Corporate Compliance Programmes and Internal Investigations in Hong Kong: Legal Framework and Best Practices

Introduction

Corporate compliance has become a strategic priority for companies operating in Hong Kong across a wide range of industries. Increasing regulatory complexity, heightened enforcement activity by Hong Kong authorities, and growing demands from international business partners and investors have made robust compliance programmes a business necessity rather than merely a legal precaution.

This article examines the key elements of effective corporate compliance programmes in Hong Kong, with particular focus on bribery and corruption compliance under the Prevention of Bribery Ordinance, the conduct of internal investigations, whistleblowing frameworks, and best practices for managing regulatory investigations.

The Regulatory Environment for Corporate Compliance in Hong Kong

Key Legislation and Enforcement Bodies

Companies operating in Hong Kong face compliance obligations across multiple regulatory domains. The most significant include:

• Anti-bribery and corruption: The Prevention of Bribery Ordinance (Cap. 201) ("POBO") and the Independent Commission Against Corruption ("ICAC") represent the primary anti-corruption legal framework and enforcement body in Hong Kong
• Anti-money laundering: The Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) ("AMLO") imposes AML/CFT obligations on financial institutions, designated non-financial businesses, and virtual asset service providers
• Securities regulation: The Securities and Futures Commission ("SFC") enforces market misconduct and insider dealing provisions of the Securities and Futures Ordinance (Cap. 571)
• Competition law: The Competition Commission enforces prohibitions on anti-competitive agreements and abuse of substantial market power under the Competition Ordinance (Cap. 619)
• Data privacy: The Office of the Privacy Commissioner for Personal Data ("PCPD") enforces data protection obligations under the Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO")

Cross-Border Enforcement Considerations

Hong Kong companies with overseas operations or international counterparties must also consider the extraterritorial reach of foreign anti-corruption and compliance regimes, including the UK Bribery Act 2010, the US Foreign Corrupt Practices Act ("FCPA"), and equivalent legislation in other jurisdictions. The international compliance obligations of Hong Kong-headquartered multinationals are frequently more demanding than those arising under Hong Kong law alone.

Building an Effective Compliance Programme

Tone at the Top

An effective compliance programme begins with genuine commitment from senior leadership. Where directors and senior management treat compliance as a cultural priority rather than a procedural obligation, compliance standards permeate the organisation more effectively. Board-level oversight of compliance, including regular reporting on compliance risks and programme effectiveness, is a hallmark of best-practice governance.

Risk Assessment

A targeted compliance programme should be built on a documented risk assessment that identifies the specific legal and regulatory risks relevant to the company's business model, industries, geographies, customer base, and third-party relationships. Risk assessment outputs should drive the prioritisation of compliance resources, with heightened controls applied to high-risk areas such as government interactions, hospitality and gifts, third-party intermediaries, and high-risk jurisdictions.

Policies and Procedures

Core compliance policies for Hong Kong companies typically include:

• Anti-bribery and anti-corruption policy (addressing the POBO and any applicable foreign anti-corruption laws)
• Gifts, entertainment, and hospitality policy
• Conflicts of interest policy
• Third-party due diligence policy and procedures
• Whistleblowing and speak-up policy
• Data privacy policy (PDPO compliance)
• Competition law compliance policy (where relevant)

Policies should be clear, accessible, tailored to the company's actual operations, and reviewed and updated periodically to reflect legal and regulatory developments.

Training and Communication

Compliance policies are only effective if the relevant employees understand their obligations. Regular, role-specific compliance training is essential, with particular focus on employees in higher-risk functions such as sales, procurement, government affairs, and finance. Training should be documented to demonstrate completion and understanding.

Third-Party Due Diligence

Third-party intermediaries, agents, joint venture partners, and distributors represent a significant source of compliance risk, as companies can face liability for corrupt acts committed by third parties acting on their behalf. Effective third-party due diligence involves pre-engagement screening, ongoing monitoring, contractual compliance representations, audit rights, and termination provisions.

