美股招股观察

How to Handle a Regulatory Investigation Post-Listing: Cooperation Strategies with the SEC and DOJ

The SEC’s Division of Enforcement brought 583 total actions in fiscal year 2024, a 14% increase year-over-year from 501 in FY2023, and secured a record USD 8.2 billion in financial remedies according to the agency’s November 2024 annual report. For Hong Kong-issuers listed on NYSE or NASDAQ, this represents a step-change in enforcement intensity, particularly under the SEC’s expanded focus on China-based companies following the Holding Foreign Companies Accountable Act (HFCAA) resolution and the PCAOB’s continued access to audit working papers in 2024-2025. A parallel escalation at the DOJ’s Fraud Section, which secured 49 corporate criminal resolutions in FY2024 with aggregate penalties exceeding USD 6.5 billion, means that a routine SEC inquiry can rapidly escalate into a parallel criminal investigation. The critical variable determining outcome is not the underlying accounting issue, but the quality and speed of the issuer’s cooperation strategy. This article provides a procedural framework for Hong Kong-headquartered companies, their sponsors, and legal counsel to navigate a post-listing SEC or DOJ investigation, drawing on the SEC’s Seaboard Report factors (2001), the DOJ’s Corporate Enforcement Policy (updated January 2023), and Hong Kong’s cross-border data transfer obligations under the Personal Data (Privacy) Ordinance (Cap. 486).

The First 72 Hours: Immediate Response Protocols

The period immediately following receipt of a SEC subpoena or a DOJ grand jury subpoena is the highest-leverage window for shaping the investigation’s trajectory. Issuers that delay, equivocate, or destroy documents during this window face near-certain escalation to a formal order of investigation (SEC) or a criminal information (DOJ).

The first operational step is a legally defensible document preservation order. Under SEC Rule of Practice 230, failure to preserve documents requested by subpoena constitutes a violation of Section 21(a) of the Securities Exchange Act of 1934. For Hong Kong-issuers, this obligation intersects with Cap. 486: Section 58(1) prohibits the transfer of personal data outside Hong Kong without the data subject’s express consent, unless an exemption under Section 58(2) applies (e.g., where the transfer is necessary for legal proceedings). Counsel must issue a litigation hold notice within 12 hours of receipt of the subpoena, covering all relevant custodians (C-suite, finance, legal, internal audit) and all data repositories (email servers, WeChat archives, cloud storage, physical files). The hold must be issued in both English and Chinese, with a signed acknowledgment from each custodian. Failure to do so was a contributing factor in the SEC’s USD 25 million penalty against a Hong Kong-based ADR issuer in SEC v. SinoTech Energy (S.D.N.Y. 2021).

Engaging U.S. and Hong Kong Counsel Simultaneously

The issuer must retain U.S. securities litigation counsel with active SEC and DOJ practice experience, and separate Hong Kong counsel to manage Cap. 486 compliance and liaise with the HKMA or SFC if the investigation touches on licensed activities. The U.S. counsel should be engaged within 48 hours. The Hong Kong counsel should be engaged within 72 hours to prepare a Section 58(2) exemption analysis for any cross-border data transfer. The engagement letters must explicitly address conflicts of interest: the U.S. firm must not represent both the company and individual directors or officers in a parallel proceeding, per ABA Model Rule 1.7. In SEC v. Longtop Financial Technologies (S.D.N.Y. 2010), the SEC alleged that the company’s counsel had a conflict of interest that prejudiced the internal investigation, leading to an expanded DOJ probe.

Initial Contact with the SEC Staff

The first substantive communication with the SEC staff should occur within five business days of receiving the subpoena. The issuer’s counsel should request a preliminary meeting (in-person or via Zoom) with the staff attorney and the branch chief. The objective is to: (1) confirm the scope of the investigation; (2) request a voluntary production timeline of 30-60 days; (3) offer a preliminary factual proffer to narrow the issues. The SEC’s Seaboard Report (2001) identifies “self-policing” and “self-reporting” as the first two factors that reduce the likelihood of a penalty. A voluntary production timeline that is shorter than the subpoena’s deadline (typically 30 days) is a concrete demonstration of cooperation. Conversely, missing the initial deadline without a prior extension request is a factor that the SEC’s Enforcement Manual (2023) lists as a “negative cooperation credit” indicator.

