The Court of First Instance has imposed 13-year disqualification orders against three former senior executives of China Candy Holdings Limited (the “Company”)[1] after finding that they were involved in a scheme to overstate the Company’s cash balances and conceal the misstatements through falsified accounting records and banking documents.

The Court found that the Company’s reported cash and bank balances were overstated by approximately RMB38 million (as of 30 June 2016) to RMB43 million (as of 31 December 2016), representing up to 97% of the Company’s purported cash position. The Court described the evidence as overwhelming and found that the overstatements were deliberate, involving a scheme of falsified vouchers, bank slips and bank statements, some of which were provided to the Company’s auditors, rather than the result of accounting error.

None of the three Respondents participated in the proceedings or attended the trial. The Court was prepared to draw adverse inferences from their non-participation, although it noted that the documentary evidence already provided overwhelming support for the SFC’s case.

In determining the appropriate period of disqualification, the Court observed:

“What we are concerned with in this case is a scheme which was designed to circumvent ordinary oversight of auditing. Ordinarily, external auditors act as gatekeepers by independently evaluating and ensuring the accuracy of a company’s financial information. In this case, however, the Overstatements were not identified by [the auditor] precisely because it, too, was provided with falsified financial information by the Respondents on at least two occasions.”

Takeaways

The decision illustrates the SFC’s continued focus on financial reporting integrity, the gatekeeping role of auditors and director accountability.

First, the SFC remains willing to pursue Securities and Futures Ordinance (Cap. 571) section 214 proceedings where financial reporting misconduct is alleged, particularly where senior management is directly involved.

Secondly, attempts to manipulate or undermine the audit process are likely to be treated as a serious aggravating factor. The judgment reinforces the importance of maintaining the integrity of information provided to auditors, regulators and the market.

Thirdly, the case demonstrates the effectiveness of document-driven regulatory investigations. The SFC was able to use independently obtained banking records to test the accuracy of the Company’s accounting records and auditor materials. The decision illustrates the extent to which modern regulatory investigations are driven by documentary evidence and third-party records, allowing regulators to reconstruct transactions and challenge management explanations using independent sources.

See full judgment at HCMP 572/2022

[1] The Company’s shares were listed on the Growth Enterprise Market of The Stock Exchange of Hong Kong Limited on 11 November 2015 (former stock code: 8182). The listing of its shares was cancelled with effect from 31 December 2019.

Recent SFC disciplinary action highlights growing regulatory expectations regarding cybersecurity governance, operational resilience and incident preparedness.

Cybersecurity has traditionally been viewed as a technical function to be managed by information technology teams. Recent regulatory developments suggest that this perspective is no longer sufficient. The Securities and Futures Commission (“SFC“) is increasingly treating cyber resilience as a matter of governance, operational resilience and regulatory compliance, with clear expectations that senior management take active responsibility for managing cybersecurity risk.

The SFC’s recent disciplinary action against a licensed corporation following a ransomware attack provides a useful illustration of these expectations in practice. When considered together with the SFC’s broader cybersecurity initiatives and more recent guidance regarding AI-enabled cyberattacks, a clear regulatory trend emerges: firms will increasingly be judged not only on whether they suffer a cyber incident, but also on whether they have implemented adequate and effective cybersecurity controls, exercised appropriate oversight and demonstrated the resilience necessary to withstand and recover from cyber threats.

The lessons are relevant not only to licensed corporations, but also to asset managers, family offices and private wealth structures that increasingly rely on technology, remote access arrangements and third-party service providers.

A Recent Regulatory Reminder

The recent disciplinary action arose from a ransomware attack reported by a Hong Kong licensed corporation in September 2022. According to the SFC’s findings, a hacker exploited weaknesses in the firm’s remote access environment and disrupted the critical IT infrastructure, including file servers, email servers, domain controllers, trading application servers and accounting servers. Recovery took approximately three weeks.

During that period, clients were unable to access the firm’s internet platform and mobile trading application and could only place orders through account executives.

