Managing cross-border investigations involving China and Hong Kong

In recent years, there has been an explosion in the number of cross-border investigations targeting multinational companies that are regulated in multiple jurisdictions. In particular, US regulators, including the Securities and Exchange Commission (SEC) and the Department of Justice (DOJ), have become keenly interested in misconduct all over the world, but especially conduct that takes place in or touches upon the Greater China region. This emphasis derives from, among other things, the increase in the number of PRC companies participating in the US capital markets (including issuers listed through reverse merger transactions), an M&A boom involving Chinese companies and suspicious trades in the stock of companies involved in such transactions, and ever increasing enforcement of the Foreign Corrupt Practices Act (FCPA).

This article highlights some key issues that a multinational firm will encounter in a cross-border investigation involving the US and Hong Kong regulators, particularly one where part of the alleged misconduct occurred in mainland China.¹

Imagine you represent Bigcat Securities (Bigcat Hong Kong), a Hong Kong-based asset management firm. Bigcat Hong Kong is a subsidiary of Bigcat Inc, a US bank and financial services firm. Bigcat Hong Kong is licensed by the Hong Kong SFC to conduct a variety of regulated activities, including dealing in securities, advising on securities and asset management.

The SEC learns of suspicious trading activities at Bigcat Hong Kong, namely the purchase of a large amount of call options of a US-listed company, TAR, before an acquisition of TAR by SinoACQ, a Chinese state-owned enterprise (SOE), was announced. The trades were executed by an SFC-licensed Australian trader working at Bigcat Hong Kong, for several accounts managed by Bigcat Hong Kong for its clients. The trader at issue has close client relationships with a senior official at SinoACQ and manages his personal account. Moreover, it appears that the trader maintained an office in Beijing and travelled there frequently to meet with the SinoACQ executive and other clients. The SEC sends a voluntary information request to Bigcat Inc asking for information concerning these suspicious trades. To fulfil the SEC’s information request, Bigcat Hong Kong starts an investigation.

Disclosure and discovery issues

The most critical part of the investigation will be collecting, reviewing and providing relevant documents to the regulators, including the SEC. For example, in this case, relevant documents located in the PRC, in Hong Kong and in the US might all fall under the scope of the information request.

When the PRC is involved, the document review process can become especially challenging. One key issue is that PRC laws prohibit the export of state secrets, trade secrets and personal information without proper authorisation or consent. Thus, a protocol should be established to identify such sensitive information.

A protocol in this case is particularly necessary because the facts indicate that some relevant documents may relate to SinoACQ, a Chinese SOE. The scope of ‘state secrets’, ‘intelligence’ and ‘trade secrets’ is broad and ambiguous under PRC laws. A ‘state secret’ is defined under PRC law as any matter ‘bearing on state security and national interests and, as determined according to legal procedures, are known by a limited number of people for a given period of time.’² The decision of what is considered a ‘state secret’ ultimately cannot be determined by a private party, which further increases the uncertainty. Export of state secrets, even where they have not officially been identified as ‘state secrets’, but one knows or should have known that the materials or information concerns the state’s interest or security, can result in criminal penalties.³ Examples that could potentially fall under the scope of state and trade secrets include information in respect of an SOE’s contractual negotiating position, M&A plans, procurement needs, and its long-term strategy in light of the national economic environment.

Therefore, to the extent that there are documents that had not been exported outside of the PRC previously (for example, if potentially response documents were kept in Bigcat Hong Kong’s representative office in Beijing), they should be reviewed within the PRC to decide whether their content might be too sensitive to be exported. For complicated cases, such a review might need to be handled by or under the guidance of PRC counsel.

There is a lower risk in having counsel located outside of the PRC review documents that have already been exported out of the PRC. However, to the extent possible, counsel should withhold or redact sensitive information from disclosure to third parties, including non-Chinese regulators. Relevant regulators should be informed of the decision to redact or withhold, and the approach taken to determine the sensitivity of the information under local laws. Often, the firm under investigation will provide assistance to the regulators to help them understand the issue. For example, the firm can provide witnesses to explain to the regulators the relevant background of the documents, without actually producing them. For information less relevant to the investigation, it can also argue that non-disclosure will not have a significant impact on the investigation. It can also ask the regulators to use mutual agreements with PRC regulators to obtain relevant information, although that process may be too protracted to be viewed as a feasible solution.

Even though the US regulators are becoming increasingly educated on the conflict between US disclosure requirements and PRC’s state and trade secrecy laws, there is always a risk that when a subpoena has been issued, the regulators might push to enforce the subpoena notwithstanding the assertion that the matters implicate state secrets. Thus, in an extreme case, a firm under investigation needs to balance the risk of violating PRC secrecy laws with the risk of losing credit for cooperation in the US investigation.

