Hong Kong has seen cryptocurrencies grow in popularity, highlighting the need for appropriate licensing regimes (implemented in the form of virtual asset service providers (VASPs)), bolstered by active enforcement actions.

While some have criticised the regulators for taking too little action too late, it is clear that the SFC takes investor protection seriously and will continue to do so into 2024. Any unlicensed activities harming investors, particularly those of a fraudulent nature, will not be tolerated. Outside of the crypto markets, prompt reporting and voluntary cooperation with authorities are crucial for earning cooperation credit and leniency, while proposed legislative reforms in crowdfunding, cybersecurity, stablecoins, and personal data (including fines for data breach) are on the horizon.

Investigations – important trends or developments

Authorities in Hong Kong remain very active in their investigation of misconduct and white-collar crime.

The strategic focus of the Securities and Futures Commission (SFC) on high-impact cases helps to address key risks in financial markets and sends a strong deterrent message to the market. In the quarter ended 30 September 2023, the SFC conducted 434 investigations on corporate disclosure, corporate misgovernance, insider dealing, intermediary misconduct, market manipulation and unlicensed activities.

Disciplinary action was taken against 18 individuals and 13 corporations, resulting in total fines of HKD41.7 million in 2022/2023.

Alongside enforcement action, the SFC continues to drive investor protection and issued a consultation on proposed amendments to the Securities and Futures Ordinance that would have significantly broadened the statutory basis upon which court orders seeking relief for investors could be obtained. In its conclusions published August 2023, the SFC stated that it will go ahead with broadening the territorial scope of the insider dealing provisions, but decided to put the other proposed amendments on hold.

The SFC’s conclusion strikes a delicate balance between enhancing investor protection and recognising practical implementation issues. For more details, see Proceed with caution: limited enforcement reform in Hong Kong (so far). However, the SFC remains of the view that the existing legal framework is insufficient to ensure that aggrieved investors (especially retail) are compensated for financial losses in appropriate cases. Further reform may be proposed in due course.

Cooperation among various regulatory and enforcement authorities continued. For example:

• The SFC and the Independent Commission Against Corruption (ICAC) conducted a joint operation against two listed companies on suspicion of market manipulation in August 2023.
• The SFC, ICAC and the Accounting and Financial Reporting Council (AFRC) conducted the first tripartite operation involving two listed companies on suspicion that they falsified corporate transactions totalling HKD193 million in October 2023, resulting in three arrests.

Important law reforms impacting corporate criminal liability

The SFC has expanded its regulatory oversight of the virtual assets sector by introducing a licensing regime for VASPs, effective 1 June 2023.

Persons who carry on a VASP business are required to obtain a licence, while the VASP regime has criminalised a broad range of crypto-related misconduct. Offences include breach of regulations regarding the issuance of advertisements relating to virtual asset services, the use of fraudulent or deceptive devices in transactions involving virtual assets, and the use of fraudulent or reckless misrepresentations with the intention to induce investment in virtual assets.

Liability will also accrue for non-compliance with anti-money laundering and counter-terrorist financing requirements. Licensed VASPs and their responsible officers would be liable to a fine of HKD1 million and two years’ imprisonment upon conviction, and subject to a range of disciplinary sanctions, including revocation of the VASP licence. For more details, see Hong Kong Regulatory Roadmap for the Year of the Rabbit.

The SFC referred JPEX, an unregulated virtual asset trading platform, to the Hong Kong Police Force (HKPF) for investigation for breach of the VASP regime in September 2023, resulting in over 60 high-profile arrests for alleged fraud. The JPEX incident has added to calls for more robust crypto regulation in Hong Kong from certain commentators.

Internal investigations – key developments

Recent regulatory reforms and guidance demonstrate an increased need for corporates to remain vigilant on the need to self-report misconduct to appropriate authorities and manage the employment risks arising from the investigation of employee conduct.

The SFC’s Guidance Note on Cooperation was updated in June 2023. It emphasises the importance of voluntary and prompt reporting and provision of true and complete information regarding failings. Acceptance of liability and implementation of rectification measures are also forms of cooperation that the SFC will take into account in resolving a matter and determining sanctions.

If an internal investigation unveils cartel conduct, a corporate should consider applying to the Hong Kong Competition Commission (HKCC) for leniency under the Leniency Policy for Undertakings Engaged in Cartel Conduct. In a recent case, the HKCC pursued a price-fixing cartel in the real estate agency sector. One of the defendant’s competitors, Centaline Property, provided substantial assistance to the HKCC in its investigation and secured a leniency agreement, under which the HKCC agreed not to take any legal proceedings against Centaline or its officers or employees.

