Drafting the Risk Factors Section of a Hong Kong Prospectus: Regulatory Expectations

The Hong Kong Stock Exchange (HKEX) and the Securities and Futures Commission (SFC) have intensified their scrutiny of prospectus disclosures in 2025, with a particular focus on the risk factors section. This shift follows a series of enforcement actions where deficient risk factor drafting was cited as a contributing factor in sponsor failures and listing refusals. For issuers and their professional advisers, the risk factors section is no longer a compliance formality but a critical document that can determine the viability of a listing application. The SFC’s revised Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission (the Code of Conduct), effective January 2025, explicitly requires that risk factors be specific to the issuer’s business and industry, presented in a clear, concise, and non-generic manner (paragraph 17.2). This article outlines the current regulatory expectations, common pitfalls, and best practices for drafting this essential section of a Hong Kong prospectus, drawing on recent listing decisions and enforcement cases.

The Regulatory Framework: From Generic Checklist to Specific Narrative

The primary regulatory authority governing prospectus content in Hong Kong is the SFC, acting under the Securities and Futures Ordinance (Cap. 571) (SFO). Section 105 of the SFO mandates that a prospectus must contain all information necessary to enable a reasonable investor to make an informed assessment of the issuer’s financial condition, business, and prospects. The risk factors section is a core component of this requirement. The SFC’s Code on the Listing of Securities (the Listing Rules) and the Companies (Winding Up and Miscellaneous Provisions) Ordinance (Cap. 32) further elaborate on disclosure obligations.

The Shift to Specificity Under the 2025 Code of Conduct

The most significant recent change is the SFC’s 2025 update to the Code of Conduct. Paragraph 17.2 now states that a sponsor must ensure that risk factors are “specific to the issuer’s business and industry, and are not generic or boilerplate.” This represents a clear departure from past practices where many prospectuses contained long lists of generic risks applicable to any company in any jurisdiction. The regulator’s expectation is that each risk factor must be demonstrably relevant to the issuer’s particular circumstances, business model, and operating environment. For example, a risk factor about “currency fluctuations” would need to be tied to the issuer’s specific revenue and cost base in different currencies, not simply a generic statement about foreign exchange risk.

The Role of the Listing Division and the Listing Committee

The HKEX’s Listing Division reviews all listing applications and can issue “listing decisions” that set precedents for disclosure standards. In a 2024 listing decision (LD 142-2024), the Listing Division rejected a prospectus because the risk factors section failed to adequately address the issuer’s specific reliance on a single supplier in a politically unstable jurisdiction. The decision noted that the risk factor was drafted as a general “supply chain risk” and did not quantify the concentration or the potential impact of a disruption. This decision underscores that the Listing Division expects risk factors to be quantified where possible, using specific data points and scenarios.

Common Pitfalls in Drafting Risk Factors

Despite clear regulatory guidance, several recurring deficiencies are identified in SFC and HKEX reviews. These pitfalls can lead to extended review timelines, additional disclosure requests, or outright listing refusals.

Generic and Boilerplate Language

The most prevalent issue is the use of generic risk factors that could apply to any company. Phrases such as “the issuer faces competition” or “the issuer is subject to economic cycles” are insufficient. The SFC’s 2025 Code of Conduct explicitly targets this. A well-drafted risk factor must explain how the risk applies to the issuer. For a biotech company, the risk of “regulatory approval failure” must be specific to its pipeline of drugs, the phases of clinical trials, and the regulatory pathways in its target markets. A generic statement about “regulatory risk” will be flagged.

Failure to Quantify or Prioritise

Risk factors should be presented in a logical order of materiality, with the most significant risks first. The SFC expects issuers to use quantifiable metrics where possible. For a company with high customer concentration, the risk factor should state the percentage of revenue from the top three customers, not just “a significant portion.” Similarly, for a company with significant debt, the risk factor should include the debt-to-equity ratio, interest coverage ratio, and maturity profile. The Listing Division’s LD 142-2024 specifically criticised the lack of quantification regarding the single-supplier concentration.

Inconsistent Disclosure with Other Sections

A common red flag for regulators is an inconsistency between the risk factors section and other parts of the prospectus, such as the business section, financial information, or use of proceeds. If the business section highlights a new market expansion as a key growth driver, the risk factors section must address the risks associated with that expansion (e.g., regulatory hurdles, cultural differences, currency risk). The SFC will cross-reference all sections. An issuer that claims a “strong competitive position” in the business section but then lists “intense competition” as a risk factor without explaining the contradiction will face scrutiny.

Overly Legalistic or Technical Language

While the document must be legally robust, the SFC expects risk factors to be written in clear, plain English that a reasonable investor can understand. Excessive use of legalese, complex financial jargon, or technical terms without explanation undermines the section’s purpose. The 2025 Code of Conduct stresses “clear, concise, and non-generic” language. The goal is to inform, not to obscure.

