Whistleblowing Policy (Hong Kong)

A Whistleblowing Policy in Hong Kong establishes the rules and responsibilities that govern the conduct it addresses.

Hong Kong does not have a standalone whistleblower protection statute equivalent to the United Kingdom's Public Interest Disclosure Act 1998 or Australia's Public Interest Disclosure Act 2013. Protection for whistleblowers in Hong Kong is drawn from several overlapping legal sources. The Prevention of Bribery Ordinance (Cap. 201) is the most important: Section 30 of Cap. 201 makes it a criminal offence — punishable by a fine of HK$100,000 and imprisonment for one year — to disclose the identity of a person who has made a complaint to the Independent Commission Against Corruption (ICAC) without lawful authority. The ICAC, established under the Independent Commission Against Corruption Ordinance (Cap. 204), is the primary anti-corruption enforcement agency in Hong Kong and receives thousands of reports of suspected corruption annually through its 24-hour reporting hotline (25 266 366) at its headquarters at 303 Java Road, North Point.

The Employment Ordinance (Cap. 57) provides supplementary protection through Section 32K, which prohibits dismissal where the principal reason is that the employee has given evidence or information in any proceedings or inquiry. While Section 32K does not cover all whistleblowing scenarios, dismissal in retaliation for a good-faith internal report may constitute a breach of the implied duty of mutual trust and confidence under common law employment principles applied by the Labour Tribunal and the Court of First Instance.

For listed companies on the Main Board and GEM of the Hong Kong Stock Exchange, the HKEX Corporate Governance Code (updated 2022) specifically recommends that boards establish procedures for employees to raise concerns about possible financial reporting improprieties and other matters, with assurance that staff raising concerns in good faith will be protected from retaliation. The Securities and Futures Commission (SFC) — which licenses corporations under the Securities and Futures Ordinance (Cap. 571) — and the Hong Kong Monetary Authority (HKMA) — which supervises authorised institutions under the Banking Ordinance (Cap. 155) — similarly expect licensed corporations and authorised institutions to maintain adequate internal controls, which regulators interpret to include effective reporting mechanisms for misconduct.

The Companies Ordinance (Cap. 622) requires directors to act in the best interests of the company and to report material matters — a whistleblowing policy operationalises this obligation across the entire workforce, not just at board level. Section 9 of the Prevention of Bribery Ordinance (Cap. 201) makes private sector bribery a criminal offence carrying up to seven years' imprisonment, and a whistleblowing policy creates the internal channel for detecting Section 9 violations before they escalate into criminal investigations by the ICAC or the Commercial Crime Bureau of the Hong Kong Police Force.

The forms-legal.com template provides organisations with a professionally drafted framework that integrates Cap. 201 ICAC reporting protocols, HKEX Corporate Governance Code recommendations, and SFC/HKMA regulatory expectations into a single document tailored to Hong Kong law and practice. Section 30 of Cap. 201 and Section 32K of Cap. 57 together form the legal backbone of any Hong Kong whistleblower protection regime.

Every Hong Kong organisation — regardless of size, sector, or whether it is listed — should establish a Whistleblowing Policy as a foundational element of its corporate governance and compliance framework. The circumstances requiring or strongly recommending a policy are numerous and span both mandatory regulatory requirements and recognised established procedures in Hong Kong.

Listed companies on the Main Board or GEM of the Hong Kong Stock Exchange are subject to the HKEX Corporate Governance Code (updated 2022), which recommends that the audit committee review the company's arrangements for employees to raise concerns about possible financial reporting improprieties or other matters. The audit committee's report in the annual corporate governance report must disclose whether such arrangements are in place. In practice, the absence of a whistleblowing policy is a governance deficiency that institutional investors and proxy advisory firms treat as a negative indicator when assessing board quality. Non-compliance with the HKEX Corporate Governance Code must be explained — and a failure to explain is itself a breach of the Main Board Listing Rules.

Companies regulated by the Securities and Futures Commission (SFC) under the Securities and Futures Ordinance (Cap. 571) — licensed corporations, collective investment scheme operators, and approved persons — are expected to maintain adequate systems and controls under the SFC's Code of Conduct and Guidelines on Internal Controls, which specifically identify reporting mechanisms for employee concerns about potential regulatory breaches as a component of adequate controls. Failure to maintain such mechanisms may result in SFC disciplinary action under Section 194 of Cap. 571.

Authorised institutions regulated by the Hong Kong Monetary Authority (HKMA) under the Banking Ordinance (Cap. 155) — licensed banks, restricted licence banks, and deposit-taking companies — are expected under HKMA's Supervisory Policy Manual CG-1 to have effective internal reporting arrangements covering financial crime, compliance failures, and conduct issues. The HKMA may take supervisory action against institutions with inadequate governance frameworks including missing whistleblower channels.