Another issue relates to data privacy laws. Although the PRC has not established a strict data privacy regime comparable to that in the EU, the government has in several occasions, especially in high-profile cases that have a political overtone, used privacy protection as reasons to restrict data collection, transmission and disclosure. In addition, Hong Kong also has its own data privacy regime. Disclosure is generally allowed under both regimes if consent has been obtained. It is common for multinational companies to ask their employees to consent to disclosure of personal information at the onset of their employment. However, once the investigation commences, the scope of consent should be re-examined. If there was no consent or the existing consent was inadequate, the firm under investigation may need to specifically ask relevant employees for consent in relation with the investigation.

Data privacy concerns will arise in connection with review of employee data stored locally on devices such as laptops, smartphones, tablets, and portable hard drives. The firm will need to balance its right to access these devices against the employee’s right to privacy in his or her personal data under applicable law. Care must also be taken to secure these devices to preserve evidence and avoid criticism for regulators.

Witness interviews

The other key step in the investigation is interviewing relevant witnesses. In general, a lawyer should lead or co‑lead the questioning so as to preserve privilege.

If relevant employees are located in the PRC, the best practice is to bring them to Hong Kong for such interviews. This is because PRC law does not recognise privilege. Thus, any interview notes prepared in the PRC might be subject to disclosure to the PRC government. By contrast, if a US-qualified lawyer interviews an employee following the usual procedures taken for such interviews in the US (including the delivery of the Upjohn warning, which advises the employee that the interviewing lawyer represents the company and does not represent the witness), the interview notes will most likely be considered privileged in both the US and in Hong Kong, because Hong Kong law recognises legal advice privilege between foreign lawyers and their clients.

Besides the Upjohn warning, investigating attorneys usually will remind the interviewees that the knowledge of the internal investigation, the interview and the discussion thereunder should be kept confidential. This is especially important if the firm is expecting or has already received an inquiry from Hong Kong regulators, which generally imposes a strict secrecy requirement over its investigations.⁴ However, firms should also be mindful of a recent initiative by the SEC to encourage reporting by whistleblowers. Firms must heed the SEC’s recent enforcement action against KBR in which the SEC considered language in a confidentiality agreement signed by interviewees in an internal investigation ‘improperly restrictive’ and thus in violation of the SEC’s whistleblower regulations.⁵ Therefore, while a secrecy request should be raised especially for Hong Kong law reasons, a firm under investigation may also want to make clear to the employees that such a requirement does not prohibit an employee from making a report to US regulators.

The US regulators might also request the firm under investigation make its employees available for interviews. Usually, they will prefer such employees to travel to the US voluntarily to cooperate with the interview request. Alternatively, if an employee refuses to travel, there are often circumstances where SEC or DOJ attorneys will travel to Hong Kong to conduct the interview.

A firm cannot force employees to travel and to cooperate in an investigation and, for foreign employees not residing in the US, US regulators have limited means to coerce participation in an interview. However, the firm still has a great degree of leverage over its employees. It is quite common for a firm to make cooperation during an investigation a job requirement, and failure to cooperate a ground for disciplinary action up to termination.⁶

US regulators can also compel testimony through various mutual cooperation arrangements. For example, the DOJ has a formal mutual legal assistance treaty (MLAT) in place with the Hong Kong government. The SEC also has entered into a few multilateral and bilateral enforcement cooperation agreements with the Hong Kong SFC, under which they could compel production and interviews administrated by the Hong Kong SFC.

Dealing with multiple regulators

Once the US regulators have initiated an investigation, Bigcat Hong Kong, as an entity regulated in Hong Kong by the SFC, will need to consider its regulatory reporting obligations in Hong Kong as well. In this particular case, there are a variety of reporting obligations, including:

• Under relevant SFC regulations,⁷ Bigcat Hong Kong must self-report any material breach of financial services law or regulation by itself, its employees and its clients, including insider trading activities. The reporting obligation arises ‘immediately’ upon the discovery of the breach.
• Hong Kong anti-money laundering law also imposes a strict reporting obligation triggered by a mere ‘suspicion’ of the existence of criminal proceeds from certain indictable offences. If Bigcat Hong Kong suspects that the proceeds of insider trading are in accounts that it manages, it must file a suspicious transaction report. The suspicious transaction report should be filed with the Joint Financial Intelligence Unit (JFIU), which serves as a clearing house for such reports. Failure to report itself is a criminal offence.⁸
• If a firm discovers that bribes have been paid, a report to the Independent Commission Against Corruption (ICAC) might be advisable.
• For listed companies, consideration must be given to whether and when any disclosure needs to be made to the market under periodic or continuous disclosure obligations.