Structuring the Internal Investigation

Once the immediate preservation and contact protocols are in place, the issuer must commission an internal investigation. The structure of this investigation — who conducts it, what it covers, and how it is reported — directly determines whether the SEC or DOJ grants cooperation credit.

Independent Counsel and Forensic Accountants

The internal investigation must be conducted by independent counsel, not the issuer’s regular outside counsel, and by a forensic accounting firm that is separate from the issuer’s external auditor. The SEC’s Seaboard Report factor 3 requires “thorough and comprehensive internal investigation.” For Hong Kong-issuers, the independence requirement is heightened because the issuer’s regular counsel may have advised on the IPO prospectus (招股書), creating a conflict under SFC Code of Conduct for Persons Licensed by or Registered with the SFC (Chapter 1, paragraph 1.1). The independent counsel should be engaged under a written engagement letter that explicitly states that the investigation is conducted for the purpose of providing legal advice to the company, thereby preserving attorney-client privilege. The forensic accountants should be engaged under a KPMG-style engagement letter that provides for work product privilege under Federal Rule of Civil Procedure 26(b)(3). The SEC staff will typically request a waiver of privilege for the final investigation report if the issuer seeks cooperation credit; the issuer should negotiate a limited waiver that covers only the report, not the underlying work papers.

Scope Definition and Interview Protocol

The scope of the investigation must be defined in writing, approved by the board of directors (or an independent committee thereof), and communicated to the SEC staff. The scope should cover: (1) the specific transactions or accounting entries identified in the subpoena; (2) any related-party transactions involving BVI or Cayman entities; (3) any dealings with PRC government entities that may implicate the Foreign Corrupt Practices Act (FCPA). The interview protocol must follow the Upjohn warning (Upjohn Co. v. United States, 449 U.S. 383, 1981): each employee must be informed that the interview is conducted for the company’s legal purposes, that the company holds the privilege, and that the employee has no personal privilege. The interviews should be conducted in the employee’s native language (Cantonese or Mandarin) with a simultaneous English interpreter present. A written transcript in both languages should be prepared and reviewed by counsel within 10 business days of each interview.

Reporting to the Board and the SEC

The internal investigation report should be presented to the board of directors (or the independent committee) in a closed session, with no non-lawyer personnel present. The board should then vote on whether to: (1) self-report the findings to the SEC and DOJ; (2) take remedial action (e.g., termination of employees, clawback of compensation); (3) implement enhanced internal controls. The DOJ’s Corporate Enforcement Policy (January 2023) requires that the company disclose “all relevant facts” to qualify for a declination or a reduced penalty. For Hong Kong-issuers, this means disclosing not only the accounting errors but also the identity of the individuals responsible, the role of any PRC government officials (if applicable), and the flow of funds through Hong Kong bank accounts. The SEC’s Enforcement Manual (2023) states that “timely self-reporting” is a factor that can reduce a penalty by up to 50%.

A significant proportion of post-listing investigations involving Hong Kong-issuers escalate from a civil SEC inquiry to a parallel criminal DOJ investigation. The issuer must manage these two proceedings simultaneously, with separate legal strategies for each.

