HKEX Review Focus on Supplier Dependency and Business Disruption Risk

The Hong Kong Stock Exchange (HKEX) has sharpened its scrutiny of supplier concentration and business disruption risk in listing applications, a shift that directly impacts the viability of companies with single-source or geographically concentrated supply chains. This heightened focus, evident in a series of Listing Decisions (LDs) published between 2023 and 2025, reflects a broader regulatory drive to ensure that applicants can demonstrate operational resilience as a core component of their suitability for listing under the HKEX Listing Rules. For CFOs, company secretaries, and sponsors, this means that a prospectus must now provide a forensic-level analysis of supply chain dependencies, backed by quantitative stress testing and contractual evidence, rather than generic risk factor disclosure.

The regulatory pivot is not a sudden change but a culmination of several factors: the post-pandemic supply chain shocks, geopolitical tensions affecting trade routes, and a series of high-profile defaults among listed companies that cited supplier failure as a primary cause. The HKEX’s Listing Division now routinely requests detailed breakdowns of top suppliers by revenue, geographical location, and the duration of the relationship, with particular attention to any single supplier accounting for more than 30% of total procurement costs or a sole-source provider for critical inputs. Failure to provide a credible mitigation plan, such as multi-sourcing agreements, inventory buffers, or alternative logistics arrangements, can result in a formal “deficiency letter” and a delayed listing timetable.

The Evolution of HKEX’s Supplier Dependency Framework

The HKEX’s approach to supplier dependency has evolved from a general risk factor into a specific, quantitative test applied during the vetting process. This shift is codified in several Listing Decisions and reinforced by guidance from the Securities and Futures Commission (SFC) on the duty of sponsors to conduct adequate due diligence.

The 30% Threshold and the “Critical Input” Test

The HKEX applies a de facto materiality threshold for supplier concentration, though it is not a rigid rule. In Listing Decision LD143-2023, the Exchange questioned an applicant whose top three suppliers accounted for 72% of total raw material costs, with the single largest supplier providing 41% of a key component. The HKEX required the sponsor to demonstrate that the applicant could switch suppliers within 90 days without material production disruption. The sponsor’s analysis, which included a detailed market survey of alternative suppliers and their certification timelines, was deemed insufficient until it included a signed letter of intent from a secondary supplier.

This case established the “critical input” test: if a supplier provides a component or service that is not readily substitutable due to technical specifications, regulatory approvals, or long lead times, the HKEX will treat the dependency as a “fundamental business risk” under Listing Rule 2.03(3), which requires that an issuer be “suitable for listing.” The burden falls on the applicant to prove that the risk is manageable, not merely to disclose it.

Geographic Concentration and Geopolitical Risk

Beyond supplier count, the HKEX now scrutinizes geographic concentration with equal rigour. A 2024 Listing Decision (LD146-2024) involved a manufacturer whose entire supply of a specialty chemical came from a single province in mainland China. The HKEX’s Listing Committee required the applicant to provide a business disruption analysis covering scenarios such as a 30-day plant shutdown due to regulatory action, a natural disaster, or a transport corridor closure. The applicant was ultimately required to secure a secondary supplier in a different province and to maintain a 60-day inventory buffer before the listing was approved.

This approach mirrors the HKEX’s broader risk management framework for issuers with significant PRC operations, as outlined in the 2023 “Guidance on Listing of Companies from the PRC.” The Exchange expects sponsors to assess the impact of PRC regulatory changes, such as the 2022 Environmental Protection Tax Law amendments or the 2024 “dual control” energy consumption policies, on supplier stability. For companies sourcing from regions like Xinjiang or Hubei, additional due diligence on labour practices and supply chain compliance is now standard.

Sponsor Due Diligence and Prospectus Disclosure Requirements

The SFC’s “Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission” (the Code) imposes specific obligations on sponsors to verify the accuracy and completeness of information in a listing application. The HKEX’s heightened focus on supplier dependency has translated into explicit sponsor work programmes.

