawyer (or the client) are protected from disclosure by litigation privilege if they are made for the dominant purpose of obtaining information or evidence for use in actual or reasonably contemplated litigation. However, legal advice privilege will generally not apply to communications with third parties.

Witness interviews

47 Does your country permit the interviewing of witnesses as part of an internal investigation?

Yes. There is no general prohibition under Hong Kong law against interviewing witnesses as part of the information-gathering process in an internal investigation.

48 Can a company claim the attorney–client privilege over internal witness interviews or attorney reports?

Legal advice privilege is often claimed for the records of internal witness interviews, if the interviews are conducted at the direction of an in-house or external legal adviser. Case law in Hong Kong suggests that a corporation may argue that legal advice privilege exists regarding such records if the interviews are conducted (or the reports are compiled) for the dominant purpose of obtaining and giving legal advice during the internal investigation. This is in contrast to the position in England, which applies a more limited definition of ‘client’, for example.

Litigation privilege may only be claimed if it is established that the witness interviews are conducted for the dominant purpose of use in an actual or reasonably contemplated litigation.

49 When conducting a witness interview of an employee in your country, what legal or ethical requirements or guidance must be adhered to? Are there different requirements when interviewing third parties?

Whether the interviewee is an employee or a third party, it is recommended that they be informed that:

• the interview is part of a fact-finding exercise;
• the lawyer conducting the interview represents the company, not the interviewee;
• the interview is protected by legal professional privilege belonging to the company, which can choose to disclose the contents of the interview to third parties, including regulators and authorities, without the interviewee’s permission;
• the interviewee may provide personal information covered by data protection laws, which will be used only for the fact-finding or review exercise. This exercise may involve sharing the interviewee’s personal information with other advisers working for the company, regulators and authorities; and
• the contents of the interview are confidential and should not be shared with any other person (including other employees).

50 How is an internal interview typically conducted in your country? Are documents put to the witness? May or must employees in your country have their own legal representation at the interview?

The internal interview will typically be attended by in-house legal counsel and any specialised investigation team with or without external counsel (depending on the nature and seriousness of the issues involved). Relevant documents are typically put to the witness at the internal interview for reference, comment and explanation, as necessary. There is no legal requirement that employees have their own legal representation at an internal interview, and this is not common in practice.

Reporting to the authorities

51 Are there circumstances under which reporting misconduct to law enforcement authorities is mandatory in your country?

Generally, a person is under no positive obligation to report crimes or provide assistance to law enforcement authorities, save for suspicious transaction reports under anti-money laundering laws, which are mandatory, and certain exceptions for licensed corporations and financial institutions.

52 In what circumstances might you advise a company to self-report to law enforcement even if it has no legal obligation to do so? In what circumstances would that advice to self-report extend to countries beyond your country?

Although there is no formal arrangement or mechanism for deferred prosecution agreements in Hong Kong, it may be advisable for a company to self-report with a view to demonstrating its proactive and full co-operation with the authorities, which may militate against a decision to prosecute or be considered as a mitigating factor in sentencing.

Whether the self-report should extend to foreign countries will depend on the nature and extent of the issues involved, in particular whether it has a cross-border, regional or global element.

53 What are the practical steps needed to self-report to law enforcement in your country?

A company should undertake appropriate internal investigations to ascertain the nature and extent of the issues, and to ensure the contents of any self-report are correct and not misleading (including through any material omission). It should also seek legal advice on the applicable self-reporting obligations.

For licensed corporations and financial institutions that are under a regulatory duty to self-report, a balance needs to be struck between making timely self-reports and ensuring that reports are correct and not misleading.

Responding to the authorities

54 In practice, how does a company in your country respond to a notice or subpoena from a law enforcement authority? Is it possible to enter into dialogue with the authorities to address their concerns before or even after charges are brought? How?

Hong Kong enforcement agencies, such as the Independent Commission Against Corruption and the Hong Kong Securities and Futures Commission (SFC), have extensive powers to compel information to be provided to them by corporations involved in investigations, and there is very little that can be done to challenge requests for information when they are made.

However, it would be unusual for criminal charges to be brought against a corporation without it having an opportunity to discuss the circumstances of the allegations with the enforcement agency. In financial misconduct investigations, the twin regulatory and criminal nature of the supervisory jurisdiction of the SFC and the Hong Kong Monetary Authority (HKMA) means that there would be an opportunity for representations to be made by the corporation, through its lawyers, as to the circumstances, and the proposed remediation, prior to criminal charges being brought.