What makes the case particularly significant is what did not occur. The SFC expressly recorded that there was no evidence of unauthorised trading, client financial losses, misappropriation of client assets, leakage of client information or client complaints.

Nonetheless, the SFC publicly reprimanded the firm and imposed a financial penalty after concluding that its cybersecurity controls and governance arrangements were deficient and failed to comply with applicable regulatory requirements.

The case therefore demonstrates that disciplinary action may arise even where a cyber incident does not result in client loss. The regulator’s focus was on whether the firm had implemented and maintained adequate systems and controls and whether those deficiencies contributed to the firm’s inability to withstand and recover from the incident.

The SFC’s Focus on Resilience and Control Failures

A notable feature of the disciplinary action is that the SFC’s criticism was directed not simply at the occurrence of a ransomware attack, but at the firm’s lack of cyber resilience.

The investigation identified deficiencies in network security controls, user access and privileged account management, operating systems, antivirus protection, remote access arrangements, password management, cybersecurity awareness training and external device security.

The SFC found that these deficiencies contributed both to the firm’s inability to withstand the attack and to the severity of the resulting disruption. Particularly significant were the backup and recovery shortcomings. Daily backups were stored on external hard drives that were not consistently disconnected from the network, resulting in the backup files themselves being compromised during the incident. The firm’s business continuity plan also failed to adequately address ransomware and data-loss scenarios, significantly impeding recovery efforts.

The disciplinary action therefore sends a broader message: regulators are increasingly concerned with operational resilience and preparedness, not merely technical prevention.

Cyber Resilience Is an Increasing Supervisory Priority

The recent disciplinary action should not be viewed in isolation.

In September 2023, the SFC announced an industry-wide thematic cybersecurity review of selected licensed corporations, stating expressly that cybersecurity is a major focus of its supervision. The review examined cybersecurity governance, incident reporting, cloud security, remote access controls, technology lifecycle management and third-party technology vendor risks.

The SFC has consistently identified recurring weaknesses across the industry, including the use of end-of-life software, inadequate remote access controls, phishing vulnerabilities and weaknesses in third-party technology arrangements.

Notably, many of the deficiencies identified in the recent disciplinary action, including weaknesses relating to remote access, authentication controls, patch management and staff awareness, closely mirror risks highlighted by the SFC in its 2020 circular on remote working arrangements and 2025 thematic cybersecurity review report. This demonstrates that regulatory guidance may ultimately become the benchmark against which firms’ systems and controls are assessed.

More recently, the SFC has warned licensed firms about the growing risks posed by AI-enabled cyberattacks. According to the regulator, advances in AI are increasing both the sophistication and frequency of cyber threats while reducing the time available for firms to respond to vulnerabilities. In response, the SFC has, once again, emphasised patch management, access controls, monitoring, third-party oversight and incident response preparedness.

Viewed in this context, the recent disciplinary action appears less as an isolated enforcement case and more as part of a broader supervisory programme aimed at strengthening cyber resilience across the financial services industry.

Why This Matters Beyond the IT Department

A consistent theme across recent SFC publications is that cyber resilience is fundamentally a management responsibility.

The SFC’s 2017 guidelines on cybersecurity and related publications place responsibility on senior management for establishing cybersecurity frameworks, approving policies, allocating resources and overseeing contingency planning. The SFC has also expressly emphasised that senior management, including the Manager-in-Charge of Information Technology, bears ultimate responsibility for managing cybersecurity risks faced by licensed firms.

This reflects an increasingly common regulatory view that cyber resilience should be treated alongside operational risk, compliance and business continuity as a core governance issue.

Technical specialists remain essential. However, many of the matters highlighted by regulators extend beyond technology and into governance structures, management accountability, outsourcing arrangements, vendor contracts, incident reporting, escalation procedures, business continuity planning and regulatory compliance.

A recurring theme in recent SFC publications is the growing importance of third-party technology risk. Many firms rely heavily on cloud service providers, software vendors and managed service providers, yet outsourcing does not transfer regulatory responsibility. The SFC has repeatedly emphasised vendor due diligence, access controls, ongoing monitoring, concentration risk assessments and contractual incident-notification requirements.