Mandatory Verification Procedures

Under paragraph 17.6 of the Code, sponsors must take “reasonable steps” to satisfy themselves that statements in the prospectus are not false or misleading. In the context of supplier dependency, the HKEX now expects sponsors to perform the following as a minimum:

1. Contractual Review: Obtain and review all supply agreements with the top 5 suppliers by value. The review must confirm the existence of “take-or-pay” clauses, termination rights, force majeure provisions, and minimum volume commitments.
2. Site Visits: Conduct physical or virtual site visits to the premises of the top 3 suppliers. The visit report must include photographs, interview notes with senior management, and an assessment of production capacity.
3. Financial Health Check: Obtain the audited financial statements of the top 2 suppliers for the past three years. If the supplier is a private company, the sponsor must use alternative verification methods, such as bank confirmations or credit bureau reports.
4. Alternative Supplier Mapping: Prepare a formal “alternative supplier analysis” that identifies at least two credible alternatives for each critical input. The analysis must include estimated switching costs, lead times, and quality certification requirements.

Failure to complete these steps, as noted in a 2024 enforcement action by the SFC against a sponsor (SFC Enforcement News, July 2024), can result in disciplinary action, including fines and suspension of the sponsor’s licence.

Prospectus Disclosure: Moving Beyond Generic Risk Factors

The HKEX’s “Guide on Disclosure of Business and Financial Information” (2023 update) explicitly requires that risk factors be “specific to the issuer’s business” rather than generic. For supplier dependency, this means the prospectus must include:

• A table listing the top 5 suppliers, their geographic location, the percentage of total purchases, and the duration of the relationship.
• A narrative explaining the reasons for the concentration (e.g., technical specifications, regulatory exclusivity, cost advantages).
• A detailed description of the mitigation measures, including inventory policies, multi-sourcing agreements, and insurance coverage.
• A sensitivity analysis showing the estimated financial impact of a 30-day, 60-day, and 90-day supply disruption on revenue, gross profit, and net income.

A 2024 prospectus for a medical device manufacturer (Company A, Main Board Listing, 2024) that passed HKEX scrutiny included a 15-page section on supply chain risk, complete with a Monte Carlo simulation of disruption scenarios. This level of detail is now becoming the market standard.

Business Disruption Risk: From Disclosure to Quantitative Modelling

The HKEX’s focus has expanded beyond supplier dependency to encompass broader business disruption risk, including reliance on single manufacturing sites, key customers, and critical IT systems. This is a direct response to the pandemic-era disruptions that affected multiple listed companies.

Single-Site Manufacturing and Operational Resilience

The HKEX’s Listing Committee has made it clear that a company operating from a single manufacturing facility faces a presumption of unsuitability unless it can demonstrate robust business continuity planning. In a 2025 Listing Decision (LD150-2025), an applicant whose entire production was housed in a single factory in Dongguan was required to commission a third-party business continuity audit. The audit had to cover scenarios including fire, flood, power outage, and labour strike, with quantified recovery time objectives (RTOs) and recovery point objectives (RPOs) for each scenario.

The applicant was ultimately required to establish a secondary production line in a different city, with a minimum of 20% of total capacity, before the listing could proceed. This precedent has significant implications for manufacturing companies, particularly those in the Greater Bay Area, where land and labour costs often drive single-site operations.

Key Customer Dependency and the “80/20” Rule

While supplier dependency is a supply-side risk, customer concentration remains a demand-side concern. The HKEX applies a similar analytical framework to key customers, with a particular focus on any single customer accounting for more than 20% of total revenue. In LD148-2024, an applicant whose top customer contributed 65% of revenue was required to provide a copy of the customer’s audited financial statements and a letter from the customer confirming its intention to continue purchasing for at least the next three years.

The HKEX’s approach here is informed by the “80/20 rule” often cited in risk management literature: if 80% of revenue comes from 20% of customers, the business is vulnerable to the loss of a single relationship. The Exchange expects the prospectus to include a detailed analysis of the customer’s industry, financial health, and switching costs, as well as the terms of the master service agreement or supply contract.