55 Are ongoing authority investigations subject to challenge before the courts?

The circumstances under which an ongoing investigation could be challenged in the courts are difficult to envisage, short of provable mala fides on the part of the enforcement agency.

56 In the event that authorities in your country and one or more other countries issue separate notices or subpoenas regarding the same facts or allegations, how should the company approach this?

These circumstances are most likely to arise in the context of financial regulatory investigations by regulators in different jurisdictions, or international anti-bribery enforcement under the US Foreign Corrupt Practices Act or the United Kingdom’s Bribery Act. In circumstances in which the notices or subpoenas have been issued validly, justify substantive responses and relate to identical subject matter, it is advisable to adopt consistent disclosure with each agency. Further, assuming that a financial institution’s operations are international in nature, coupled with self-reporting obligations imposed in other countries (most notably the United States and the United Kingdom), this usually means that some form of notification or reporting to overseas regulators would be required even in the context of an investigation that primarily concerns Hong Kong, and in the absence of any separate notices or subpoenas being issued by overseas regulators. Given the increasing prevalence of international co-operation between regulators and criminal enforcement agencies, a failure to disclose certain matters in one jurisdiction may well be apparent and seized on as an indication of inadequate compliance or co-operation.

Assuming that the investigation primarily concerns Hong Kong, it is advisable to adopt the disclosure made to the local regulators (e.g., the SFC or the HKMA) as a ‘base’ document in framing the appropriate disclosure to overseas regulators with reference made to the nexus with other countries (e.g., by reason of the institution’s or an individual’s licensing status, client impact, and so on). Care should also be taken to ensure that notification has been given to and, in appropriate cases, consent obtained from the local regulators, before overseas notification or disclosure is made. In particular, the SFC almost always insists that its written consent be obtained before a licensed corporation can disclose the existence or content of an ongoing investigation, even to an overseas regulator.

57 If a notice or subpoena from the authorities in your country seeks production of material relating to a particular matter that crosses borders, must the company search for and produce material in other countries to satisfy the request? What are the difficulties in that regard?

Under notices issued by the various Hong Kong enforcement agencies, companies may be required to produce material in their possession, custody, control or power, whether this is located in other countries or solely in Hong Kong, subject to having a reasonable excuse not to do so.

This may give rise to issues in some foreign jurisdictions, where the transmission of certain types of information outside that country may be prohibited by local law. In Hong Kong, exposure to criminal liability under foreign law would not constitute a reasonable excuse for non-compliance with a notice or subpoena. This applies in circumstances where a reasonable person would conclude that the Hong Kong public interest in the investigation of criminal activities outweighs any public or private interest in compliance with the foreign law. However, if there are alternative means of obtaining the documents without materially adverse consequences to the investigation, a real and appreciable risk of prosecution under foreign law would constitute a reasonable excuse for non-compliance.

A related issue arises as to the extent that the company is required to produce relevant material in the possession, custody or power of its parent, subsidiary or an associated company (which may be incorporated in other countries). In general terms, this depends on whether the company subject to investigation (the subject company) has a presently enforceable legal right to obtain the documents from such other companies without the need to obtain the consent of anyone else. This is a question of fact, which depends on whether the subject company has sufficient control over the other companies such that the documents in the possession, custody or power of the other companies can be said to be within the power of the subject company.

58 Does law enforcement in your country routinely share information or investigative materials with law enforcement in other countries? What framework is in place in your country for co-operation with foreign authorities?

Hong Kong regulators, including the HKMA and the SFC, have signed memoranda of understanding to establish co-operative arrangements that include the sharing of information with foreign counterparts, including those in China. One of the most important of these is the International Organisation of Securities Commissions Multilateral Memorandum of Understanding, which was the first global information-sharing arrangement among securities regulators.

Hong Kong authorities may co-operate with their foreign counterparts reciprocally in criminal matters under the framework established in the Mutual Legal Assistance in Criminal Matters Ordinance (Cap. 525). However, this particular legislation is not applicable to China, Macao or Taiwan.

59 Do law enforcement authorities in your country have any confidentiality obligations in relation to information received during an investigation or onward disclosure and use of that information by third parties?

