Confidentiality Agreements and Training Requirements for Share-Price Sensitive Information Post-Listing

The SFC’s 2024-25 enforcement report, published in April 2025, recorded 18 insider dealing investigations initiated during the fiscal year, a 50% increase from the 12 opened in FY2023-24. This uptick, combined with the Market Misconduct Tribunal’s (MMT) 2024 ruling in SFC v. Li and Chan — which imposed a 5-year director disqualification on a Hong Kong-listed company’s CEO for sharing Q4 2023 revenue projections with a single fund manager — has sharpened the compliance focus for newly listed issuers. For companies completing their initial public offering (IPO) on the Main Board or GEM of HKEX in 2025-26, the post-listing 90-day “quiet period” is no longer the sole regulatory risk window. The HKEX Listing Rules, specifically Main Board Rule 13.09 and GEM Rule 17.10, impose a continuous obligation to disclose inside information “as soon as reasonably practicable.” The practical challenge for directors and company secretaries is that share-price sensitive information (SPSI) — a term codified in the SFC’s Code of Conduct (paragraph 16.1) — is frequently generated in board meetings, investor calls, and operational reviews where confidentiality is assumed but not contractually enforced. This article examines the specific contractual and training mechanisms that listed issuers must implement to satisfy the SFC’s enforcement expectations and HKEX’s disclosure standards, drawing on the SFC v. Li and Chan precedent and the HKEX’s 2024 Guidance on Disclosure of Inside Information.

The Regulatory Architecture: Inside Information, SPSI, and the Duty of Confidentiality

Defining the Trigger: Inside Information Under the SFO and HKEX Rules

The Securities and Futures Ordinance (Cap. 571, SFO) defines inside information under Part XIVA, Section 307A, as specific information about the issuer, its shareholders, or its securities that is not generally known, and which if generally known would be likely to materially affect the price of the listed securities. The HKEX Listing Rules operationalise this through Main Board Rule 13.09(2)(a) and GEM Rule 17.10(2)(a), requiring disclosure “as soon as reasonably practicable” after the information becomes known to the issuer. The SFC’s Guidelines on the Disclosure of Inside Information (June 2012, updated 2024) further clarify that the duty rests with the issuer’s board, not merely its compliance officer or company secretary.

A 2024 HKEX guidance note (HKEX Listing Decision LD-2024-001) reinforced that “price-sensitive” is not a separate category under the SFO — all inside information is, by statutory definition, price-sensitive. However, the term “share-price sensitive information” (SPSI) persists in industry practice and SFC enforcement circulars to describe information that, while not yet meeting the full inside information threshold, carries a material price impact risk if prematurely disclosed. The distinction matters for confidentiality agreements: a contractual clause that only covers “inside information” as defined in the SFO may be too narrow, as information can be price-sensitive without yet being “generally known” or “specific” enough to trigger the SFO definition.

The Confidentiality Obligation: Contractual vs. Statutory

The SFC’s Code of Conduct for Persons Licensed by or Registered with the SFC (paragraph 16.1, effective 1 January 2024) imposes a statutory duty on licensed persons to “take all reasonable steps” to prevent the misuse of inside information. For listed issuers, this duty extends to directors, employees, and advisers through HKEX Main Board Rule 3A.14 (sponsor obligations) and the Model Code for Securities Transactions by Directors of Listed Issuers (Appendix 10 to the Main Board Rules, Appendix 15 for GEM).

The SFC v. Li and Chan (MMT 2024) case established that a director’s verbal assurance of confidentiality, without a written agreement, does not satisfy the “reasonable steps” standard. The CEO in that case had shared unaudited Q4 2023 revenue figures — which later proved 23% below consensus analyst estimates — with a single institutional investor during a pre-arranged lunch. The MMT found that the absence of a signed non-disclosure agreement (NDA) between the issuer and the investor, coupled with the CEO’s failure to document the meeting’s agenda in advance, constituted a breach of the director’s duty under SFO Section 309 (prohibition on disclosing inside information). The penalty included a HKD 4.2 million fine and a 5-year disqualification from being a director of any Hong Kong-listed company.

Confidentiality Agreements: Structural Requirements for Post-Listing Issuers

Scope of Coverage: Beyond Inside Information to SPSI

A confidentiality agreement for a post-listing issuer must define its subject matter with precision. Standard NDAs that cover “confidential information” broadly are insufficient. The HKEX’s 2024 Guidance on Disclosure of Inside Information (paragraph 38) recommends that issuers adopt a two-tier definition:

• Tier 1: Inside Information — Information that meets the SFO Section 307A definition, subject to immediate disclosure obligations under Main Board Rule 13.09.
• Tier 2: SPSI — Information that, while not yet meeting the inside information threshold, is reasonably likely to affect the issuer’s share price if disclosed prematurely. This includes draft financial results, board meeting minutes containing forward-looking statements, and material contract negotiations.