IT and Cybersecurity Disruption

In an era of increasing digital dependency, the HKEX has also started to scrutinise IT and cybersecurity risks as a form of business disruption. The 2024 “Guidance on Cybersecurity and Data Privacy in Listing Applications” (HKEX, June 2024) requires applicants to disclose any material cybersecurity incidents in the past three years and to describe their incident response plans. For companies relying on a single cloud service provider (e.g., AWS, Alibaba Cloud, or Azure), the HKEX expects a discussion of vendor lock-in risks and a disaster recovery plan that includes a secondary provider.

This guidance is particularly relevant for fintech, biotech, and SaaS companies, where a 24-hour system outage could result in significant revenue loss and reputational damage. The HKEX’s Listing Division has been known to request penetration test reports and SOC 2 Type II audit reports from applicants in these sectors.

Practical Implications for Listing Applicants and Their Advisors

The heightened scrutiny of supplier dependency and business disruption risk has direct, practical consequences for the listing timeline, cost, and structure of an IPO. Sponsors and applicants must now build these considerations into their pre-IPO planning.

Pre-Listing Remediation Timelines

Companies that identify a material supplier concentration issue during the due diligence phase should not expect to remediate it quickly. The HKEX’s informal guidance suggests that establishing a credible secondary supplier, including qualification, certification, and initial production runs, typically takes 6 to 12 months. For companies in regulated industries (e.g., pharmaceuticals, medical devices, or automotive parts), the timeline can extend to 18 months due to regulatory approvals.

Applicants should therefore begin the supplier diversification process at least 12 months before the intended A1 filing date. This timeline also applies to the establishment of secondary manufacturing sites or the implementation of business continuity plans.

Impact on Valuation and Pricing

A material supplier dependency finding can also affect the company’s valuation. Investment banks and cornerstone investors will factor in the risk premium associated with a concentrated supply chain, which can result in a 10% to 20% discount on the IPO price compared to a diversified peer. In a 2024 IPO for a semiconductor equipment manufacturer, the final offer price was set at the bottom of the bookbuilding range after the HKEX raised concerns about the company’s sole-source relationship with a Japanese supplier of precision components.

Sponsors should therefore advise their clients to engage with potential cornerstone investors early in the process, providing them with the same level of detail on supply chain risk that the HKEX will require. This transparency can help mitigate the valuation discount.

Cross-Border Considerations for PRC Companies

For companies incorporated in the PRC or with significant PRC operations, the supplier dependency analysis must also consider the impact of PRC export controls and sanctions. The 2024 “Regulations on the Administration of Export Control of Dual-Use Items” (PRC State Council, 2024) impose restrictions on the export of certain technologies and materials. If a supplier is subject to these controls, the applicant must demonstrate that it has obtained the necessary export licences or that alternative suppliers are available.

Similarly, companies sourcing from regions subject to US or EU sanctions (e.g., certain entities in Russia or Iran) face an immediate presumption of unsuitability. The HKEX has made it clear in its 2024 “Guidance on Sanctions Compliance” that it will not list companies whose supply chains involve sanctioned entities, even if the applicant itself is not directly sanctioned.

Actionable Takeaways for Listing Applicants

1. Conduct a supplier dependency audit 12 months before filing: Identify all critical inputs and map the concentration of suppliers by value, geography, and substitutability. Commission a third-party business continuity audit for single-site manufacturers.
2. Secure secondary suppliers with signed agreements: A letter of intent or a memorandum of understanding is insufficient. The HKEX expects a legally binding agreement with a secondary supplier that covers pricing, volume, and delivery terms.
3. Prepare a quantitative disruption impact analysis: Use scenario modelling to estimate the financial impact of a 30-day, 60-day, and 90-day supply disruption. Include the analysis in the prospectus as a separate section, not just a risk factor.
4. Engage the sponsor early on due diligence procedures: The sponsor’s work programme must include site visits, financial reviews, and alternative supplier mapping for the top 3 suppliers. Delays in completing this work can push back the A1 filing by months.
5. Review all supply agreements for force majeure and termination clauses: The HKEX will scrutinise the contractual protections in place. Ensure that agreements include adequate force majeure provisions and that termination rights are not overly favourable to the supplier.