Information provided to enforcement authorities in Hong Kong confidentially during an investigation will remain confidential, except to the extent that its use is necessary within an investigation, prosecution or regulatory enforcement. Although it may be shared with other enforcement agencies or regulators under information-sharing agreements, it would not be disclosed to other third parties without an order from a court.

60 How would you advise a company that has received a request from a law enforcement authority in your country seeking documents from another country, where production would violate the laws of that other country?

It may be possible to refuse production on the grounds that the foreign illegality constituted a reasonable excuse not to produce the documents under the relevant legislation. It is also not uncommon that the documents are in the possession, custody or power of a parent, subsidiary or associated company incorporated or operating in another country. These issues should be brought to the attention of the enforcement agency, which should consider whether assistance could be sought under formal channels from the agency in the foreign jurisdiction, to allow the documents to be produced without violating foreign law.

61 Does your country have secrecy or blocking statutes? What related issues arise from compliance with a notice or subpoena?

There are no blocking statutes as such in Hong Kong. There was some discussion in August 2021 that China’s Anti-Foreign Sanctions Law would be introduced into the laws of Hong Kong but it was later reported that China’s government had decided not to proceed with the plan for the time being.

The jurisdiction to order corporations and individuals to provide evidence in aid of foreign proceedings is derived from Part VIII of the Evidence Ordinance (Cap. 8). Section 75 of the Evidence Ordinance requires the application to be made pursuant to a ‘request issued by or on behalf of a court’ outside Hong Kong. In terms of procedure, therefore, a letter of request is required and Order 70 of the Rules of the High Court provides the procedural framework for taking evidence or obtaining documents from a Hong Kong entity.

62 What are the risks in voluntary production versus compelled production of material to authorities in your country? Is this material discoverable by third parties? Is there any confidentiality attached to productions to law enforcement in your country?

Care must be taken to ensure compliance with a company’s confidentiality obligations in relation to information. If disclosure to an authority is voluntary, rather than compelled, then the disclosure may violate these obligations.

Law enforcement authorities in Hong Kong must maintain the confidentiality of confidential disclosures made to them (whether voluntary or compelled), except to the extent that they choose to share them with other enforcement authorities, or use the information in an investigation, prosecution or regulatory enforcement action.

Prosecution and penalties

63 What types of penalties may companies or their directors, officers or employees face for misconduct in your country?

Companies or their directors, officers or employees may face disciplinary action – and disqualification, in the case of directors – and attract potential civil or criminal liability for misconduct in Hong Kong. For entities regulated by the Securities and Futures Commission (SFC), misconduct would include breaches of the Securities and Futures Ordinance (SFO) (Cap. 571), contravention of the terms of any SFC licence or any act prejudicial to the public interest. Sanctions may include a private or public reprimand, a fine of up to HK$10 million or three times the profit gained or loss avoided, revocation or suspension of licences or registrations, and a ban on regulated persons from applying to be licensed or approved as a responsible officer.

The SFC has powers under the SFO (Cap. 571) to seek criminal prosecution by the Hong Kong Department of Justice (DOJ) and, in practice, the SFC refers all market misconduct cases to the DOJ for advice. The maximum penalties for a person convicted of a market misconduct offence are imprisonment for 10 years and a fine of HK$10 million.

The SFC may also institute civil proceedings before the High Court or the Market Misconduct Tribunal.

64 Where there is a risk of a corporate’s suspension, debarment or other restrictions on continuing business in your country, what options or restrictions apply to a corporate wanting to settle in another country?

It depends on the laws of the other country in which the corporate wants to settle. The risk of a corporate’s suspension, debarment or other restrictions on continuing business in Hong Kong does not, as a matter of Hong Kong law, restrict the corporate from settling in another country; however, there may be legal requirements in that other country (e.g., disclosure obligations) that allow a regulator or law enforcement agency in that country to reopen a settlement if it subsequently discovers the restrictions on the corporate in Hong Kong of which it has not been previously informed.

65 What do the authorities in your country take into account when fixing penalties?

The authorities will consider all the circumstances of the case, including (1) the nature and seriousness of the conduct, (2) the value of profits accrued or loss avoided, (3) other circumstances of the firm or individual, and (4) other relevant factors.

In considering the nature and seriousness of market misconduct, the SFC will have regard to the effects of the conduct on market integrity, the costs of the conduct caused to clients or the investing public, the duration and frequency of the conduct, whether there is a breach of fiduciary duty and whether any serious or systematic management or internal control failures are revealed. The SFC will also consider the degree of co-operation with the SFC and other authorities.