In the banking sector, phase 1 of the Mandatory Reference Checking Scheme came into full effect in May 2023. The scheme addresses “rolling bad apples”. Institutions recruiting for positions that fall within scope will now need to approach the former and current employer(s) of a prospective employee to request details of their conduct covering seven years prior to the application for employment.

Institutions will need to consider carefully how to respond to such reference requests, especially while investigations are ongoing, and maintain sufficient internal employee disciplinary records on an ongoing basis so that they can provide the information requested. For more details, see Hong Kong’s proposed Mandatory Reference Checking Scheme: the end of “rolling bad apples”?

Meanwhile, the Office of the Privacy Commissioner for Personal Data (PCPD) has proposed a mandatory data breach notification mechanism and administrative fines for breach of the Personal Data (Privacy) Ordinance as proposed amendments to the ordinance. The Hong Kong government and the PCPD were aiming to consult the Legislative Council on specific legislative proposals concerning the PDPO in the second quarter of 2023.

Sectors targeted by law reforms or enforcement action

The total number of corruption complaints (excluding election complaints) received by the ICAC between January and June 2023 was 1,043, representing an increase of 16% when compared to the same period in 2022, with an increase of complaints in relation to the private sector of 33%.

Following the introduction of the VASP regime, the SFC and HKPF undertook high-profile investigations of unlicensed VASPs and related fraudulent activities, in particular in relation to JPEX and Hounax (another virtual asset trading platform). Active enforcement in the virtual assets sector is expected to continue into 2024 as Hong Kong establishes itself as a credible virtual assets hub with investor protection.

Meanwhile, the HKCC continues to focus on a wide range of sectors which directly impact consumers. Its areas of interest include the sale of residential properties, supply of air-conditioning works, online food delivery services, car warranty restrictions, and joint business agreements between airlines.

Cross-border coordination

The Hong Kong authorities continue to work closely with their counterparts in the other parts of China. For instance:

• The SFC acknowledged the China Securities Regulatory Commission (CSRC) for providing extensive assistance and continued support to the SFC in combating cross-boundary offences and misconduct.
• The Macao Commission Against Corruption assisted the ICAC by arranging interviews with witnesses in Macao in relation to bribery over HKD34 million Macao hotel air-conditioning maintenance contracts.
• The SFC and CSRC held their 15th regular meeting on enforcement cooperation and joint training in November 2023, at which they exchanged views on enforcement priorities, trends and progress and took stock of successful outcomes in enforcement cooperation.

On an international level, while the mutual legal assistance agreements between Hong Kong and many jurisdictions including the UK and the U.S. have been suspended for a few years, there will continue to be cross-border cooperation between regulators in specific sectors through the various memorandums of understanding (MOUs) and information sharing mechanisms currently in place.

Predictions for 2024

Virtual assets: A clear enforcement priority of authorities is the virtual assets sector, as evidenced by the high-profile investigations of JPEX and Hounax. The SFC, with assistance of other authorities, will want to demonstrate that the new VASP regime provides strong investor protection and any unlicensed activities harming investors, particularly those of a fraudulent nature, will not be tolerated.

Audit accountability: The AFRC as the independent regulator of the accounting profession, will become more active in its investigation and sanction of auditing/reporting irregularities or misconduct to hold accounting professionals responsible. In 2023, we saw the first joint operation between the AFRC and other authorities, and active investigations have increased by ~130%.

National security: The Hong Kong government aims to enact legislation to prohibit certain conduct endangering national security by end of 2024.

Crowdfunding law: The Hong Kong government proposed a new law which would establish a new Crowdfunding Affairs Office for deciding whether to approve a crowdfunding activity to increase the transparency and accountability of crowdfunding activities. The public consultation was completed in March 2023 and a draft bill is being prepared.

Cybersecurity of critical infrastructure: The Hong Kong government is poised to enact a new cybersecurity law, intended to clearly define the cybersecurity responsibilities of critical information infrastructure operators. A draft bill is expected to be presented to the Legislative Council in 2024.

Personal data: The PCPD foreshadowed that there will be amendments to the Personal Data (Privacy) Ordinance to establish a mandatory data breach notification mechanism, require the formulation of data retention policy, empower the PCPD to impose administrative fines, and introduce direct regulation of data processors.

Stablecoins: The HKMA has proposed key parameters for a stablecoin licensing regime and launched a public consultation on specific regulatory requirements on 27 December 2023. The regulatory arrangements are expected to be implemented in 2024. For more details, see Hong Kong Regulatory Roadmap for the Year of the Rabbit.

This article is part of our Cross-Border White Collar Crime and Investigations Review. Please click here for our overviews and insights in other jurisdictions.