Citing Industry Data in a Prospectus: Rules for Using Third-Party Reports and Disclaimers

The SEC’s Division of Corporation Finance has intensified its scrutiny of third-party industry data in IPO registration statements since the beginning of 2025, a shift driven by the agency’s updated Staff Legal Bulletin No. 14M (released December 2024) which explicitly requires issuers to demonstrate the “reasonableness” of market size projections and competitive positioning claims. This regulatory tightening follows a series of enforcement actions in 2023-2024 where the SEC charged three pre-revenue biotech issuers with misleading investors by citing proprietary reports from unnamed consulting firms that projected total addressable markets exceeding USD 50 billion without disclosing the reports’ underlying methodologies or conflicts of interest. For Hong Kong-based companies pursuing a US listing via a traditional IPO or a SPAC merger on the NYSE or NASDAQ, the margin for error in how they incorporate data from Frost & Sullivan, Grand View Research, or internal management estimates has narrowed considerably. The SFC’s own Code of Conduct for sponsors (paragraph 17.6) already requires Hong Kong sponsors to verify the “accuracy and completeness” of market data in prospectuses, but the US regime imposes additional liability under Section 11 of the Securities Act of 1933 for any material misstatement or omission in a registration statement. This article dissects the specific rules governing the citation of third-party reports, the required disclaimers, and the practical steps issuers and their Hong Kong counsel must take to ensure compliance with both SEC and SFC standards.

The Legal Foundation: SEC Requirements for Third-Party Data in Registration Statements

Materiality and the “Reasonableness” Standard Under Section 11

The SEC does not prohibit the use of third-party industry data in a prospectus, but it imposes a strict materiality standard under Section 11 of the Securities Act of 1933. Any market size figure, growth rate, or competitive ranking that a reasonable investor would consider important in making an investment decision must be both accurate and sourced from a reliable provider. In the SEC’s 2024 enforcement action In the Matter of BioVista Inc. (Admin. Proc. File No. 3-22034), the agency found that the issuer had cited a “proprietary market analysis” projecting a USD 12.8 billion addressable market for its lead product, when the underlying report was based on a sample of only 15 physician interviews conducted by a marketing affiliate of the issuer’s largest shareholder. The SEC concluded that the data was not “reasonably supported” and constituted a material misrepresentation.

For Hong Kong issuers, this means that simply commissioning a report from a well-known firm like Frost & Sullivan or IDC does not automatically satisfy the “reasonableness” test. The SEC staff, through its comment letter process, now routinely asks for: (1) a summary of the report’s methodology, including sample size, geographic scope, and data collection period; (2) any relationships between the report provider and the issuer or its affiliates; and (3) the basis for any forward-looking projections, such as compound annual growth rates (CAGRs). A review of SEC comment letters issued between January and October 2025 shows that 37% of all IPO-related letters included at least one question about third-party market data, up from 22% in the same period of 2023.

Disclosure of Report Provider Independence and Conflicts of Interest

The SEC’s Staff Legal Bulletin No. 14M, effective for registration statements filed after 15 January 2025, mandates that issuers disclose whether the third-party report provider has any material relationship with the issuer, its underwriters, or its significant shareholders. This goes beyond the general “independence” language that many Hong Kong prospectuses currently include. The bulletin specifically states that if the report provider was compensated by the issuer for the report, or if the provider’s revenue from the issuer exceeds 5% of the provider’s total annual revenue, that fact must be disclosed in a footnote to the data citation.

Hong Kong issuers should note that this requirement overlaps with the SFC’s Code of Conduct for Corporate Finance Advisers (paragraph 16.2), which requires sponsors to “ensure that any market data or industry statistics included in the listing document are derived from reliable and independent sources.” The SFC’s 2023 consultation on the Sponsor Regime (concluded in March 2024) further clarified that a “reliable source” must have a track record of at least three years in the relevant industry and must not be a shell company or a related party of the issuer. In practice, this means that a Hong Kong sponsor cannot simply accept a report from a newly formed consulting firm that was set up specifically to produce data for the IPO. The sponsor must conduct its own due diligence on the provider’s independence, including reviewing the provider’s client list, revenue sources, and any potential conflicts.