The agreement must specify that Tier 2 information is subject to the same confidentiality and non-use obligations as Tier 1, but without triggering the immediate disclosure obligation under Main Board Rule 13.09. This prevents a paradoxical situation where a counterparty receiving SPSI under an NDA is forced to trade on it immediately to comply with disclosure rules — a scenario the SFC addressed in its 2023 Circular on Information Walls and Chinese Walls (SFC 2023-12-01).

Counterparty Identification: Advisers, Investors, and Service Providers

The counterparty scope of a post-listing confidentiality agreement must be broader than pre-IPO arrangements. The HKEX Listing Decision LD-2023-003 (November 2023) examined a case where a listed issuer’s sponsor had shared draft Q1 2024 financials with a consortium of placing agents during a follow-on equity offering. The placing agents had signed NDAs, but the issuer had not required the agents to confirm in writing that they had established internal information walls between their advisory and trading desks. The HKEX concluded that this constituted a breach of Main Board Rule 3A.14 (sponsor’s obligations to ensure proper handling of inside information).

The recommended counterparty list includes:

• Directors and senior management — Covered by the Model Code (Appendix 10), but supplemented by individual confidentiality deeds that survive termination of employment.
• Sponsors, financial advisers, and legal counsel — Subject to SFC Code of Conduct paragraph 16.1, but issuers should require a written undertaking that the adviser maintains Chinese walls compliant with SFC Code of Conduct paragraph 16.2.
• Major shareholders and potential investors — For private placements, block trades, and pre-IPO placements, each recipient must sign an NDA that explicitly acknowledges the SFO’s inside information provisions.
• Auditors and valuation firms — Often overlooked. The HKEX’s 2024 Guidance on Disclosure of Inside Information (paragraph 42) notes that auditors handling draft financial statements before board approval are a common source of leaks.

Duration and Survival Clauses

The SFO does not prescribe a fixed confidentiality period for inside information. Inside information ceases to be confidential once it is “generally known” (SFO Section 307A(2)(b)). However, SPSI may remain price-sensitive for extended periods. The HKEX Guidance on Disclosure of Inside Information (paragraph 50) recommends that confidentiality agreements for post-listing issuers include a survival clause of at least 12 months from the date of disclosure, with an evergreen clause for information that remains non-public.

A 2025 MMT case (SFC v. Wong, MMT 2025-02) involved a company secretary who disclosed draft annual results to a former director 14 months after the director’s resignation. The NDA signed at resignation had a 6-month survival period, which had expired. The MMT ruled that the issuer’s failure to impose a longer survival clause constituted a systemic compliance failure, resulting in a HKD 1.8 million fine against the issuer itself under SFO Section 309(2)(a).

Training Requirements: Building a SPSI-Compliant Culture

Mandatory Training for Directors and Senior Management

The SFC’s Guidelines on the Disclosure of Inside Information (paragraph 60) explicitly require that “directors and senior management receive training on the identification and handling of inside information at least annually.” The HKEX Corporate Governance Code (Appendix 14, Code Provision C.1.3) reinforces this by requiring that all directors participate in continuous professional development (CPD) on regulatory compliance topics.

For post-listing issuers, the training must cover:

• Definitional precision — Distinguishing between inside information (SFO Section 307A), SPSI, and non-price-sensitive operational data. The HKEX’s 2024 Guidance on Disclosure of Inside Information (paragraph 12) provides a decision tree for this classification.
• Disclosure triggers — When SPSI becomes inside information requiring immediate disclosure under Main Board Rule 13.09. The training must include case studies from recent MMT rulings, including SFC v. Li and Chan (2024) and SFC v. Wong (2025).
• Blackout periods and trading restrictions — The Model Code (Appendix 10, Rule A.3) prohibits directors from dealing in the issuer’s securities during the 60-day period before the announcement of annual results and 30 days before quarterly or half-year results. Training must emphasise that this prohibition extends to any person in possession of inside information, not just directors.

Training for Non-Director Employees and Contractors

The HKEX Listing Decision LD-2023-005 (December 2023) addressed a case where a mid-level accountant in a listed issuer’s finance department had shared draft Q3 2023 revenue data with a friend working at a brokerage. The accountant had not received any training on inside information handling. The HKEX ruled that the issuer’s failure to provide training to non-director employees constituted a breach of Main Board Rule 13.09(2)(a), as the issuer had not taken “reasonable steps” to prevent the misuse of inside information.

