Your Hong Kong customer or buyer is asking for ESG information. Here is what the regulatory environment requires — and what they need from you.

The Hong Kong Stock Exchange (HKEX) requires all listed companies to publish annual ESG reports covering environmental key performance indicators (KPIs), social KPIs, and governance disclosures. HKEX significantly upgraded its ESG Reporting Guide in 2020 to make climate-related disclosures mandatory on a 'comply or explain' basis. Following the ISSB's publication of IFRS S1 and S2, HKEX has adopted HKFRS S2 (equivalent to IFRS S2) as the mandatory climate disclosure standard for large issuers from FY2025 and all listed issuers from FY2026.

Hong Kong's Green and Sustainable Finance Cross-Agency Steering Group — comprising the Hong Kong Monetary Authority (HKMA), Securities and Futures Commission (SFC), Insurance Authority, and Mandatory Provident Fund Schemes Authority — coordinates Hong Kong's sustainable finance regulatory framework. The HKMA requires authorised institutions to implement TCFD-aligned climate risk management. The SFC requires fund managers to consider climate risks in investment decisions and disclose climate-related information.

The Securities and Futures Commission (SFC) requires SFC-licensed fund managers to make climate-related disclosures at the fund and entity level, aligned with TCFD recommendations. Fund managers must disclose governance arrangements for climate risks, climate risk management processes, and climate-related metrics including portfolio carbon footprint. This requirement flows through to companies in which SFC-regulated funds invest, as fund managers must assess and disclose portfolio company climate risks.

EU companies with supply chains or business relationships in Hong Kong — particularly in financial services, logistics, retail, and manufacturing — will be required under CSDDD to conduct human rights and environmental due diligence. Hong Kong-based suppliers and service providers will receive questionnaires on labour practices, environmental management, and anti-corruption compliance. Companies with supply chains extending into mainland China face additional scrutiny on forced labour risks.

The US Uyghur Forced Labor Prevention Act creates a rebuttable presumption that goods produced in whole or in part in Xinjiang, China, are made with forced labour. US Customs and Border Protection actively monitors goods transshipped through Hong Kong to identify potential circumvention. Hong Kong-based traders, logistics companies, and manufacturers with supply chains touching Xinjiang must maintain comprehensive supply chain traceability documentation to demonstrate goods are not subject to the UFLPA rebuttable presumption.

Hong Kong's Personal Data (Privacy) Ordinance (PDPO, Cap. 486) was amended in 2021 to introduce mandatory data breach notification. Data users must notify the Office of the Privacy Commissioner for Personal Data (PCPD) 'as soon as practicable' — interpreted in practice as within 72 hours for breaches likely to cause real risk of significant harm to data subjects. Failure to notify carries criminal penalties. The Hong Kong Monetary Authority (HKMA) and Securities and Futures Commission (SFC) impose sector-specific cybersecurity incident reporting requirements on financial institutions, typically within 1 hour for critical incidents. The Hong Kong Police Force's Cyber Security and Technology Crime Bureau (CSTCB) handles cybercrime investigations. Suppliers processing Hong Kong customer data must align breach notification to the PCPD 72-hour window and sector-specific HKMA/SFC requirements where applicable.