In practice, it often is preferable to begin a conversation with the SFC and the ICAC about an ongoing SEC and DOJ investigation before any formal report is made. That disclosure enables a firm to explain to the Hong Kong regulators that they are actively conducting an investigation to better understand potential wrongdoing, and once they have enough knowledge to conclude that a report is needed, it will file the report immediately accompanied by proper factual support. This approach will prevent a premature or inadequate report.

Once a firm has made a report, it should expect that the SFC, and potentially the ICAC, will launch their own investigations into the potential misconduct. The SFC investigation will likely be conducted with the following goals: (i) to determine whether the firm and its employees are ‘fit and proper’ to remain licensed by the SFC; (ii) to understand in detail how the misconduct happened and to impose proper penalties on the firm and relevant employees; and (iii) to cooperate with foreign securities regulators’ investigations. The ICAC will be more interested in bribery and will focus on whether the evidence shows a violation of Hong Kong’s anti-corruption law, the Prevention of Bribery Ordinance.

Throughout their investigations, the Hong Kong regulators will likely ask specific questions about the progress and the potential outcome of the US investigations. For one thing, the regulators might be cooperating with each other, and asking the firm to provide details about the investigation by foreign regulators will serve as a ‘test’ of the firm’s candour. More importantly, the Hong Kong regulators will want information about parallel US investigations to shape the scope and timing of their own investigations, as well as the timing and level of any penalties that will be levied.

Once both US and Hong Kong regulators have become involved in the investigation, the firm under investigation must pay special attention to conflicting regulations and differences in regulators’ practice. One particular issue will be the secrecy obligations the SFC and ICAC will impose on the firm. The firm will need to get the Hong Kong regulators’ approval before disclosing relevant information to the US regulators. Where the SFC and ICAC are aware of an investigation by US authorities, they usually grant such an approval. However, it is necessary that such a request be raised early in the process and with great care.

There are also differences in how regulators handle investigations. For example, the US regulators, equipped with relatively sophisticated e-discovery tools, have specific technical requirements for disclosure of documents, especially electronic stored information. The US regulators have their own team and review platform to carry out data sorting, document review and metadata management, so they are usually more willing to accept disclosure of a large amount of documents in response to a broad information request. The US regulators are also more familiar with innovative e-discovery tools, such as predictive coding. As long as the disclosing party is open about the use of such tools and their potential impact on the disclosure, the US regulators are likely to agree with the approach.

On the other hand, Hong Kong regulators, like many others, may not always have the resources to process a large amount of information. Thus, they will expect additional assistance from the firm’s internal investigation team. They often ask the internal investigation team to voluntarily organise, summarise and arrange materials or information to address many narrowly tailored questions and issues. An investigating team that spend the time to design and compile a user-friendly disclosure package will likely gain more credit for cooperation from the Hong Kong regulators.

A firm should not treat regulators from one jurisdiction more preferably than another. The firm being investigated must convey the message that it treats all regulators seriously and equally. For example, while Hong Kong regulators might prefer paper-based production, the firm should explain that production to the SEC is done electronically, and the firm is willing to accommodate the Hong Kong regulators’ interests if they want to receive a similar form of production. We have seen cases where the Hong Kong regulators expressed interest in at least learning about the features and functionality of e-discovery tools, even if they cannot currently take full advantage of them.

Resolving investigations with multiple regulators

Finally, there are challenges in negotiating a resolution with regulators in multiple jurisdictions. Regulators will have different enforcement or regulatory cultures, as well as varying focus areas and agendas, which will complicate the process and may make settlement more difficult.

In the US, the nature and severity of any resolution will depend upon the DOJ’s analysis of the factors relevant to corporate criminal prosecutions.⁹ These factors focus upon the scope and nature of the conduct, the entity’s cooperation with the investigation, and any remedial steps taken by the entity. Depending on the wrongfulness and level of cooperation, the resolution can be in the form of a guilty plea, a deferred prosecution agreement (DPA), a non-prosecution agreement (NPA), or in rare cases, a decision to decline prosecution.

The Hong Kong SFC has the authority to pursue its own regulatory enforcement actions, or it can initiate civil and criminal court proceedings. However, it does not have tools like DPAs and NPAs. Through regulatory actions, it can impose fines on regulated entities and individuals, or revoke or suspend their licences. For market misconduct, including insider trading cases, the SFC tends to bring criminal and civil court cases. Court proceedings nevertheless can cause significant delays and uncertainties, and make a global ‘concerted’ resolution more difficult to achieve.