Resolution and settlements short of trial

66 Are non-prosecution agreements or deferred prosecution agreements available in your jurisdiction for corporations?

There are no formal mechanisms in Hong Kong for the negotiated settlement of criminal investigations or proceedings that are equivalent to deferred prosecution agreements in the United Kingdom or the United States. However, in some limited circumstances, negotiations with, or representations made to, the Securities and Futures Commission (SFC) and the Hong Kong Department of Justice may result in a decision being taken not to prosecute.

67 Does your jurisdiction provide for reporting restrictions or anonymity for corporates that have entered into non-prosecution agreements or deferred prosecution agreements until the conclusion of criminal proceedings in relation to connected individuals to ensure fairness in those proceedings?

Not applicable.

68 Prior to any settlement with a law enforcement authority in your country, what considerations should companies be aware of?

The SFC has wide powers to enter into settlement agreements under the Securities and Futures Ordinance (SFO) (Cap. 571) and may do so if this is in the public interest. In considering settlement, aside from considering factors such as the strength of the prosecution and defence cases, the costs and reputational damage of a lengthy investigation and potential subsequent legal proceedings, and possible penalties, institutions should also be aware that the SFC may insist on a public reprimand of the financial institution via an announcement on the SFC’s website. The SFC will take into account the degree of co-operation in considering the settlement package.

69 To what extent do law enforcement authorities in your country use external corporate compliance monitors as an enforcement tool?

Not applicable.

70 Are parallel private actions allowed? May private plaintiffs gain access to the authorities’ files?

SFO (Cap. 571) gives a person who has suffered pecuniary loss as a result of market misconduct the right to bring a civil action to seek compensation. Compensation will only be payable if it is fair, just and reasonable in the circumstances of the case. Findings of the Market Misconduct Tribunal in relation to market misconduct will be admissible as prima facie evidence in the private action, though proceedings before the tribunal are not a prerequisite for bringing civil proceedings. The SFC will not intervene in private legal proceedings.

Publicity and reputational issues

71 Outline the law in your country surrounding publicity of criminal cases at the investigatory stage and once a case is before a court.

In practice, law enforcement agencies do not normally publish the commencement of investigations of criminal cases (although they sometimes announce high-profile arrests or dawn raids). Publicity usually follows when a decision has been made to charge an individual or during criminal proceedings once instituted. Criminal trials in Hong Kong are conducted in open court. Some agencies, such as the Securities and Futures Commission and the Independent Commission Against Corruption, publicise the outcome of enforcement proceedings they have initiated on their websites from time to time.

72 What steps do you take to manage corporate communications in your country? Is it common for companies to use a public relations firm to manage a corporate crisis in your country?

There are no particular factors specific to Hong Kong in managing corporate communications in Hong Kong. The steps are likely to be similar to those that would be taken to manage corporate communications in other jurisdictions, for example, timely, accurate and effective messages using the right media channels, while being sensitive and perceptive to the geo­political environment. Public relations and media companies can be and have been used in Hong Kong to manage certain corporate crises.

73 How is publicity managed when there are ongoing related proceedings?

Publicity is usually managed by a press officer or communications department that will monitor media reports and suggest the making of public statements as and when necessary. Any public statements made by the company should be carefully drafted and any prejudicial effects on ongoing proceedings should be taken into consideration.

Duty to the market

74 Is disclosure to the market in circumstances where a settlement has been agreed but not yet made public mandatory?

For a listed corporation, settlement of a regulatory investigation may constitute inside information (depending on the nature and severity of the underlying offence or misconduct) and thus require disclosure as soon as reasonably practicable. In practice, the corporation and the authorities will usually agree on a press release being issued as part of the settlement and will agree on the timing for the release.

By way of context, inside information is defined to include specific information about the corporation that is not generally known to the public but would, if generally known, be likely to materially affect the price of the listed securities. Under Part XIVA of the Securities and Futures Ordinance (Cap. 571), a listed corporation must, as soon as is reasonably practicable after it becomes aware or is notified of any inside information, disclose the information to the public (subject to certain exceptions).