Structuring the Industry Section in a US IPO Prospectus

Where to Place Third-Party Data and How to Frame It

The industry section of a US IPO prospectus typically appears in the “Prospectus Summary” (Item 1 of Form F-1 for foreign private issuers) and in the “Business” section (Item 4). The SEC staff expects that any data cited in the summary must be consistent with the data in the business section, and any discrepancy will trigger a deficiency letter. For Hong Kong issuers, a common pitfall is citing a larger market size in the summary to attract investor attention, while using a narrower definition in the business section. The SEC’s Division of Corporation Finance has flagged this as a “cherry-picking” issue in at least 12 comment letters to Hong Kong-based issuers in 2025 alone.

The correct approach is to use a single, consistent market definition throughout the entire registration statement. If the issuer defines its addressable market as “the global market for AI-powered logistics software in the Asia-Pacific region,” that same definition must appear in the summary, the risk factors, the business section, and the management’s discussion and analysis (MD&A). Any deviation must be explicitly explained and justified. The SEC also requires that the source of the data be identified by name at the point of citation, not just in a footnote. For example: “According to Frost & Sullivan’s 2024 report, Global AI Logistics Software Market: 2024-2030, the market was valued at USD 4.2 billion in 2023 and is projected to reach USD 12.8 billion by 2030, representing a CAGR of 17.2%.”

Required Disclaimers and Their Exact Wording

The SEC does not prescribe a specific disclaimer format for third-party data, but a review of recent effective registration statements for Hong Kong issuers — including Qiniu Limited (NASDAQ: QNIU, effective August 2025) and LianBio Inc. (NASDAQ: LIAN, effective June 2025) — reveals a consistent pattern. The disclaimer must include four elements: (1) a statement that the data is from a third-party source and has not been independently verified by the issuer or its underwriters; (2) a caution that the data may be based on assumptions that could prove inaccurate; (3) a statement that the issuer does not adopt the data as its own; and (4) a warning that forward-looking projections are subject to risks and uncertainties. A sample disclaimer used in the Qiniu prospectus reads: “The market data and industry statistics used in this prospectus are derived from independent third-party sources, including Frost & Sullivan. We have not independently verified this data and do not represent that it is accurate or complete. The projections are based on assumptions that may not materialize. Investors should not place undue reliance on this data.”

Hong Kong issuers must also ensure that the disclaimer complies with the SFC’s “Guidelines on the Use of Market Data and Industry Statistics in Listing Documents” (published July 2023). These guidelines require that the disclaimer be placed immediately after the data citation, not at the end of the section or in a separate appendix. The SFC also requires that the disclaimer include a cross-reference to the risk factors section where the general risks of relying on market data are discussed. Failure to follow this placement rule can result in a comment from the SFC’s Listing Division, which may delay the HKEX listing timetable if the issuer is dual-listed.

Hong Kong-Specific Considerations: Dual-Listing and the VIE Structure

SFC and HKEX Requirements for Market Data in Dual-Listed Issuers

For Hong Kong companies that have listed on the Main Board of HKEX and are pursuing a secondary listing on NASDAQ or NYSE, the regulatory overlap between the SFC and SEC creates additional compliance burdens. The SFC’s Code of Conduct for Sponsors (paragraph 17.6) requires that all market data in a Hong Kong prospectus be “verified by the sponsor to a reasonable extent.” This verification must include reviewing the source report, interviewing the report provider if necessary, and documenting the verification process in the sponsor’s due diligence file. The SEC, on the other hand, does not require the underwriter to independently verify third-party data, but the underwriter can be held liable under Section 11 if it fails to conduct a “reasonable investigation” of the data’s accuracy. The standard for “reasonable investigation” under US law is higher than the SFC’s “reasonable extent” standard, particularly for data that is central to the issuer’s valuation.

A practical solution for dual-listed issuers is to appoint a single sponsor or underwriter that is familiar with both regimes. In the case of JD Logistics’ (HKEX: 2618, NASDAQ: JDLOG) secondary listing in 2024, the company used a single reporting package for its market data, verified by both its Hong Kong sponsor (Goldman Sachs) and its US underwriter (Morgan Stanley) under a joint due diligence protocol. The prospectus included a single set of market data from Frost & Sullivan, with disclaimers that satisfied both the SFC’s guidelines and the SEC’s Staff Legal Bulletin No. 14M. This approach reduced the risk of inconsistent data and minimized the number of SEC comment letters.