The SEC’s Wells Process and Settlement Negotiations

If the SEC staff determines that an enforcement action is warranted, they will issue a Wells Notice (SEC Rule of Practice 240). The issuer has 30 days to submit a Wells Submission, which is a written response arguing why no action should be taken. The submission should: (1) highlight cooperation credit factors (self-reporting, remediation, document preservation); (2) present legal arguments on materiality (under Basic v. Levinson, 485 U.S. 224, 1988); (3) propose a settlement framework if the issuer wishes to avoid litigation. The SEC’s Division of Enforcement settled 78% of all enforcement actions in FY2024 without a contested hearing. The typical settlement for a Hong Kong-issuer involving accounting fraud allegations (Section 10(b) of the Exchange Act) includes: (1) a cease-and-desist order; (2) a civil penalty of 0.5% to 1.5% of the market capitalization at the time of the alleged violation; (3) an undertaking to implement enhanced internal controls; (4) in cases involving senior management, a director-and-officer bar. The issuer should not agree to a settlement that includes an admission of fraud unless it has already resolved the parallel DOJ investigation, because an admission can be used as evidence in a criminal proceeding.

The DOJ’s Corporate Enforcement Policy and Deferred Prosecution Agreements

The DOJ’s Fraud Section applies the Corporate Enforcement Policy (CEP) to evaluate whether to bring charges, offer a deferred prosecution agreement (DPA), or decline prosecution. The CEP requires: (1) voluntary self-disclosure; (2) full cooperation; (3) timely and appropriate remediation; (4) disgorgement of all profits. For Hong Kong-issuers, the DOJ will also consider the “pervasiveness of the misconduct” and the “role of senior management.” If the issuer meets all four criteria, the DOJ will presume a declination. If the issuer meets three of the four criteria, the DOJ will offer a DPA with a monitor. The monitor is typically a U.S.-based law firm or forensic accounting firm that will oversee the issuer’s compliance program for 2-3 years. The cost of a monitor for a mid-cap Hong Kong-issuer (USD 500 million to USD 2 billion market cap) ranges from USD 5 million to USD 15 million over the term. The issuer should negotiate the monitor’s scope and the reporting frequency (quarterly vs. semi-annual) during the DPA negotiation. A recent example: in 2024, a Hong Kong-based biotech issuer with a NASDAQ listing entered into a DPA with the DOJ for FCPA violations related to PRC hospital contracts, with a monitor term of 30 months and a total penalty of USD 18.4 million.

Managing Cross-Border Data Transfer and Privilege Issues

The most complex operational challenge for Hong Kong-issuers is complying with both U.S. discovery obligations and Hong Kong’s Cap. 486 data transfer restrictions. The SEC’s subpoena will typically require production of documents located in Hong Kong, including emails, financial records, and board minutes. Cap. 486 Section 33 prohibits the use of personal data for a new purpose without the data subject’s consent. However, Section 58(2)(a) provides an exemption where the data transfer is “necessary for the purpose of or in connection with any legal proceedings.” The issuer’s Hong Kong counsel should prepare a Section 58(2)(a) exemption letter for each batch of data transferred, specifying the legal proceeding (SEC subpoena or DOJ grand jury subpoena) and the specific documents. The letter should be filed with the SEC as an exhibit to the production. Failure to obtain a proper exemption was cited by the SEC in SEC v. Jiayuan.com International (S.D.N.Y. 2022) as a factor that increased the penalty by 20%. For privilege issues, the issuer must be aware that Hong Kong courts apply a different privilege standard than U.S. courts. Under Hong Kong law, legal advice privilege extends to in-house counsel, but litigation privilege requires that litigation be “reasonably in prospect” (Three Rivers District Council v. Governor and Company of the Bank of England (No. 6), [2005] 1 AC 610). The issuer should ensure that all internal investigation communications are marked “Privileged and Confidential — For Legal Advice Purposes” to maximize protection.

Remediation and Long-Term Compliance

The final phase of a regulatory investigation is remediation. The SEC and DOJ will evaluate whether the issuer has implemented structural changes to prevent recurrence. For Hong Kong-issuers, this often requires fundamental changes to the corporate governance framework and the audit committee structure.