The recommended training protocol for non-director employees includes:

• Annual mandatory e-learning module — Covering the definition of inside information, the prohibition on disclosure (SFO Section 309), and the issuer’s internal reporting procedures.
• Role-specific workshops — For employees in finance, investor relations, and legal/compliance, who are most likely to encounter SPSI. These workshops should include scenario-based exercises, such as handling an unsolicited call from an analyst asking for guidance on next quarter’s revenue.
• Contractor and consultant onboarding — Every external party that receives SPSI must complete a training module before accessing the information. The module must be documented, with a signed acknowledgement retained by the issuer for at least 6 years (consistent with SFO Section 320 record-keeping requirements).

Documentation and Record-Keeping

The SFC’s Guidelines on the Disclosure of Inside Information (paragraph 65) require that issuers maintain a written record of all training provided, including dates, attendee lists, and training materials. The HKEX Corporate Governance Code (Code Provision C.1.6) further requires that the board review the effectiveness of the issuer’s inside information handling procedures at least annually.

A 2024 HKEX Listing Decision LD-2024-002 examined an issuer that had provided training but had not retained attendance records. The HKEX concluded that without documentary evidence, the issuer could not demonstrate compliance with the Guidelines on the Disclosure of Inside Information paragraph 60 requirement. The issuer was required to re-run the training and submit a compliance report to the HKEX Listing Division within 30 days.

Enforcement Trends and Practical Implications for 2025-2026

The SFC’s Enhanced Enforcement Focus

The SFC’s 2024-25 enforcement report (published April 2025) shows that 32% of all enforcement actions during the fiscal year involved insider dealing or improper disclosure of inside information, up from 24% in FY2023-24. The SFC has also established a dedicated Inside Information Disclosure Task Force within its Enforcement Division, with a mandate to review every HKEX listing application for potential disclosure deficiencies.

The MMT’s 2025 ruling in SFC v. Chan and Lee (MMT 2025-04) is particularly instructive. The case involved a listed issuer’s CFO who had shared draft Q4 2024 financials with three institutional investors during a pre-IPO roadshow for a subsidiary’s spin-off listing. The CFO had required each investor to sign an NDA, but the NDA did not explicitly reference the SFO’s inside information provisions. The MMT ruled that the NDA was insufficient because it did not include a clause requiring the investor to refrain from trading on the information until it was publicly disclosed. The penalty included a HKD 3.5 million fine against the CFO and a 3-year disqualification.

Practical Compliance Recommendations for Post-Listing Issuers

Based on the regulatory architecture and enforcement trends, post-listing issuers in 2025-2026 should implement the following measures:

• Adopt a standardised NDA template — The template must include a two-tier definition (inside information and SPSI), a survival clause of at least 12 months, and an explicit acknowledgement of the SFO’s inside information provisions (Section 307A and Section 309). The template should be reviewed by legal counsel with SFC enforcement experience.
• Establish a SPSI disclosure committee — The committee, comprising the CFO, company secretary, and head of legal/compliance, should meet monthly to review all information shared with external parties and assess whether it meets the SPSI threshold.
• Implement a mandatory training calendar — Training must be conducted at least annually for directors and senior management, and at least bi-annually for employees in finance, investor relations, and legal/compliance. All training must be documented with attendance records retained for 6 years.
• Conduct an annual compliance audit — The audit should review all NDAs signed during the year, all training records, and any incidents of potential SPSI leakage. The audit results must be reported to the board and filed with the HKEX Listing Division if any material deficiencies are identified.

Actionable Takeaways

1. Post-listing issuers must adopt a two-tier definition of confidential information in their NDAs — covering both inside information (SFO Section 307A) and share-price sensitive information (SPSI) — to avoid the enforcement gap identified in SFC v. Li and Chan (MMT 2024).
2. Every NDA signed with a counterparty receiving SPSI must include a survival clause of at least 12 months and an explicit clause prohibiting the counterparty from trading on the information until public disclosure.
3. Directors and senior management must complete annual training on inside information identification and handling, with documented attendance records retained for 6 years, as required by the SFC’s Guidelines on the Disclosure of Inside Information (paragraph 60).
4. Non-director employees in finance, investor relations, and legal/compliance must complete role-specific training at least bi-annually, with scenario-based exercises covering unsolicited analyst calls and draft financial data handling.
5. The board must review the issuer’s inside information handling procedures at least annually, with audit results reported to the HKEX Listing Division if material deficiencies are identified, consistent with the Corporate Governance Code (Code Provision C.1.6).