How to Build a Compliance Culture in a Pre-IPO Company: Starting with Tone from the Top

The SFC’s 2024 enforcement report recorded 194 active investigations and 78 disciplinary actions against intermediaries, a 15% increase from 2023, while the HKEX’s latest Listing Committee decisions show a rising rejection rate for IPO applications citing insufficient internal controls — 12% of the 68 new listing applications rejected in 2024 were turned down primarily on governance grounds, up from 7% in 2022. For a pre-IPO company in Hong Kong, the window to build a credible compliance culture is narrowing. The Listing Rules Chapter 3.08 require every director to satisfy the Exchange of their competence and character, and the Sponsor regime under the Code of Conduct for Persons Licensed by or Registered with the SFC (the “Code of Conduct”) paragraph 17 mandates that sponsors assess an applicant’s internal control systems. A company that begins constructing its compliance framework only when the sponsor’s due diligence team arrives in the boardroom has already lost the argument. The tone from the top is not a slogan; it is the single most verifiable data point an investigator will examine.

The Regulatory Calculus: Why Pre-IPO Compliance Is Not Optional

The SFC and HKEX have shifted from a principles-based approach to a rules-based enforcement posture that directly penalises pre-IPO governance failures. The SFC’s 2023-2024 annual report shows that 34% of its enforcement actions involved listing-related misconduct, with 12 cases specifically targeting inadequate internal controls in IPO applicants. The HKEX’s Guidance Letter HKEX-GL86-16 explicitly states that the Exchange may refuse a listing if the applicant’s internal controls are “materially deficient,” and this is not a theoretical risk — in 2024, the Listing Division rejected two applications from biotech companies under Chapter 18A precisely because the board had not demonstrated a functioning compliance culture.

The cost of building compliance late is not merely a rejection; it is a permanent market stigma. A company that withdraws its application after an SFC inquiry into internal controls faces a mandatory 12-month cooling-off period under the Listing Rules, and the sponsor must disclose the reason for withdrawal in any subsequent application. For pre-IPO companies targeting a Main Board listing in 2025 or 2026, the compliance culture must be embedded at least 18 months before the Form A1 submission — a timeline that the SFC’s thematic inspection of sponsors in 2024 confirmed as the minimum period for a credible audit trail.

The Sponsor’s Lens: What They Actually Look For

A sponsor conducting due diligence under paragraph 17 of the Code of Conduct is required to verify that the applicant’s board and senior management have established a “culture of compliance” that permeates the organisation. This is not a box-ticking exercise. The SFC’s 2023 “Report on the Thematic Inspection of Sponsors” found that 60% of sponsors had identified material weaknesses in applicants’ internal controls during the pre-listing phase, and in 25% of those cases, the weaknesses were traced directly to a lack of board-level engagement.

The specific evidence sponsors seek includes: board meeting minutes that show compliance as a standing agenda item, a written compliance manual endorsed by the board, a designated compliance officer reporting directly to the audit committee, and a whistleblowing policy that has been tested with at least one reported incident. The Listing Rules require the audit committee to have at least three members, all non-executive directors, with at least one being an independent non-executive director with appropriate professional qualifications (Rule 3.21). A pre-IPO company that has not constituted its audit committee with these specifications 12 months before the listing application will find itself in a structural deficit that no last-minute remediation can fix.

Building the Framework: From Board Resolution to Operational Reality

The compliance culture must be codified in three layers: the board’s governance charter, the management’s operational procedures, and the staff’s daily conduct. Each layer requires its own documentation, training, and verification mechanism. The HKEX’s Corporate Governance Code (CG Code) sets out the principles, but the pre-IPO company must go beyond the CG Code’s minimums to satisfy the sponsor’s due diligence.

The Board Charter and the Compliance Committee

The board should pass a formal resolution adopting a compliance charter that defines the roles and responsibilities of the board, the audit committee, and the compliance officer. This charter must reference the Listing Rules, the Securities and Futures Ordinance (Cap. 571), and the Prevention of Bribery Ordinance (Cap. 201). The resolution should be passed at least 18 months before the expected A1 submission date, and the minutes must record the discussion, not merely the vote.

The compliance committee — which can be a sub-committee of the audit committee — should meet at least quarterly, with minutes that demonstrate substantive review of compliance incidents, regulatory changes, and training completion rates. The SFC’s enforcement actions in 2024 included two cases where the board had a compliance committee on paper but the minutes showed no discussion of actual compliance issues for six consecutive quarters. The HKEX treated this as evidence that the compliance culture did not exist in practice.

The Compliance Officer Appointment and Reporting Lines

The compliance officer must be a senior executive with direct access to the board, preferably the company secretary or a dedicated compliance director. The Listing Rules do not mandate a specific title, but the SFC’s Code of Conduct paragraph 5.2 requires that the compliance function have sufficient authority and resources. In practice, this means the compliance officer should report to the audit committee, not to the CEO, and the reporting line must be documented in the board charter.

The compliance officer’s responsibilities should include: monitoring regulatory changes from the SFC, HKEX, and HKMA; conducting annual compliance risk assessments; managing the whistleblowing channel; and reporting to the board on compliance metrics at each board meeting. The pre-IPO company should budget for a compliance officer salary that is at least comparable to the CFO and legal counsel, as the SFC’s inspections will verify whether the role is treated as a cost centre or a strategic function.