An effective cyber resilience framework therefore requires coordination among management, compliance personnel, legal advisers and technical specialists.

What Family Offices Should Pay Attention To

Although family offices are generally not subject to the same regulatory framework as licensed corporations, many face similar risks. Industry publications suggest that family offices are increasingly targeted because they often hold substantial assets and sensitive information while operating with smaller teams and less formalised cybersecurity frameworks.

The threat landscape is also evolving beyond traditional hacking techniques. Family offices may be particularly vulnerable to business email compromise, payment instruction fraud, adviser impersonation, AI-enabled voice cloning and deepfake-enabled fraud.

Takeaways

The SFC’s recent cybersecurity enforcement action reinforces a broader regulatory message: cyber resilience is now fundamentally a governance issue. Technology controls remain important, but so do oversight, decision-making structures, incident preparedness and management accountability.

The disciplinary findings, viewed alongside the SFC’s remote working guidance, industry-wide cybersecurity reviews and more recent warnings concerning AI-enabled cyber threats, reveal an increasingly sophisticated supervisory framework focused on resilience, preparedness and accountability.

For licensed corporations, asset managers and family offices alike, the key question is no longer simply whether systems can prevent every cyber incident. Rather, it is whether the organisation can demonstrate that it has taken adequate and effective steps to manage cybersecurity risk, maintain resilience, respond effectively to incidents and recover in a manner consistent with emerging regulatory expectations.

This article discusses the SFC’s disciplinary action announced on 28 July 2026 concerning cybersecurity control deficiencies identified following a ransomware incident, together with related SFC cybersecurity guidance and supervisory publications. Readers may wish to review the original SFC materials for further details.

Further information: https://apps.sfc.hk/edistributionWeb/gateway/EN/news-and-announcements/news/doc?refNo=26PR118

The Stock Exchange of Hong Kong Limited (the “Exchange”) and/or the Securities and Futures Commission (the “SFC”) recently published various guidance concerning, among other things, (1) the regulatory reform relating to the Uncertificated Securities Market (“USM”), which is expected to be implemented on 16 November 2026, and (2) the launch of a new issuer communication platform, the HKEX Issuer Access Platform (“IAP”), in the fourth quarter of 2026.

1. Uncertificated Securities Market (USM) Regime

The Hong Kong USM regime aims to eliminate paper share certificates and facilitate the electronic holding and transfer of securities. At the core of the regime is the use of an Approved Securities Registrar (“ASR”), which will evidence and transfer securities through its Uncertificated Securities Registration and Transfer System, enabling investors to hold participating securities in uncertificated form directly in their own names and enjoy shareholder rights directly.

The key matters that listed issuers should note in relation to the USM regime are summarized below:

2.HKEX Issuer Access Platform (IAP)

The IAP is a new online communication platform established by the Exchange to unify regulatory filings, public submissions and two-way communications between listed issuers and the Exchange. A summary of the IAP is set out below.

The IAP will consolidate a wide range of functions. In general, the documentary filings and categories of approvals that users may submit and process through the IAP include, but are not limited to, the followings:

The issuer’s authorised representatives, relevant employees, professional advisers, printers and other market participants authorised by the issuer may register accounts on the IAP and conduct the relevant filings and communications through the platform.

Upon launch, the IAP will operate alongside the Electronic Submission System (“ESS”) and will assume the electronic form submission functions currently handled through ESS. In general, the IAP will become the primary platform through which issuers and their advisers handle Listing Rules compliance matters while also facilitating the publication of the relevant announcements and circulars (such as those relating to notifiable transactions and/or connected transactions) through its integration with the ESS.

The Exchange currently plans to launch the IAP in the fourth quarter of 2026. The registration and onboarding process will be conducted in phases:

• advisers may open accounts from July 2026; and
• issuers will be onboarded in phases from October 2026 to the second quarter of 2027, with each issuer receiving at least 12 weeks’ prior notice before transitioning to the platform.

