Whistleblowing policies and systems required for Hong Kong listed companies

Hong Kong Corporate Governance Code Requirements for Whistleblowing

A listed issuer on The Stock Exchange of Hong Kong Limited must establish a hong kong whistleblowing policy that enables employees and other workplace participants to report concerns about possible improprieties. Code Provision D.2.3 of Appendix C1 to the Main Board and GEM Listing Rules sets out this requirement. It was upgraded from a Recommended Best Practice to a Code Provision on 1 January 2022 and renumbered from D.2.6 to D.2.3 with effect from 1 July 2025. The provision imposes a comply-or-explain obligation. A company may depart from it only if it states that departure and explains the reasons in its corporate governance report.

Hong Kong Whistleblowing Policy Requirements for Listed Companies

Code Provision D.2.3 requires the board of a listed issuer to establish a whistleblowing policy and system. The policy must cover employees and those who deal with the issuer, such as customers and suppliers. They must be able to raise concerns in confidence and with anonymity. The reporting channel must lead to the audit committee or to a designated committee comprising a majority of independent non-executive directors. The subject matter is possible improprieties in any matter related to the issuer.

The system must allow for confidential reporting. An anonymous reporting mechanism is also required. The whistleblower does not need to reveal their identity to make a report. The audit committee or the designated committee receives and handles the reports. Not the executive directors or senior management.

An issuer that does not have such a policy must explain why and what alternative arrangements are in place. The disclosure is made in the annual corporate governance report that accompanies the annual report.

Hong Kong Whistleblowing Code Provision D.2.3 in Detail

Code Provision D.2.3 reads as follows (paraphrasing the Listing Rules wording): "The issuer should establish a whistleblowing policy and system for employees and those who deal with the issuer (such as customers and suppliers) to raise concerns, in confidence and with anonymity, with the audit committee (or a designated committee comprising a majority of independent non-executive directors) about possible improprieties in any matter related to the issuer."

The provision does not specify the form of the policy or system. It does not prescribe a particular reporting channel. A hotline, web portal or email address are all permissible. The issuer determines what is appropriate for its size and operations. The requirement is that the channel works, is accessible to the categories of people listed, and that reports reach the audit committee or the designated committee.

Whistleblower Protection Hong Kong Private Sector: The Statutory Gaps

Hong Kong has no general statutory whistleblower protection for private sector employees. There is no protected disclosure regime. No reward scheme. No statutory duty on a private employer to maintain a whistleblowing channel. The existing protections are piecemeal and cover only narrow categories of reporting.

The absence of a comprehensive statutory framework means that an employee who reports misconduct internally or to a regulator may still face dismissal or retaliation without a statutory remedy, unless the report falls within one of the specific protections described below. The HKEX Corporate Governance Code does not itself confer employment rights. It is a listing standard, not an employment statute.

Hong Kong Employment Ordinance Whistleblower Retaliation: Section 72B

Section 72B(1) of the Employment Ordinance (Cap. 57) prohibits an employer from terminating or discriminating against an employee because the employee gave evidence or information in proceedings or an inquiry to enforce the Employment Ordinance, or concerning a work accident or a breach of work safety law. The protection does not cover reporting fraud, corruption or financial misconduct.

If an employer breaches section 72B, the dismissal is considered unreasonable and unlawful under section 32A(1)(c)(i) of the Employment Ordinance. The employee may apply to the Labour Tribunal for a remedy. Reinstatement without the employer's agreement is available. Compensation is capped at HK$150,000. The compensation cap of HK$150,000 applies to the award for unreasonable and unlawful dismissal.

Hong Kong Audit Committee Whistleblowing Channel: How the System Operates

The audit committee is the primary recipient of whistleblowing reports under Code Provision D.2.3. The committee, or a designated committee with a majority of independent non-executive directors, must establish procedures for receiving, investigating and responding to reports.

The channel must allow for anonymous reporting. An anonymous reporter cannot be identified by the system. The committee does not need to know the reporter's identity to investigate. Confidential reporting means the committee will treat the reporter's identity as confidential within the organisation, disclosing it only on a need-to-know basis for the investigation or if required by law.

The committee should set out in its terms of reference how it will handle reports: who receives them, how they are logged, how investigations are conducted, and how the outcome is communicated to the reporter where possible. The committee should report to the board on the number and nature of reports received and the outcome of investigations.

Section 72B Employment Ordinance and Related Protections

Beyond section 72B, the Employment Ordinance provides a general prohibition on termination in circumstances that are unreasonable and unlawful. The definition of unreasonable and unlawful dismissal in section 32A focuses on discrimination on grounds of pregnancy, trade union membership, and giving evidence in Employment Ordinance proceedings. Whistleblowing about financial misconduct is not included.

The limited scope means that a private sector employee who reports corruption or fraud to the ICAC or the SFC may face dismissal without a statutory claim for whistleblower retaliation. The employer may still be liable for wrongful dismissal under the general law of contract. The burden falls on the employee to establish the contract remedy.

Section 30A Prevention of Bribery Ordinance: Informer Identity Protection

Section 30A of the Prevention of Bribery Ordinance (Cap. 201) protects the identity of an informer in court proceedings. The court may order disclosure only where it is necessary in the interests of justice or for the defence. The protection applies to the identity of the person who gave information to the ICAC. It does not apply to employment protection.

An employee who reports a bribe to the ICAC under section 30A cannot be forced to reveal their identity in court. The section does not prevent the employer from dismissing the employee for making the report. The protection is against disclosure in legal proceedings, not against retaliation.

