美股招股观察

How to Write the Risk Factors Section: Balancing Negative Disclosure in an S-1

The SEC’s Division of Corporation Finance issued Staff Legal Bulletin No. 14M (CF) in December 2024, codifying a stricter materiality threshold for risk factor disclosure in registration statements. The bulletin explicitly directs issuers to eliminate “generic, hypothetical, or boilerplate” risks that do not directly correlate with the company’s specific business model, capital structure, or industry. For Hong Kong-based issuers filing an F-1 or S-1 for a NYSE or NASDAQ listing, this represents a structural shift in drafting strategy. The era of padding a risk section with 40-plus pages of standard disclaimers—covering “global economic conditions” or “potential pandemics”—is effectively over. Issuers must now demonstrate a causal link between each risk factor and a verifiable operational or financial characteristic. The consequence of non-compliance is not merely a comment letter; it is a delayed registration statement, increased underwriter liability exposure, and, in extreme cases, a refusal order under Section 8(b) of the Securities Act of 1933. This article dissects the mechanics of writing a risk factors section that satisfies SEC scrutiny while protecting the issuer’s valuation narrative.

The Shift from Disclosure Volume to Disclosure Precision

The SEC’s 2024 bulletin explicitly rejects the “laundry list” approach to risk factors. Under the new framework, each risk factor must be company-specific, material, and forward-looking in a manner that directly ties to the issuer’s financial statements or business operations. The bulletin cites the Basic Inc. v. Levinson (1988) standard for materiality: a fact is material if there is a “substantial likelihood that a reasonable investor would consider it important” in making an investment decision. For a Hong Kong issuer with a Cayman Islands holding company and PRC operating subsidiaries via a VIE structure, a risk factor stating “We may be subject to PRC regulatory actions” is no longer sufficient. The issuer must quantify the probability of such action, cite specific PRC regulations (e.g., the 2023 Data Security Law or the 2021 Cybersecurity Review Measures), and disclose the potential financial impact—whether as a percentage of revenue or a specific liability exposure.

Data from the SEC’s EDGAR system for filings between January and October 2025 shows that 68% of initial S-1 filings from non-US issuers (including Hong Kong) received at least one comment letter specifically challenging the risk factors section. The most common deficiency: failure to differentiate risks between the issuer’s holding company, its PRC operating entities, and the VIE structure. The SEC’s 2024 bulletin explicitly requires this tiered disclosure. For example, an issuer must separately disclose risks related to (a) the Cayman holding company’s ability to enforce contractual rights under the VIE agreements, (b) the PRC subsidiary’s ability to remit dividends, and (c) the Hong Kong listing vehicle’s compliance with HKEX Listing Rule 19C if a secondary listing is contemplated. Failure to do so results in a “deficiency letter” that stalls the 20-day waiting period under the Securities Act.

Structuring the Risk Factors Section: A Three-Tier Hierarchy

Tier 1: Business and Industry Risks (Company-Specific)

This is the highest-priority tier. Each risk factor must be preceded by a headline that states the specific risk, not a generic category. For example, instead of “Risks Related to Our Business,” use “We are exposed to currency fluctuation risk from our cross-border revenue streams, which represented 72% of our total revenue for FY2024.” The body must then quantify the exposure: the issuer’s functional currency, the percentage of revenue denominated in non-functional currencies, the hedging strategy (if any), and the impact of a 10% adverse movement on net income. The SEC’s 2024 bulletin explicitly states that “quantitative disclosure is preferred over qualitative description” for financial risks. For a Hong Kong issuer with a PRC subsidiary, this means disclosing the exact percentage of revenue subject to PRC foreign exchange controls under the State Administration of Foreign Exchange (SAFE) regulations.

This tier must address the legal framework of every jurisdiction where the issuer operates. For a Hong Kong issuer with a Cayman holding company and PRC VIE structure, the risk factors must separately address:

  • Cayman Islands Law: The issuer’s ability to enforce contractual rights under the VIE agreements, specifically the Cayman Islands Companies Act (2023 Revision) provisions on derivative actions and the enforceability of foreign judgments. The SEC requires disclosure of whether the Cayman courts have recognized PRC court judgments in the past; if not, the issuer must state that “there is no assurance that a PRC court judgment would be enforceable in the Cayman Islands.”
  • PRC Law: The risk of the VIE structure being invalidated under PRC law, citing the Supreme People’s Court’s 2024 Judicial Interpretation on Foreign Investment which clarifies that VIEs in restricted industries (e.g., education, internet content) may be deemed invalid if the contractual arrangements are found to circumvent foreign ownership prohibitions.
  • Hong Kong Law: If the issuer is dual-listed on HKEX, the risk of conflict between SEC and HKEX disclosure requirements, particularly under HKEX Listing Rule 2.03 (continuous disclosure obligations) and the Securities and Futures Ordinance (Cap. 571) provisions on market misconduct.

Tier 3: Structural Risks (Capital Structure and Shareholder Rights)

This tier addresses the specific risks inherent in the issuer’s capital structure. For a Hong Kong issuer using a weighted voting rights (WVR) structure permitted under HKEX Chapter 8A, the risk factors must disclose the exact ratio of voting power held by the controlling shareholder(s) versus public shareholders. The SEC requires a table showing the percentage of economic interest versus voting interest for each class of shares. A 2025 study by the Harvard Law School Forum on Corporate Governance found that issuers with WVR structures received 40% more comment letters on risk factors than those with single-class structures. The risk factor must explicitly state that “shareholders with limited voting rights may not be able to influence corporate actions, including the election of directors or approval of mergers, even if they hold a majority of the economic interest.”