Environmental, social and corporate governance (ESG)

75 Does your country regulate ESG matters?

In terms of ESG reporting, there are mandatory disclosure requirements and disclosures required on a ‘comply or explain’ basis for Hong Kong listed companies, which were put in place in 2016 and enhanced in 2020 and 2022. The enhancements in 2020 incorporated elements of the recommendations by the Financial Stability Board’s Task Force on Climate-Related Disclosures (TFCD), which were released in 2017. The Green and Sustainable Finance Cross-Agency Steering Group (members of which include the Hong Kong Exchanges and Clearing Limited (HKEX), Securities and Futures Commission (SFC), Hong Kong Monetary Authority (HKMA) and Insurance Authority) announced in December 2020 that the TCFD recommendations will become mandatory no later than 2025. The HKEX’s Guidance on Climate Disclosures published in November 2021 provides practical guidance to facilitate listed companies’ compliance with these recommendations in light of the direction towards mandatory TCFD-aligned climate-related disclosures by 2025.

Following consultation conclusions issued in December 2021, effective for the financial year commencing 1 January 2022, ESG reports are required to be published at the same time as annual reports (the previous requirement was for ESG reports to be published no later than five months after the end of the financial year). The Corporate Governance Code and Listing Rules have also been amended to elaborate upon the link between the ESG reporting regime and corporate governance, including making clear boards’ responsibility for governance and oversight of ESG matters, and the assessment and management of ESG risks together with appropriate internal controls.

There are also requirements under the Companies Ordinance (Cap. 622) that companies registered in Hong Kong include in their annual directors’ report a ‘discussion’ on the company’s environmental policies (although there are no clear rules around what that discussion should include).

In April 2019, the SFC introduced high-level disclosure requirements for green and ESG SFC-authorised funds. This light-touch 2019 circular was superseded on 1 January 2022 by a circular issued on 29 June 2021, which contains requirements in relation to:

• the ESG fund’s name;
• offering documents in respect of disclosure of the ESG focus, ESG investment strategy, asset allocation, reference benchmark (such as index fund) and risks or limitations associated with the ESG focus;
• additional disclosure; and
• periodic (at least annual) assessment and disclosure of the attainment of the ESG focus.

In December 2021, the HKMA published a new supervisory policy manual module on climate risk management as a non-statutory guideline. The aim of the module is to provide high-level guidance to authorised institutions to build climate resilience by incorporating climate considerations into governance, strategy, risk management and disclosure. A period of 12 months is allowed for implementation.

76 Do you expect to see any key regulatory or legislative changes emerge in the next year or so designed to address ESG matters?

From 20 August 2022 for large fund managers (those with assets under management in their collective investment schemes of HK$8 billion or greater) and from 20 November 2022 for all other fund managers, amendments to the Fund Manager Code of Conduct will mean climate-related risks are to be considered in investment and risk management processes and disclosed to fund investors, depending on relevance and materiality, to meet investors’ growing demand for climate risk information and to combat greenwashing (i.e., exaggeration of green credentials).

77 Has there been an increase in ESG-related litigation, investigations or enforcement activity in recent years in your country?

It remains to be seen how, from which regulators and in which sectors we will see enforcement activity, although greenwashing is a stated target. Taking that stated focus, looking back at Hong Kong regulatory enforcement trends in the past decade or so, and extrapolating forward, in the shorter term and given the more mature ESG disclosure requirements for listed companies, enforcement might be expected against listed companies and their directors (1) in respect of false or misleading disclosures inducing share trans­actions (Securities and Futures Ordinance (SFO) (Cap. 571), section 277) and (2) inside information disclosure failures by listed companies in connection with their ESG reporting (assuming ESG matters are price sensitive for a given company; SFO, Part XIVA). In the medium term, there might be disciplinary action taken by the SFC and other regulators in relation to ESG disclosure failures in respect of their obligations as regulated entities, or breaches of ESG-specific regulatory obligations, for example, in connection with the ESG-related enhancements to the Fund Manager Code of Conduct.

Anticipated developments

78 Do you expect to see any key regulatory or legislative changes emerge in the next year or so designed to address corporate misconduct?