Following completion of the transition to the IAP, the Exchange will introduce a redesigned market information page on its website, consolidating and displaying issuer information such as management details, corporate events and other key dates. Once issuers update their records, investors will be able to access updated information on an almost real-time basis, further enhancing market transparency.

For further information or advice regarding (1) the USM regulatory reforms, and (2) the  IAP, please do not hesitate to contact us.

Summary

In Li Yuhong v oOo Securities (HK) Group Ltd [2025] HKCFI 5270, the Hong Kong Court of First Instance found an investment adviser/asset manager liable for misrepresentation and multiple pre- and post-investment breaches of duty in connection with an investor’s subscription for unlisted corporate bonds.

The Court’s reasoning turned heavily on (i) the defendant’s conflicted “dual hat” role as both exclusive placing agent and discretionary asset manager, (ii) significant evidential gaps, and most notably, (iii) the defendant’s failure to call the relationship manager alleged to have made the key representations as a witness.

Key Facts

The plaintiff, a Mainland investor, sought Hong Kong residence under the Capital Investment Entrant Scheme (“CIES”). She initially invested in a comparatively lower-risk product. During the pre‑engagement period, the defendant’s relationship manager worked to build a relationship of trust with the family, and the defendant was appointed the exclusive placing agent of certain unlisted, non‑rated bonds issued by China Agroforestry Low‑Carbon Holding Company Limited (the “Issuer“) (the “Relevant Bonds”) in the value of HK$50 million, earning commission on placements .

The plaintiff was persuaded to switch her entire CIES investment into the Relevant Bonds through the defendant, acting as placing agent, for a total investment of HK$10.5 million. The parties also entered into a discretionary asset management agreement under which the defendant was to manage the bonds post-subscription, thereby earning additional management/performance fees.

The Issuer ultimately failed to redeem the bonds at maturity, and the plaintiff sustained an almost total loss.

Court’s findings

Adverse Inferences and Evidential Gaps

A decisive feature was the Court’s willingness to draw strong adverse inferences from missing witnesses and missing documents. The defendant did not call the former relationship manager alleged to have made the key representations as a witness; the Court described this omission as “critical if not fatal” and drew adverse inferences. The Court was also critical of the lack of contemporaneous internal records said to evidence portfolio monitoring and review.

Misrepresentation: “early redemption” and “low risk” assurances

The Court found that the defendant (through its relationship manager) made, and the plaintiff relied on, two central representations:

1. Early redemption: that the bonds could be redeemed early on notice; and
2. Low risk / safe investment: that default was unlikely.

On the “early redemption” representation, the Court regarded the contemporaneous Client Analysis Report as pivotal: it contained a purported early redemption term which did not appear in the bond terms and conditions. The Court rejected the suggestion that this was a mere “clerical error”. The plaintiff’s later email correspondence in December 2018, referring to the same 30‑day notice understanding, was treated as consistent with that representation and was not corrected by the defendant’s staff at the time.

As to the “low risk / safe investment” representation, the Court held it was inherently more probable that a relationship manager seeking to complete a large primary‑market placement would “paint a rosy picture” to induce the investment, and noted the absence of documentary evidence that the defendant ever warned the plaintiff that the Issuer was loss‑making. The defendant’s only factual witness ultimately accepted he had no basis to deny the representation was made.

The Court also accepted the plaintiff’s expert evidence that the Relevant Bonds were high risk and unsuitable for the plaintiff’s pleaded investment objective, noting features such as the Issuer’s weak financial position, lack of independent credit rating, illiquidity, and concentration risk.

Contractual wording did not provide a safe harbour

The defendant relied on non-reliance/exemption wording in the placing documentation to argue that the misrepresentation claim was contractually precluded. The Court rejected this in substance, emphasising that fraudulent misrepresentation is not readily excluded absent clear wording, and that in any event such clauses are susceptible to statutory control.

Separately, the Court considered the plaintiff’s inability to understand the English-only placing letter, the rushed signing process, and the absence of explanation or translation, and accepted a non est factum analysis in the circumstances to negate the effect of the defendant’s attempted contractual protections.