Internal Investigations

Triggers for Internal Investigations

Internal investigations may be triggered by a wide range of events, including whistleblower reports through internal or external channels, regulatory enquiries or document requests from the ICAC, SFC, Competition Commission, or other authorities, media reports or public allegations, audit findings or financial anomalies, and M&A due diligence discoveries.

A prompt, well-structured internal investigation serves multiple purposes: it enables the company to understand the facts before responding to regulators, preserves legal privilege over privileged communications and work product, identifies responsible individuals, and demonstrates the company's commitment to compliance and self-remediation.

Privilege Considerations

Legal professional privilege is a critical consideration in internal investigation planning. In Hong Kong, communications between a client and its legal advisers that are made for the dominant purpose of obtaining legal advice, or in anticipation of litigation, are protected by legal professional privilege. This means that investigation reports, interview memoranda, and other work product prepared under the supervision of external legal counsel may be protected from disclosure to regulators or in litigation.

Preserving privilege requires careful structuring of the investigation engagement: external lawyers should lead the investigation, internal HR or compliance teams should be involved under legal direction, and communications should clearly be directed to legal counsel for the purpose of obtaining advice. Privilege may be lost through inadvertent disclosure or waiver, and companies should seek legal advice on privilege management at the outset of any significant investigation.

Evidence Preservation

When an investigation is triggered, companies should implement prompt measures to preserve potentially relevant evidence. This includes issuing a legal hold notice suspending routine document deletion policies, identifying and securing electronic data, and ensuring key witnesses are aware of preservation obligations. Failure to preserve evidence can result in adverse inferences in regulatory proceedings or litigation.

Conducting Interviews

Employee interviews are a central component of most internal investigations. Key considerations include:

• Whether the interviewee is represented by separate legal counsel (particularly for senior employees or potential subjects of the investigation)
• Providing the "Upjohn warning" or equivalent notice to interviewees that the investigating lawyers represent the company, not the individual, and that privilege belongs to the company
• Documenting interviews through counsel notes (preserving privilege) rather than formal transcripts
• Managing the risk of tip-off to external parties or obstruction of parallel regulatory investigations

Regulatory Cooperation and Self-Reporting

Where an internal investigation reveals potential regulatory violations, companies face a difficult decision regarding whether and when to self-report to relevant authorities. Self-reporting can result in significant benefits including reduced penalties, more favourable settlement terms, and demonstration of remediation commitment. However, self-reporting also waives certain defences and can trigger parallel investigations by other regulators or jurisdictions.

In Hong Kong, the ICAC, SFC, and Competition Commission each have their own cooperation policies and self-reporting incentives. Legal advice should be obtained before any self-reporting decision to ensure a fully informed assessment of the risks and benefits.

Whistleblowing Frameworks

Effective whistleblowing mechanisms are a best-practice element of compliance programmes, enabling employees to report concerns confidentially without fear of retaliation. Key features of an effective whistleblowing framework include:

• Multiple reporting channels (internal hotline, external third-party hotline, email, direct report to board or audit committee)
• Guaranteed confidentiality or anonymity options
• Clear anti-retaliation protections and consequences for retaliation
• Prompt acknowledgment and investigation of reports
• Feedback to whistleblowers on investigation outcomes (where appropriate)

Hong Kong does not yet have a comprehensive whistleblower protection law equivalent to those in the US or UK. However, certain sector-specific protections exist (e.g., for reporting of money laundering suspicions), and companies should implement contractual and policy-based protections as a matter of best practice.

How Alan Wong LLP Can Assist

Alan Wong LLP advises companies on all aspects of corporate compliance and internal investigations in Hong Kong. Our services include compliance programme design and review, POBO and AML/CFT compliance advisory, internal investigation management and oversight, privilege analysis and preservation strategy, regulatory engagement and self-reporting advice, and employee interview and investigation support.

Our team combines regulatory expertise with practical investigative experience to help companies manage compliance risks proactively and respond effectively when issues arise. We advise clients across a wide range of industries, from financial services and technology to manufacturing and professional services.

Contact us to discuss how we can assist with your corporate compliance or internal investigation needs.