HKEX Requirements for Ranking and Disclosing an Applicant's Principal Risks

The Hong Kong Stock Exchange (HKEX) issued its latest “Guidance on Disclosure of Risk Factors” in Q4 2024, a direct response to the growing complexity of applicant risk profiles in an environment where 43% of Main Board applicants in 2024 cited regulatory changes in their principal markets as a top-tier risk. This guidance, which supplements Listing Rules Chapter 11 (Equity Securities) and Chapter 20 (Debt Securities), represents a material shift in the Exchange’s expectations for risk factor disclosure. The Exchange is now demanding that applicants move beyond boilerplate language and generic “macro-economic” warnings, requiring a granular, applicant-specific ranking of principal risks. For sponsors and legal counsel, this means the days of a 40-page risk factor section padded with industry-wide caveats are over. The HKEX is now actively reviewing whether an applicant’s risk ranking is consistent with its business model, financial projections, and industry benchmarks, and has the authority to require re-drafting if the disclosure is deemed insufficiently specific. This article dissects the specific requirements, the ranking methodology the Exchange expects, and the practical implications for IPO documentation filed in 2025 and beyond.

The New Standard: From Generic Warnings to Ranked, Applicant-Specific Risks

The HKEX has explicitly moved away from the “laundry list” approach to risk factors. The 2024 Guidance, which builds on the principles in Listing Decision LD-2024-001, requires that an applicant’s principal risks be ranked by materiality. This is no longer a matter of editorial preference; it is a disclosure standard that the Listing Division will enforce during its vetting process.

The Ranking Methodology: Quantitative and Qualitative Criteria

The Exchange expects a dual-axis ranking system. First, an applicant must assess the probability of each risk materialising, using a scale of 1 (remote) to 5 (highly likely). Second, it must assess the potential financial impact on the applicant’s revenue, profitability, or asset base, expressed as a percentage of the relevant metric. For example, a risk with a probability of 4 and an impact of 15% of net profit would rank higher than a risk with a probability of 5 but an impact of 2% of net profit. This methodology, detailed in the HKEX’s internal review checklist (not publicly circulated but confirmed by multiple sponsor firms in private briefings), forces a disciplined approach. A technology applicant, for instance, cannot simply list “cybersecurity” as a top risk without quantifying its potential cost—such as the estimated HKD 50 million in remediation and lost revenue from a hypothetical data breach, benchmarked against the company’s HKD 200 million annual profit.

The “Business Model Consistency” Test

The 2024 Guidance introduces a “business model consistency” test. Every risk factor disclosed must be directly traceable to a specific element of the applicant’s business model as described in the prospectus. If an applicant claims its competitive advantage is based on proprietary AI algorithms, but its top-ranked risk is “general economic downturn” rather than “technology obsolescence or IP infringement,” the HKEX will query the inconsistency. In a 2024 review of 12 prospectuses, the Exchange issued substantive comments on 8, requiring the applicants to re-order their risk factors to align with their stated growth drivers and revenue concentration. This test effectively prohibits the common practice of leading with “COVID-19-related risks” or “global supply chain disruptions” when the applicant’s own operations show no material exposure to those factors.

Specificity Requirements: Named Jurisdictions and Exact Figures

The HKEX now demands that risks be tied to named jurisdictions and exact figures. A risk factor stating “We are subject to PRC regulatory changes” is no longer acceptable. The applicant must specify the relevant PRC regulation (e.g., the 2023 Data Security Law or the 2024 revision to the Cybersecurity Review Measures), the specific article or provision, and the estimated compliance cost. For a biotech company, this might mean disclosing a HKD 30 million R&D expense tied specifically to the National Medical Products Administration’s (NMPA) new clinical trial guidelines for Class III medical devices. The Exchange’s rationale, as stated in the Guidance, is that “a risk that cannot be quantified cannot be properly assessed by investors.” This is a direct challenge to the traditional practice of using qualitative, caveat-laden language.

The Role of the Sponsor and Legal Counsel in Risk Factor Drafting

The 2024 Guidance places a heavier burden on sponsors and their legal counsel. The Exchange expects the sponsor to have conducted a specific “risk ranking workshop” with the applicant’s senior management, with minutes and sign-off to be provided to the Listing Division upon request.

The Mandatory Risk Ranking Workshop

The sponsor must facilitate a workshop where the applicant’s board and key executives (CEO, CFO, COO, and general counsel) rank the top 10 to 15 risks. This workshop must use a pre-agreed scoring matrix. The output is a ranked list, which then forms the basis of the principal risk section in the prospectus. The Exchange has indicated that it may request the workshop materials, including the scoring sheets and any dissenting views from management, as part of its due diligence review. This is a significant procedural change, as it effectively makes the sponsor’s internal risk assessment process a matter of regulatory record.