Post-investment management: monitoring failures, exit options, and conflicts

Once the bonds were held within a discretionary management structure, the Court found that the defendant owed contractual, common law, statutory and/or fiduciary duties as asset manager/trustee, including duties of reasonable care and skill, monitoring, and fiduciary no-conflict/no-profit obligations.

On the facts, the Court found no evidence of meaningful monitoring and held that the defendant had either delayed or simply ignored the plaintiff’s redemption requests. The Court noted that the defendant’s staff had even sought clarification from the Issuer on the early redemption procedure, with no documentary evidence showing any considered decision‑making.

Crucially, the Court held that the defendant failed to exercise, or even properly consider, contractual exit rights that could have materially improved the plaintiff’s position as risks crystallised.

Finally, the Court held that the defendant’s dual roles, earning placing commission as exclusive placing agent while also charging management/performance fees as discretionary asset manager, engaged and breached fiduciary no-conflict and no-profit duties in the absence of fully informed consent.

Practical takeaways

This is a rare case where an investor succeeded in her claim against her investment adviser/asset manager for misrepresentation and breaches of duty.

Taken together, this judgment highlights several important lessons. Investment advisors must remain vigilant to conflicts of interest when acting in dual capacities, and should not assume that broad non‑reliance or exemption clauses will protect them as those clauses may be found unreasonable or unconscionable.

While outcomes in investor claims remain highly fact-sensitive, this decision illustrates that courts will hold advisers and discretionary managers to exacting standards where the evidential record does not support the intermediary’s account of advice, monitoring and conflict management.

MinterEllison has extensive experience assisting investors with asset recovery and helping corporations manage and resolve complex disputes involving financial products, advisory relationships, and asset management arrangements. For further information, please contact our Dispute Resolution team.  

The full judgement can be accessed here: legalref.judiciary.hk/lrs/common/ju/ju_frame.jsp?DIS=175819&currpage=T

From January to April 2026, The Stock Exchange of Hong Kong Limited (the “Exchange”) published certain guidance covering, among other matters: (1) the uncertificated securities market (the “USM”); (2) revisions to the ongoing public float requirements; and (3) the appointment, removal and remuneration of auditors. This article summarises the key aspects of the relevant updates.

(1) Uncertificated Securities Market

The USM regime aims to abolish paper share certificates and enable the electronic holding and transfer of securities. The core feature of the USM is that, through the platforms operated by approved securities registrars (“ASR“) and connected to systems of Hong Kong Securities Clearing Company Limited, investors may hold prescribed securities (“Prescribed Securities“) directly in their own names in uncertificated form and enjoy shareholders’ rights directly. The Exchange and the Securities and Futures Commission currently expect the USM to be implemented on 16 November 2026 (“USM Implementation Date“), with the corresponding amendments to the Listing Rules taking effect upon the implementation of the relevant subsidiary legislations. The USM regime prescribes a five‑year phased mandatory transition, with an aim to enhance the operational efficiency and security of the securities market.

For new applicants of Prescribed Securities whose listing date falls after the USM Implementation Date, such securities must be issued in uncertificated form from the date of listing. Prescribed Securities of listed issuers will be required to become Participating Securities within the five‑year transition period from the USM Implementation Date. For listed issuers, there are certain preparatory steps which need to be completed at this stage, including (but not limited to):

Listed issuers are therefore recommended to engage with their ASRs and assess whether preparatory work (such as amendments to constitutional documents) should be commenced in advance, in order to facilitate a smooth transition to the USM regime.

(2) Revisions to the Ongoing Public Float Requirements

The Exchange has revised the ongoing public float requirements under the Listing Rules. The revised rules have taken effect since 1 January 2026, introducing new ongoing public float thresholds, disclosure obligations and the regulatory approach to public float shortfalls.

While the existing minimum 25% public float requirement applicable to issuers (which have no other classes of listed shares) (the “Initial Prescribed Threshold“) will remain effective, the revised regime introduces an alternative threshold for compliance purpose. Under the alternative threshold, an issuer must ensure that the portion of the class of shares an issuer has listed on the Exchange that is held by the public must, at all times:

1. have a market value of at least HK$1 billion; and
2. represent at least 10% of the issuer’s total number of issued shares in the class of shares listed (excluding treasury shares) (“Alternative Threshold“).