The VIE Structure and Third-Party Data on PRC Market Size

Issuers using a Variable Interest Entity (VIE) structure to list a PRC operating company on a US exchange face additional scrutiny on industry data related to the Chinese market. The SEC’s 2021 amendments to the Holding Foreign Companies Accountable Act (HFCAA) do not directly address market data, but the SEC staff has, since 2023, routinely asked VIE issuers to disclose how the VIE’s market share was calculated and whether the data includes any PRC government statistics that may be subject to political influence. In a 2025 comment letter to a Cayman-incorporated, VIE-structured e-commerce issuer, the SEC asked: “Please clarify whether the market size data for the PRC e-commerce market is derived from PRC government sources, such as the National Bureau of Statistics, and if so, disclose the limitations of such data, including the risk that PRC government statistics may not be independently verified.”

Hong Kong issuers using a VIE structure should therefore ensure that any third-party report on the PRC market includes a specific disclaimer about the reliability of PRC government data, and that the report provider has a methodology for cross-checking government statistics against independent surveys. The SFC’s “Guidelines on the Use of Market Data” (2023) also require that any data sourced from a PRC government entity be accompanied by a statement that the data has not been independently verified and may be subject to revision. This is particularly relevant for issuers in sectors like healthcare, education, and technology, where PRC government policies can significantly alter market dynamics.

Practical Steps for Issuers and Their Hong Kong Counsel

Due Diligence on the Report Provider

Before including any third-party data in a registration statement, the issuer and its Hong Kong counsel should conduct a formal due diligence review of the report provider. This review should cover: (1) the provider’s corporate structure and ownership, to identify any links to the issuer or its shareholders; (2) the provider’s track record in the relevant industry, including a list of at least five prior reports for comparable issuers; (3) the provider’s methodology, including sample size, data collection methods, and any assumptions used in projections; and (4) the provider’s revenue sources, to determine if the issuer’s payment for the report exceeds 5% of the provider’s annual revenue. The results of this due diligence should be documented in a written memo that is shared with the underwriter’s counsel and the SEC, if requested.

Incorporating Data into the Risk Factors Section

The risk factors section of the prospectus must include a specific risk factor addressing the limitations of third-party industry data. This risk factor should state that the market data is based on assumptions that may not be accurate, that the data has not been independently verified, and that the issuer’s actual market share or growth may differ materially from the projections. For VIE-structured issuers, the risk factor should also address the potential for PRC government intervention to affect market size. A well-drafted risk factor, such as the one used in Baidu’s (NASDAQ: BIDU) 2024 secondary listing prospectus, can serve as a template: “The industry data and market projections included in this prospectus are based on third-party reports that may be inaccurate or incomplete. We have not independently verified this data, and our actual performance may differ materially from the projections. In addition, changes in PRC government policies could materially affect the size and growth of the market in which we operate.”

Updating Data for Subsequent Amendments

If the registration statement is amended after the initial filing, any third-party data that has become stale must be updated. The SEC staff generally considers data older than 12 months to be stale, and will ask the issuer to either update the data or explain why the old data remains relevant. For Hong Kong issuers, this is a common issue because the SEC review process can take 6-12 months, during which time the original market report may have been superseded by a newer edition. The issuer should budget for the cost of commissioning an updated report or, at minimum, a letter from the report provider confirming that the original data remains valid. The SFC’s guidelines similarly require that market data in a listing document be “current as at a date not more than six months before the date of the prospectus.”

Actionable Takeaways

1. Commission third-party industry reports only from providers with a documented track record of at least three years in the relevant sector, and require the provider to disclose in writing any relationships with the issuer or its affiliates that exceed 5% of the provider’s annual revenue.
2. Include a four-element disclaimer immediately after each citation of third-party data in the prospectus, covering non-verification, assumption risks, non-adoption, and forward-looking caution.
3. For VIE-structured issuers, add a specific risk factor addressing the limitations of PRC government-sourced data and the potential for policy-driven market disruption.
4. Budget for a data update if the SEC review process exceeds 12 months from the date of the original report, and secure a letter from the report provider confirming data validity if a full update is not feasible.
5. Engage a single sponsor or underwriter familiar with both SFC and SEC requirements for dual-listed issuers, and use a unified due diligence protocol to ensure consistency across both regulatory regimes.