For bribery matters, the ICAC focuses on individual liability. If it considers a violation of the POBO exists, it will refer the case to prosecutors for criminal prosecution. The resolution thus will be reached through the usual criminal justice process involving prosecution, a trial and conviction by jury, if any, which can take a significant amount of additional time even after the fact-finding steps have been concluded in the investigation.

Conclusions

Investigations concerning Hong Kong and China present some unique legal and practical challenges. We conclude this article with the following key points.

First, flow of information across borders should be handled with utmost care given the concerns over the PRC’s vague state and trade secrecy, and data privacy regimes in both the PRC and Hong Kong.

Second, internal interviews should be structured in a way to maximise privilege. The Hong Kong legal regime provides relatively adequate protection in this aspect, but the PRC does not. In addition, a firm under investigation often will be expected to make non-US employees available for interviews by the US regulators as an element of cooperation.

Third, the legal and regulatory regimes, as well as the regulators’ general practices, are inconsistent between US and Hong Kong. Nevertheless, keeping the regulators informed, engaging in open discussion about potential conflicts and proactively offering solutions and tailoring the approach will be the key to successfully managing a cross-border investigation.

Last, the final resolution of the different investigations will be unlikely to happen concurrently due to differences in the toolkits regulators have for enforcement actions and their different approaches. A firm under investigation must be mindful of the implications of these differences, and strive to push for an orderly resolution to the extent possible.

Notes

1. Hong Kong is a Special Administrative Region (SAR) of China. Since its handover from the UK to China in July 1997, it has been granted ‘a high degree of autonomy.’ Thus, Hong Kong preserves its common law-based legal system that is separate from the legal system in mainland China. Hong Kong also has its own financial regulators, including the Hong Kong Securities and Futures Commission (SFC).
2. See article 2 of the PRC Law on Guarding State Secrets. Information concerning the following subjects can constitute ‘state secrets’: (i) national policy decision making on state affairs; (ii) national defence; (iii) diplomatic activities and foreign affairs; (iv) national economic and social development; (v) science and technology; (vi) state security and criminal investigations, and (vii) other secret matters classified by the state secret-guarding department. See also article 9 of the PRC Law on Guarding State Secrets. ‘Intelligence’ is defined under PRC law as ‘matters which relate to national security and interests and which has not been made known to the public or should not have been made known to the public in accordance with the relevant regulations’. The scope of ‘intelligence’ is essentially the same as ‘state secrets’.
3. See article 5 of the People’s Supreme Court of China’s interpretation on article 111 of the PRC Criminal Law.
4. Under section 378 of the Hong Kong Securities and Futures Ordinance, persons assisting SFC staff in an investigation are subject to the secrecy requirements.
5. Order Instituting Cease-And-Desist Proceedings, In re KBR, Inc., No. 3-16466 (1 April 2015), available at www.sec.gov/litigation/admin/2015/34-74619.pdf. There are uncertainties concerning whether the whistleblower regulations implemented under the Dodd-Frank Act provide the same level of protection to domestic and overseas whistleblowers. In this case, KBR’s remedial actions were only taken to employees in the United States who had been interviewed before, but the discussion of the violation was not specifically limited to confidentiality agreements signed with interviewees in the United States.
6. See, eg, Gilman v Marsh & McLennan Cos., Docket No. 15-0603-cv (16 June 2016) (holding that a valid clause for termination under Delaware laws is an employee’s refusal to be interviewed in an internal investigation).
7. Paragraph 12.5 of Code of Conduct for Persons Licensed by or Registered with the SFC.
8. Drug Trafficking (Recovery of Proceeds) Ordinance and Organized and Serious Crime Ordinance (2002) Cap. 455, 29, section 25A, available at http://en-rules.sfc.hk/net_file_store/new_rulebooks/h/k/HKSFC3527_1868_VER50.pdf.
9. United States Attorney’s Manual section 9‑28.000 et seq (Principles of Federal Prosecution of Business Organizations), available at www.justice.gov/usam/usam-9-28000-principles-federal-prosecution-business-organizations. The SEC has enumerated its factors for evaluating cooperation by business organisations in what is known as the ‘Seaboard Report.’ Report of Investigation Pursuant to section 21(a) of the Securities Exchange Act of 1934 and Commission Statement on the Relationship of Cooperation to Agency Enforcement Decisions, SEC Rel. Nos. 34‑4469 and AAER‑1470 (23 October 2001). The relevant factors are substantially the same.