An issuer which intends to adopt the Alternative Threshold is required to publish an announcement as soon as practicable, containing the reasons for the change and a statement setting out the market value and percentage of its public float as at the latest practicable date.

For A+H share issuers, the revised rules replace the former aggregate threshold for both A and H shares with bespoke ongoing public float requirements for H shares. Under the new regime, at all times, the issuer’s H shares listed on the Exchange and held by the public must either:

1. have a market value of at least HK$1 billion (calculated by reference to the volume‑weighted average price over the previous 125 trading days); or
2. represent at least 5% of the total number of issued H shares (excluding treasury shares).

In addition to the longstanding requirement to confirm sufficient public float in annual reports, the revised regime introduces ongoing disclosure requirements at both monthly return and annual report levels, summarised below:

The revised regime also removes automatic suspension solely due to a public float shortfall and adopts a disclosure‑ and remedial‑based approach.

For all issuers with a public float shortfall:

1. an initial announcement (“Initial Announcement“) must be published within one business day after the issuer becomes aware of the shortfall, disclosing the non‑compliance and relevant public float information;
2. where a restoration plan and expected timeline cannot be finalised for inclusion in the Initial Announcement, a subsequent announcement must be published within 15 business days thereafter;
3. while the shortfall persists, subsequent monthly announcements must be published to update the market on the status and progress of the restoration plan; and
4. unless exceptional circumstances apply (e.g. privatisation or compliance with court orders), the issuer and its directors (and supervisors, where applicable) must not take actions that would further reduce the public float.

For issuers with a Significant Public Float Shortfall (as defined under Rule 13.32F of the Listing Rules), additional requirements apply, including:

1. the publication of an announcement within one business day upon becoming aware of a Significant Public Float Shortfall;
2. the addition of the stock marker “‑PF” to the issuer’s listed shares, until compliance is restored;
3. the inclusion of an appropriate warning statement in all announcements and documents required to be published by the Listing Rules; and
4. delisting if the issuer fails to re‑comply with the applicable ongoing public float requirement within 18 months (or 12 months for GEM issuers).

(3) Latest FAQs on the Appointment, Removal and Remuneration of Auditors

The Exchange has also updated FAQ16 – No.5 to provide further clarification on the core shareholder protection standards relating to the appointment, removal and remuneration of auditors under paragraph 17 of Appendix A1 to the Listing Rules.

Under the relevant guidance, a listed issuer must ensure that the appointment, removal and remuneration of its auditors are approved by a majority of shareholders, or by another body that is independent of the board of directors. The Exchange has confirmed that, where a listed issuer’s constitutional documents:

• permit the board of directors to appoint an auditor to fill a casual vacancy, with such appointment lasting only until the next annual general meeting; and
• provide that the auditor’s remuneration is approved by ordinary resolution at a general meeting, or determined in the manner specified in such a shareholders’ resolution,

such arrangements will generally be regarded as meeting the core shareholder protection standards, provided they are consistent with the applicable provisions of the Companies Ordinance (Cap. 622) (or the equivalent provisions in the issuer’s constitutional documents and domestic laws).

In addition, to ensure that the appointment or re‑appointment of auditors is considered through due process, the Exchange has indicated that the relevant circular should disclose the estimated audit fee agreed with the auditor for the audit services for the relevant reporting period (whether as a fixed amount or a fee range), together with an explanation of the basis of determination and key assumptions adopted.

Importantly, the Exchange has emphasised that a listed issuer must not request or take any action to cause an auditor to resign without first obtaining shareholders’ approval at a general meeting, as such request or action may be regarded as a removal of the auditor under the Listing Rules. The Exchange has further cautioned that pressuring an existing auditor to materially reduce previously agreed audit fees, whether directly or by reference to lower quotes from other auditors, may be regarded as indirectly causing an auditor’s resignation in lieu of shareholders’ approval.

For further information or advice regarding the above, please do not hesitate to contact us.