Organisations in industries subject to the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) — including banks, licensed money service operators, solicitors, accountants, and estate agents regulated by the Estate Agents Authority — benefit from a whistleblowing policy that encourages internal reporting of suspected money laundering before it escalates to a Suspicious Transaction Report (STR) filed with the Joint Financial Intelligence Unit (JFIU) of the Hong Kong Police Force and the Customs and Excise Department.

Private companies, partnerships, professional firms, and NGOs that handle public funds, donor contributions, or government grants should implement a Whistleblowing Policy to demonstrate accountability to funders and the public. The Social Welfare Department and the Home and Youth Affairs Bureau require funded organisations to maintain governance standards that include internal reporting mechanisms. Professional bodies including the Hong Kong Institute of Certified Public Accountants (HKICPA) and the Law Society of Hong Kong also recommend that their members' firms maintain effective internal reporting arrangements. Forms-legal.com provides a Whistleblowing Policy template for Hong Kong covering all regulatory expectations under Cap. 201, Cap. 57, and HKEX Code requirements.

A Hong Kong Whistleblowing Policy should include the following elements to be effective, legally sound, and aligned with HKEX, SFC, and HKMA expectations.

Scope of coverage: The policy should clearly define the categories of misconduct that can be reported, including: violations of the Prevention of Bribery Ordinance (Cap. 201) — bribery and corruption; fraud, embezzlement, and financial misappropriation; breaches of the Securities and Futures Ordinance (Cap. 571) and HKEX Listing Rules; violations of the Companies Ordinance (Cap. 622); health and safety breaches under the Occupational Safety and Health Ordinance (Cap. 509); data privacy violations under the Personal Data (Privacy) Ordinance (Cap. 486); and other serious legal, regulatory, or ethical violations.

Eligible reporters: The policy should specify who can make a report — employees at all levels, contractors, suppliers, customers, and any third party with knowledge of potential misconduct. Limiting the policy to employees alone misses a significant source of information about external-facing misconduct.

Reporting channels: The policy must establish multiple, accessible reporting channels to accommodate different comfort levels and degrees of sensitivity. Internal channels typically include: a dedicated whistleblowing hotline (telephone number and email); a designated Whistleblowing Officer — typically the Head of Compliance, Internal Audit, or General Counsel; and a board-level escalation path — for concerns about senior management, the Audit Committee Chairman or Lead Independent Non-Executive Director. External channels must be disclosed: the ICAC hotline (25 266 366), the SFC complaint line, and the HKMA reporting mechanism.

Confidentiality protections: The policy must commit to protecting the identity of the reporter to the maximum extent possible. Section 30 of Cap. 201 provides criminal penalties for disclosing ICAC complainant identities. For internal reports, the policy should restrict access to the report to those who need to know for investigation purposes, with breach of confidentiality being a disciplinary offence. The policy should specify who will have access to the report and under what circumstances identity may need to be disclosed.

Anonymous reporting: The policy should state whether anonymous reports are accepted and how they will be handled. Anonymous reports limit the investigator's ability to seek clarification but remain a valuable source of information. The policy should encourage reporters to identify themselves while assuring that anonymous reports will be investigated to the extent possible.

Anti-retaliation commitment: The policy must include a strong, unambiguous commitment that the organisation will not tolerate retaliation against any person who makes a good-faith report, even if the report is ultimately found to be unsubstantiated. Retaliation — including dismissal, demotion, harassment, ostracism, or any adverse employment action — must be defined as a serious disciplinary offence. The policy should specify the process for a reporter to raise a concern that they are being retaliated against.

Investigation process: The policy should outline the investigation framework — who conducts investigations (internal compliance team, internal audit, or external investigators); the standard of independence required (persons with no conflict of interest); the investigation timeline (initial assessment within 5–10 business days, full investigation within 30–60 days); the rights of the accused person (to be informed of the allegation and given a fair opportunity to respond); and the disposition of the investigation (written report with findings and recommended action).

Escalation to regulators and law enforcement: The policy should address when and how the organisation will report to external authorities — the ICAC for corruption under Cap. 201; the SFC for securities law violations; the Police Commercial Crime Bureau for fraud; or the Labour Department for employment law breaches. The policy should not discourage reporters from making direct reports to the ICAC or other regulators.

Record keeping and audit: All reports, investigation records, and outcomes should be documented and retained in a confidential register maintained by the Whistleblowing Officer. The Audit Committee should receive a periodic summary report (at least annually) of all whistleblowing reports received, their disposition, and any systemic issues identified. Records should be retained for a minimum of seven years.

Training and awareness: The policy is only effective if employees know it exists and trust it. Annual training for all employees — including specific training for managers on handling disclosures and anti-retaliation obligations — is essential. The policy should be included in new employee induction materials and published on the organisation's intranet. The forms-legal.com Whistleblowing Policy (Hong Kong) template covers the mandatory elements under Prevention of Bribery Ordinance (Cap. 201).