Section 381 Securities and Futures Ordinance: Auditor Immunity

Section 381 of the Securities and Futures Ordinance (Cap. 571) gives civil immunity to auditors of listed corporations who communicate in good faith with the SFC. The auditor is not liable for breach of duty or contract for making such a communication. The protection is confined to auditors. It does not extend to other employees or workplace participants.

Section 380 of the Securities and Futures Ordinance provides a general good faith immunity for any person who communicates information to the SFC in good faith. This covers a broader category of persons than auditors. It is immunity from civil liability for making the communication, not protection against employment retaliation. An employee who reports to the SFC under section 380 cannot be sued by the employer for breach of confidentiality. The employee can still be dismissed.

Section 80 Competition Ordinance: Leniency Agreements

Section 80 of the Competition Ordinance (Cap. 619) allows the Competition Commission to enter into a leniency agreement with a participant in a cartel, giving the participant immunity from penalty in exchange for cooperation. The scheme is designed to encourage cartel members to self-report. It does not protect whistleblowers who are not participants.

A leniency agreement does not provide employment protection. An employee of a leniency applicant who reveals cartel conduct to the Commission may still be dismissed. The Protection of Leniency-related Information rules under the Competition Ordinance protect the identity of the leniency applicant from disclosure. Again, not from retaliation.

The ICAC's Role in Whistleblowing

The Independent Commission Against Corruption (ICAC) investigates corruption in both the public and private sectors under the Prevention of Bribery Ordinance. An employee who reports suspected private sector bribery to the ICAC is protected by section 30A from having their identity disclosed in court. No statutory protection against retaliation exists.

The ICAC does not operate a reward scheme for whistleblowers. Its focus is on law enforcement, not on providing employment remedies for reporters. An employee who makes a report to the ICAC and suffers retaliation must rely on the general law of contract or seek alternative remedies such as a claim for constructive dismissal under the Employment Ordinance. The same limitation applies: the dismissal must fall within the statutory grounds.

The Absence of a Statutory Duty or Reward Scheme

Hong Kong does not impose a statutory duty on private employers to maintain a whistleblowing channel. The obligation under Code Provision D.2.3 is a listing rule requirement. Not a statutory one. A private company that is not listed is not required by law to have a whistleblowing policy.

There is no reward scheme for whistleblowers in Hong Kong's private sector. No ordinance provides a financial incentive for reporting fraud, corruption or misconduct. The Competition Ordinance's leniency scheme is the closest equivalent. It applies only to cartel participants, not to bystanders or observers.

Recommended Best Practice Considerations for Issuers

Code Provision D.2.3 is a comply-or-explain requirement. Treat it as a minimum standard. The HKEX has indicated that it expects issuers to maintain effective whistleblowing systems, and the audit committee should regularly review the policy's operation.

The following elements form a suggested framework for a whistleblowing policy:

Element	Description
Scope	Employees, customers, suppliers and other workplace participants
Channel	Confidential and anonymous reporting to the audit committee or a designated committee
Investigation	Procedures for receiving, logging, investigating and responding to reports
Confidentiality	Commitment to protect the reporter's identity where possible
Non-retaliation	Statement that the issuer will not retaliate against good faith reporters
Reporting	Annual report to the board on the number and nature of reports and outcomes

Compliance and Disclosure Obligations

The corporate governance report must state whether the issuer has complied with Code Provision D.2.3. If it has not, it must explain the reasons for non-compliance and describe any alternative arrangements. The report is part of the annual report and is subject to the same filing and disclosure requirements under the Listing Rules.

The audit committee must also include in its terms of reference a description of its role in relation to whistleblowing. The committee's report to the board should include a summary of the whistleblowing reports received and the action taken.

Practical Considerations for Business Owners

Business owners of listed companies should ensure that the whistleblowing policy is documented, communicated to all employees and third parties who deal with the issuer, and reviewed annually. The policy should be in both English and Chinese if the workforce or stakeholders include Cantonese- or Mandarin-speaking individuals.

The policy should also address how the issuer will handle false reports. Encourage good faith reporting. State that making a false report with malice may lead to disciplinary action.

The absence of statutory whistleblower protection means that issuers should include a non-retaliation clause in their policy to reassure reporters. Such a clause is not legally binding in the way a statutory provision would be. It provides a contractual commitment that the issuer will not take adverse action against a good faith reporter.

The Listing Rules Context

Code Provision D.2.3 sits alongside other governance requirements in Appendix C1. The same consultation package that renumbered D.2.3 also introduced the nine-year cap on INED tenure at Rule 3.13A and the six-directorship cap at Rule 3.12A. The page on independent non-executive directors covers those provisions in detail.

The whistleblowing requirement complements the anti-corruption requirement at Code Provision D.2.4, which states that the issuer should establish policies and systems that promote and support anti-corruption laws and regulations. The page on anti-bribery covers section 9 of the Prevention of Bribery Ordinance and the related Listing Rule requirements.

The page on the Corporate Governance Code covers the full structure of Appendix C1, including Mandatory Disclosure Requirements, Code Provisions and Recommended Best Practices. The whistleblowing provision is one of several code provisions that the audit committee oversees.

The page on risk management and internal control covers the board's responsibility for reviewing the effectiveness of internal control systems, which includes the controls around the whistleblowing channel.

The page on board diversity covers the single-gender board ban and workforce diversity policy, which are separate from the whistleblowing requirements but form part of the same governance framework.

The page on ESG reporting covers climate-related disclosures under Part D of Appendix C2, which are separate from the governance code provisions.

The page on weighted voting rights covers the eligibility criteria and voting power caps under Chapter 8A, which apply only to issuers with weighted voting rights.

The page on public governance covers the bodies to which Appendix C1 does not apply.