The Securities and Futures Commission (SFC) issued a consultation paper in June 2022 seeking to broaden its enforcement powers. The SFC proposes to extend section 213 of the Securities and Futures Ordinance (SFO) (Cap. 571) to empower it to be able to apply to the court for restoration, damages and other civil remedial orders after its exercise of disciplinary powers under section 194 or section 196 for misconduct or unfitness. This would mean the SFC would have recourse to civil compensation for investors, not only for contravention of a provision of the SFO (one of the current triggers for section 213) but also for breach of SFC codes and guidelines that are referenced to assess misconduct and unfitness. The SFC also proposes the broadening of civil and criminal insider dealing provisions to cover (1) insider dealing perpetrated in Hong Kong with respect to overseas listed securities and (2) expressly for the sake of clarity, insider dealing perpetrated outside Hong Kong with respect to Hong Kong listed securities. The former seeks to plug a gap so that section 300 need not be inappropriately used as it was previously; section 300 was designed to deal with fraud, which insider dealing does not necessarily entail, and to target specific persons, as opposed to the market as a whole. The insider dealing proposals are generally seen as a natural evolution and acceptable. However, the section 213 proposals have generated some concerns for their potential breadth of application and the need for clarity as to the stated targeting of ‘serious’ misconduct and what this means in terms of the type of misconduct potentially giving rise to investor compensation. There are also concerns regarding procedural fairness and proportionality, including whether disciplinary sanctions as well as civil remedies to be imposed will be considered as a whole to avoid any undue burden on regulated entities. This is against the background of a consultancy study being conducted (as commissioned by the government’s Working Group on Class Actions) on the potential and likely economic and other effects on Hong Kong if a class action regime is to be introduced.

It is proposed that a licensing regime for virtual asset exchange operators be introduced on 1 March 2023. Although it might be strict as compared to other Middle Eastern and offshore virtual asset regimes, it can be justified considering the recent crypto crash and high-profile failures. It will mean that virtual asset exchange operators are subject to very similar SFC investigation, disciplinary and civil powers as intermediaries carrying out traditional securities and futures activities.

In addition, a new Type 13 regulated activity (RA13) to put trustees and custodians of Hong Kong public funds under the SFC’s direct supervision is proposed; the SFC published consultation conclusions in February 2022 and started further consultation on proposed amendments to subsidiary legislation, codes and guidelines to implement the regime.

New requirements in Paragraphs 17.1A and 21 of the Code of Conduct apply to book building and placing activities from 5 August 2022. They follow a thematic review by the SFC of licensed intermediaries engaged in equity and debt capital market activities and reports by the International Organisation of Securities Commissions regarding conflict of interests and conduct risks in raising equity and debt capital. The aim of the new requirements is to address misconduct and competitive pressures, and to align intermediaries’ incentives and liabilities, in particular:

• lack of clearly defined roles and functions on the part of intermediaries;
• late determination of fee arrangements and finalisation of syndicate membership;
• placement of knowingly inflated orders or lack of transparency in the order book;
• conflict of interests between intermediaries and investor clients;
• preferential treatment or rebates paid to some investors; and
• lack of record-keeping.

Expected standards of conduct addressing conflicts of interest have also been set out in a circular in October 2021 following a concurrent thematic review by the SFC and the Hong Kong Monetary Authority (HKMA) of intermediaries’ spread charges, and pricing arrangements and disclosure. The circular reminds senior management that they bear primary responsibility for ensuring appropriate standards of conduct and adherence to proper policies and procedures in this regard.

In March 2022, the SFC and the HKMA announced the commencement of a concurrent thematic review of the distribution of non-exchange traded investment products by intermediaries following the release of findings from a joint product survey in October 2021. The thematic review will cover distribution of popular products such as equity-linked structured products, including equity accumulators and decumulators and corporate bonds. The objective is to assess compliance with the suitability requirement under the Code of Conduct, including practices for performing product due diligence and suitability assessments, as well as provision of information to clients. With the growing complexity of products and current market volatility, the risk of mis-selling is rising, and the findings, guidance and any change in standards arising from this thematic review will assist in addressing this risk.

The Insurance Authority carried out a first joint inspection with the HKMA, which concerned premium financing, leading to two circulars in September 2021 and April 2022 clarifying the standards expected of licensed insurance intermediaries and long-term insurers in respect of (1) suitability, credit and affordability assessment, (2) risk disclosure (3) and sales practices and handling of cooling-off rights, to take effect on 1 January 2023.

We continue to expect closer co-operation between the SFC and the China Securities Regulatory Commission in cross-border investigations, in particular concerning market manipulation in the context of the China–Hong Kong Stock Connect programme, and increased joint operations between enforcement agencies within Hong Kong.

Footnotes