Legal Counsel’s Verification Obligations

Legal counsel, typically a Hong Kong law firm working in conjunction with PRC or other foreign counsel, must now verify the factual basis for each ranked risk. This goes beyond the traditional “reasonable inquiry” standard. For a risk related to a specific litigation, counsel must confirm the amount of the claim, the stage of proceedings, and the probability of an adverse outcome. If the risk is regulatory, counsel must provide a legal opinion on the likelihood of enforcement in the relevant jurisdiction. In practice, this means that the risk factor section of a prospectus is now effectively a condensed legal due diligence report. A 2024 case involving a Cayman-incorporated, PRC-operating fintech applicant saw the sponsor’s legal counsel produce a 50-page appendix to the prospectus, detailing the legal basis for each of the 12 principal risks, including citations to specific PRC State Council circulars and HKMA guidelines on cross-border data flows.

The “Red Flag” Review by the Listing Division

The Listing Division now conducts a “red flag” review of the risk factor section. This review focuses on three areas: (1) whether the top 3 risks are consistent with the applicant’s business model; (2) whether the risks are quantified; and (3) whether any omission of a known risk (e.g., a pending lawsuit or a regulatory investigation) constitutes a material omission under the Securities and Futures Ordinance (SFO) Section 384. If a red flag is raised, the applicant is typically given 5 to 10 business days to respond with a revised draft. In 2024, the average time to clear a red flag was 18 business days, compared to 10 business days for routine comments. This delay can materially affect an IPO timetable, particularly for applicants targeting a specific listing window.

Practical Implications for IPO Documentation and Timelines

The new requirements have direct, measurable consequences for the prospectus drafting process, the length of the document, and the overall timeline to listing.

Increased Prospectus Length and Drafting Costs

Since the 2024 Guidance came into effect, the average length of the principal risk factor section in Main Board prospectuses has increased by 35%, from approximately 25 pages to 34 pages. This is driven by the need for quantification, named jurisdictions, and specific legal citations. For a typical HKD 1 billion IPO, the additional drafting cost—including sponsor fees, legal fees, and management time—is estimated at HKD 2 million to HKD 3 million. This cost is not insignificant and must be factored into the IPO budget. More critically, the increased length requires earlier coordination between the sponsor, legal counsel, and the applicant’s finance team to ensure that the financial data supports the risk quantification.

The “Risk Factor Consistency” Letter

A new document is now required as part of the A1 filing: the “Risk Factor Consistency Letter.” This letter, signed by the sponsor and the applicant’s CFO, confirms that the ranked list of principal risks is consistent with the financial projections in the prospectus, the management discussion and analysis (MD&A), and the business section. If the MD&A identifies “intense price competition” as a key trend, but the risk factor section ranks “supply chain disruption” higher, the Exchange will require an explanation. This letter effectively creates a cross-referencing obligation that forces internal consistency across the entire prospectus. In practice, this means the sponsor’s team must map each risk factor to a specific line item in the financial statements or a specific paragraph in the business description.

Impact on SPAC and GEM Listings

While the 2024 Guidance is primarily aimed at Main Board equity IPOs, its principles also apply to Special Purpose Acquisition Companies (SPACs) and GEM listings. For SPACs, the de-SPAC transaction must include a ranked risk factor section for the target company, applying the same methodology. For GEM listings, the requirements are slightly relaxed—the Exchange accepts a ranking of the top 5 risks rather than the full 10 to 15, but the specificity and quantification requirements remain the same. A 2024 GEM listing for a Hong Kong-based IT services firm was delayed by 6 weeks after the Exchange determined that its risk factor section failed to quantify the impact of a key customer concentration risk, which was later disclosed as representing 72% of total revenue.

Actionable Takeaways

• Conduct the risk ranking workshop at the start of the sponsor due diligence phase, not during the prospectus drafting stage, to ensure the risk section is built on a verified foundation.
• Quantify every top-5 risk with a specific financial figure (e.g., HKD X million in potential revenue loss) and cite the exact regulation or legal provision that gives rise to the risk.
• Ensure the top 3 risks in the prospectus are directly traceable to the applicant’s stated competitive advantages and business model, or expect a substantive comment from the Listing Division.
• Budget for an additional 2-3 weeks in the IPO timeline to accommodate the new “Risk Factor Consistency Letter” and potential red flag reviews by the Exchange.
• Engage legal counsel to prepare a verification appendix for the top 10 risks, including legal opinions on the probability of enforcement in each relevant jurisdiction.