Operationalising Compliance: Policies, Training, and Enforcement

The board charter and compliance officer appointment are the architecture; the policies and training are the wiring. Without operational enforcement, the compliance culture is a facade that the sponsor’s due diligence team will dismantle in the first interview with middle management.

The Written Compliance Manual and Whistleblowing Policy

The compliance manual must cover: anti-bribery and corruption (ABC), insider dealing (Section 291 of the SFO), conflicts of interest, data privacy (Personal Data (Privacy) Ordinance Cap. 486), and anti-money laundering (AML) under the AML Guidelines issued by the SFC. Each policy must include specific examples relevant to the company’s industry — for a biotech company, this means clinical trial data management; for a fintech company, it means customer due diligence under HKMA’s AML/CFT guidelines.

The whistleblowing policy must provide for anonymous reporting, protection from retaliation, and a clear investigation procedure. The HKEX’s 2024 consultation on the CG Code proposed mandatory whistleblowing policies for all listed companies, and pre-IPO companies should adopt this as a best practice now. The policy should designate the audit committee as the recipient of whistleblowing reports, and the committee must maintain a log of all reports with their status and resolution.

Training Completion Rates and Testing

Compliance training must be mandatory for all employees, with completion rates tracked and reported to the board quarterly. The target should be 100% completion within 30 days of hire and annually thereafter. The SFC’s 2024 enforcement report noted that in three cases involving insider dealing, the employees had not completed any compliance training in the 12 months preceding the violation.

The training should include scenario-based testing, not just passive video modules. The company should document the test results and the remediation for any employee who fails. The sponsor will request the training records for the 24 months preceding the A1 submission, and any gap in training coverage for senior management or finance staff will be flagged as a material weakness.

Enforcement: The Test of Culture

The single most important indicator of a genuine compliance culture is the enforcement record. A company that has policies but has never disciplined an employee for a compliance violation is, in the sponsor’s eyes, a company that has not tested its culture. The pre-IPO company should have at least one documented compliance incident — even a minor one — that was investigated, resolved, and reported to the board. The absence of any incidents is a red flag that indicates either the policies are not being enforced or the reporting mechanisms are not trusted.

The enforcement must be consistent across all levels. The SFC’s 2023 enforcement action against a Main Board listed company involved a CEO who was found to have engaged in insider dealing; the board had not taken any action because the CEO was the founder. The SFC fined the company HKD 8 million and suspended its trading for two weeks. A pre-IPO company that cannot demonstrate that its compliance policies apply equally to the founder and the junior accountant will not pass the sponsor’s assessment.

The Timeline: A 24-Month Roadmap to Credible Compliance

The compliance culture cannot be built in a quarter. The following timeline assumes the company targets a A1 submission in month 24, and each milestone is verifiable by the sponsor.

Months 1-6: Foundation

The board passes the compliance charter and appoints the compliance officer. The audit committee is constituted with three independent non-executive directors, one of whom holds a recognised professional qualification (CPA, CFA, or law degree). The compliance manual is drafted and reviewed by external counsel with SFC experience. The whistleblowing policy is adopted, and the anonymous reporting channel is established. The first round of compliance training is completed for all employees.

Months 7-12: Testing and Refinement

The compliance officer conducts the first annual risk assessment, identifying the top three compliance risks specific to the company’s industry and operations. The board reviews the risk assessment at a dedicated meeting, with minutes recording the discussion and the actions taken. The first compliance incident — a minor conflict of interest involving a procurement manager — is investigated, and the employee is disciplined. The case is documented and reported to the audit committee.

Months 13-18: Pre-Sponsor Readiness

The company engages a sponsor for a pre-due diligence assessment. The sponsor reviews the compliance framework and identifies any gaps. The board addresses the gaps within 60 days. The second round of compliance training is completed, with a 100% completion rate. The whistleblowing channel has received at least one report, which was investigated and resolved. The board minutes for the past 12 months show compliance as a standing agenda item at every meeting.

Months 19-24: Final Verification

The sponsor conducts full due diligence under paragraph 17 of the Code of Conduct. The compliance officer provides the sponsor with the compliance manual, training records, whistleblowing log, enforcement records, and board minutes. The sponsor interviews the compliance officer, the audit committee chair, and at least two senior managers to verify that the compliance culture is operational. The A1 submission is filed, with the internal controls section referencing the specific policies and the enforcement record.

Conclusion: Five Actionable Takeaways for the Pre-IPO CFO

1. Pass the compliance charter and constitute the audit committee at least 18 months before the A1 submission, and ensure the board minutes document substantive compliance discussions at every meeting.

2. Appoint a compliance officer with direct reporting line to the audit committee, not the CEO, and budget for a role that is treated as a strategic function, not a cost centre.

3. Achieve 100% compliance training completion within 30 days of hire and annually, with scenario-based testing and documented remediation for failures.

4. Create at least one verifiable compliance enforcement action — even a minor one — to demonstrate that policies apply equally to all employees, including the founder.

5. Engage the sponsor for a pre-due diligence assessment at least 12 months before the A1 submission, and address all identified gaps within 60 days.