Enhanced Internal Controls and the Audit Committee

The SEC’s FY2024 enforcement priorities include a focus on “internal control weaknesses” under Section 13(b)(2)(B) of the Exchange Act. The issuer must engage a Big Four audit firm (not the issuer’s current auditor) to conduct a Section 404(b) assessment of internal controls over financial reporting (ICFR). The assessment should cover: (1) revenue recognition policies; (2) related-party transaction approval procedures; (3) cash management and bank reconciliation processes; (4) PRC subsidiary oversight. The audit committee must be reconstituted to include at least one member with U.S. public company audit committee experience (per NASDAQ Listing Rule 5605(c)(2)). For Hong Kong-issuers, the audit committee should also include a member with Hong Kong financial reporting experience (e.g., a former SFC official or a partner from a Hong Kong-based accounting firm). The audit committee charter should be amended to include a specific obligation to review all regulatory inquiries and internal investigation reports.

Clawback Policies and Compensation Recoupment

The SEC’s Clawback Rule (Listing Standards for Recovery of Erroneously Awarded Compensation, effective October 2023) requires listed issuers to adopt a clawback policy that covers executive officers. For Hong Kong-issuers, this policy must be enforceable under Hong Kong employment law, which generally prohibits retrospective changes to compensation without the employee’s consent (Employment Ordinance, Cap. 57, Section 32). The issuer should amend the employment contracts of all Section 16 officers to include an explicit clawback provision that complies with both the SEC rule and Cap. 57. The clawback amount should be calculated based on the “erroneously awarded compensation” — the difference between the amount paid and the amount that would have been paid based on the restated financials. In SEC v. Luckin Coffee (S.D.N.Y. 2021), the issuer agreed to a USD 180 million penalty in part because its clawback policy was not enforceable under PRC law. Hong Kong-issuers should ensure that the clawback policy covers compensation paid to employees in the PRC subsidiaries, which may require a separate PRC law analysis.

Ongoing Cooperation and Voluntary Reporting

Even after the investigation is resolved, the issuer should maintain an ongoing cooperation posture with the SEC and DOJ. This includes: (1) voluntary reporting of any subsequent internal investigation findings; (2) quarterly status calls with the SEC staff if the issuer is under a monitor; (3) annual compliance certifications signed by the CEO and CFO. The SEC’s Enforcement Manual (2023) provides that “continued cooperation” is a factor that can reduce the length of a monitor term or lead to early termination of a DPA. For Hong Kong-issuers, the SFC’s Enforcement Division also takes note of U.S. regulatory actions: a SEC settlement can trigger a parallel SFC inquiry under the Securities and Futures Ordinance (Cap. 571, Section 213). The issuer should proactively disclose the U.S. settlement to the SFC within 14 days of execution, as failure to do so can result in a separate SFC enforcement action.

Actionable Takeaways

  1. Within 12 hours of receiving a SEC or DOJ subpoena, issue a bilingual legal hold notice in English and Chinese, with signed custodial acknowledgments, to preserve all documents and comply with Cap. 486 data transfer obligations.
  2. Engage separate U.S. securities litigation counsel and Hong Kong Cap. 486 counsel within 72 hours, with explicit conflict waivers in the engagement letters to avoid the conflicts that prejudiced the Longtop Financial investigation.
  3. Structure the internal investigation through independent counsel and a separate forensic accounting firm, following the Upjohn warning protocol in both Cantonese and Mandarin, to qualify for SEC Seaboard Report cooperation credit.
  4. If the investigation escalates to a DOJ parallel proceeding, negotiate a deferred prosecution agreement with a fixed-term monitor (2-3 years) and a negotiated penalty range of 0.5% to 1.5% of market cap, referencing the 78% settlement rate in SEC FY2024 enforcement actions.
  5. Amend the audit committee charter and executive employment contracts to include an SEC-compliant clawback policy enforceable under Hong Kong’s Employment Ordinance (Cap. 57), and proactively disclose any SEC settlement to the SFC within 14 days under Cap. 571 Section 213.