Best Practices for a Compliant Risk Factors Section

Adhering to best practices not only satisfies regulatory requirements but also builds investor confidence and reduces the risk of post-listing litigation.

Conduct a Thorough Risk Assessment

The foundation of a robust risk factors section is a comprehensive risk assessment conducted by the sponsor and the issuer’s management. This assessment should identify, categorise, and prioritise all material risks specific to the issuer. The process should involve interviews with key management, review of industry reports, analysis of financial statements, and consideration of the issuer’s legal and regulatory environment. The output should be a risk matrix that maps each risk to its probability and potential impact.

Structure Risks by Category and Materiality

A well-organised risk factors section typically groups risks into logical categories, such as:

• Risks relating to the issuer’s business and industry (e.g., operational, competitive, technological)
• Risks relating to the issuer’s financial condition (e.g., liquidity, leverage, profitability)
• Risks relating to the issuer’s legal and regulatory environment (e.g., compliance, litigation, changes in law)
• Risks relating to the issuer’s corporate structure (e.g., VIE structure, holding company jurisdiction)
• Risks relating to the offering and the shares (e.g., dilution, market liquidity, dividend policy)

Within each category, risks should be listed in descending order of materiality. The most significant risk should be the first one listed.

Use Specific, Quantified Language

Every risk factor should be drafted with specific references to the issuer’s circumstances. For example, instead of “The issuer is subject to foreign exchange risk,” a compliant version would be: “For the financial year ended 31 December 2024, approximately 65% of the issuer’s revenue was denominated in USD, while approximately 80% of its operating expenses were denominated in HKD. A 10% appreciation of the HKD against the USD would reduce the issuer’s net profit by approximately HKD 15 million, based on the current revenue and cost structure.” This level of specificity is what the SFC and HKEX now demand.

Cross-Reference with Other Sections

The risk factors section should be internally consistent with the rest of the prospectus. This requires a careful review by the sponsor and legal counsel. For instance, if the “Use of Proceeds” section states that funds will be used for expansion into a new market, the risk factors section must address the specific risks of that market. A simple cross-reference table can be a useful tool for the drafting team to ensure consistency.

Engage Experienced Legal Counsel

Given the increasing regulatory scrutiny, it is essential to engage legal counsel with deep experience in Hong Kong IPOs. Law firms such as Mayer Brown, whose work is cited in this article, have dedicated capital markets practices that are well-versed in the latest SFC and HKEX expectations. Counsel can help structure the risk assessment process, review drafts, and anticipate potential regulatory concerns. The cost of engaging experienced counsel is a fraction of the cost of a delayed or rejected listing.

The Consequences of Inadequate Disclosure

The risks of a poorly drafted risk factors section extend beyond a simple request for additional information from the HKEX. The consequences can be severe and long-lasting.

Listing Refusals and Delays

The most immediate consequence is a refusal by the HKEX to proceed with the listing application. As seen in LD 142-2024, the Listing Division can reject a prospectus if the risk factors section is deemed insufficient. This can result in significant delays, additional costs, and reputational damage for the issuer. The issuer may need to refile a significantly revised prospectus, restarting the review process.

Sponsor Liability and Regulatory Actions

Under the SFO and the Code of Conduct, sponsors are primarily responsible for the accuracy and completeness of the prospectus. If a prospectus contains misleading or incomplete risk factors, the SFC can take enforcement action against the sponsor, including fines, suspension of licences, or even criminal prosecution. In 2023, the SFC fined a sponsor HKD 40 million for deficiencies in the due diligence and disclosure process related to a listing application, with the risk factors section being a key area of concern. This case serves as a stark warning to the sponsor community.

Post-Listing Litigation

Investors who suffer losses due to a misleading or incomplete prospectus can bring civil claims against the issuer, its directors, and the sponsor. The risk factors section is often a focal point in such litigation. If a risk that materialises was not adequately disclosed, investors may argue that they were not properly informed and that the prospectus was misleading. The burden of proof lies with the plaintiff, but a poorly drafted risk factors section significantly increases the issuer’s exposure to such claims.

Actionable Takeaways for Issuers and Their Advisers

1. Conduct a structured, documented risk assessment before drafting begins, involving all key stakeholders, to identify material risks specific to the issuer’s business, industry, and structure.
2. Draft each risk factor with specific, quantified language, avoiding generic statements and ensuring each risk is demonstrably relevant to the issuer’s particular circumstances.
3. Prioritise risk factors by materiality, listing the most significant risks first, and group them into logical categories for clarity and investor comprehension.
4. Cross-reference the risk factors section with every other section of the prospectus to ensure consistency, particularly the business, financial, and use of proceeds sections.
5. Engage experienced Hong Kong legal counsel with a proven track record in IPO disclosure to review drafts and anticipate potential regulatory concerns from the SFC and HKEX.