Drafting Techniques: Balancing Negative Disclosure with Valuation Protection

The “Causal Chain” Method

The SEC’s 2024 bulletin encourages a “causal chain” approach: each risk factor must demonstrate a direct line from the risk event to a financial statement line item. For example, a risk factor stating “We depend on a single supplier for 85% of our raw materials” must then explain how a supply disruption would affect cost of goods sold (COGS), gross margin, and inventory turnover. The issuer should provide a sensitivity analysis: “A 30-day disruption in supply would increase COGS by approximately HKD 12 million, reducing gross margin by 180 basis points based on FY2024 figures.” This converts a qualitative risk into a quantifiable financial impact, which satisfies the SEC’s materiality standard while also giving the issuer a defensible position in a subsequent securities class action under Rule 10b-5.

The “Safe Harbor” Language Trap

Many Hong Kong issuers rely on the Private Securities Litigation Reform Act of 1995 (PSLRA) safe harbor for forward-looking statements. However, the SEC’s 2024 bulletin explicitly warns that “boilerplate safe harbor language does not shield an issuer from liability for material omissions.” The risk factors section must be written in the present tense for known risks and the future tense for contingent risks. For example, “We are currently subject to a PRC tax audit” (present) versus “If the PRC tax authorities reclassify our VIE payments as dividends, we may be subject to withholding tax at a rate of 10%” (future). The safe harbor only applies to the latter, and only if the issuer has a reasonable basis for the projection. The SEC’s Omnicare, Inc. v. Laborers District Council Construction Industry Pension Fund (2015) decision clarified that opinion statements in risk factors are actionable if the issuer did not actually hold that belief.

The “Negative Emphasis” Technique

To balance negative disclosure with valuation protection, use a technique called “negative emphasis” or “risk mitigation disclosure.” After stating the risk, immediately follow with a sentence or paragraph describing the issuer’s specific mitigation strategy, but only if that strategy is verifiable and currently in place. For example: “We are exposed to PRC regulatory changes affecting the VIE structure. As of the date of this prospectus, we have obtained a legal opinion from [PRC law firm name] confirming that our VIE agreements are enforceable under current PRC law, and we have entered into a contractual arrangement with our PRC operating entity that provides for automatic termination payments equal to 3x annual net profit in the event of invalidation.” This converts a pure risk into a risk-with-mitigation, which reduces the negative impact on valuation while still complying with SEC disclosure requirements.

Cross-Border Considerations: Hong Kong Issuers Filing an S-1

The VIE Disclosure Mandate

For Hong Kong issuers using a VIE structure, the SEC’s 2024 bulletin requires a separate risk factor titled “Risks Related to Our VIE Structure” that must include:

  • A diagram showing the ownership structure, including the Cayman holding company, the Hong Kong intermediate holding company, the PRC WFOE, and the PRC operating entity.
  • A description of the contractual arrangements, including the exclusive option agreement, the equity pledge agreement, and the power of attorney.
  • A statement of the legal risks, citing specific PRC regulations, such as the Cybersecurity Law of the People’s Republic of China (2017) and the Data Security Law (2021).
  • A quantification of the financial exposure: “As of December 31, 2024, the VIE structure accounted for 100% of our consolidated revenue and 100% of our consolidated net assets.”

The SEC’s China-Based Issuers: Disclosure Considerations (2021) guidance, which remains in effect, explicitly states that “an issuer that relies on a VIE structure must disclose that it does not own the equity of the operating entity and that investors are purchasing shares in a holding company that has contractual rights, not ownership rights.”

Dual-Listing Conflicts: HKEX vs. SEC

A Hong Kong issuer dual-listed on HKEX and NYSE faces a conflict between HKEX Listing Rule 2.03 (continuous disclosure) and SEC Regulation S-K Item 105 (risk factors). HKEX requires immediate disclosure of price-sensitive information, while the SEC’s risk factors section is a static document filed at the time of registration. The issuer must reconcile these by including a risk factor stating: “We are subject to continuous disclosure obligations under HKEX Listing Rules that require us to disclose material information promptly, which may conflict with our obligation under US securities laws to disclose material information in a registered offering. Any delay in disclosure could result in regulatory action by the SFC under the Securities and Futures Ordinance (Cap. 571) or the SEC under the Securities Exchange Act of 1934.”

The Hong Kong Sponsor’s Role

Under HKEX Listing Rule 3A.02, the sponsor is responsible for ensuring the accuracy of the prospectus. For a US listing, the Hong Kong sponsor’s role is advisory, but the SEC’s comment letters often request confirmation from the sponsor regarding the risk factors section. The sponsor must provide a written opinion that the risk factors are “complete and accurate in all material respects” and that the issuer has disclosed all known material risks. This opinion must be filed as an exhibit to the S-1 under Item 601(b)(5) of Regulation S-K. Failure to do so results in a “deficiency letter” that delays the registration statement.

Conclusion: Three Actionable Takeaways for Issuers and Advisors

  1. Quantify every material risk factor using a specific financial metric (e.g., percentage of revenue, basis points of margin, absolute HKD amount) and cite the source of that data (e.g., audited financial statements for FY2024) to satisfy the SEC’s materiality standard under Staff Legal Bulletin No. 14M (2024).
  2. Structure the risk factors section into three tiers—business, legal/regulatory, and structural—with separate subsections for each jurisdiction (Cayman, PRC, Hong Kong) and include a VIE-specific risk factor that quantifies the financial exposure and cites the relevant PRC regulations by name and year.
  3. Use the “causal chain” method to link each risk factor to a specific financial statement line item (e.g., COGS, gross margin, net income) and include a sensitivity analysis (e.g., impact of a 10% adverse movement) to demonstrate materiality while providing a defensible position under Rule 10b-5 and the PSLRA safe harbor.