Company’s Counsel Perspective

1. Guiding the Company to Address the Issues

To address the issues, it is essential to ensure that the company’s practices comply with the relevant legal, regulatory, and listing requirements. Regarding revenue recognition, the improper practices of recording full-year subscription revenue on contract signing, verbal amendments to written contracts, and side agreements regarding refund terms must cease immediately. The company must ensure compliance with HKFRS 15 (Revenue from Contracts with Customers), which requires revenue to be recognized only when performance obligations are satisfied. An internal audit should be conducted to identify any improperly recorded revenue and unofficial agreements. Any inaccuracies in financial statements should be corrected and restated to reflect compliance with proper accounting standards. A formalized policy should be implemented to ensure that all future contracts and amendments are in writing, reviewed by legal and finance teams, and approved at the appropriate management level.

For regulatory compliance issues, the company must act promptly to renew the expired payment gateway license in Thailand. Operating without a valid license exposes the company to significant legal and reputational risks. Local counsel should be engaged to expedite the renewal process and assess any penalties or backdated compliance obligations. The company must also address the absence of Anti-Money Laundering (AML) procedures by implementing temporary measures, such as customer due diligence, transaction monitoring, and reporting obligations. A comprehensive AML policy should be developed in line with international standards. Furthermore, the company’s data protection deficiencies must be addressed by relocating its data servers to compliant jurisdictions or securing the necessary permits for the current locations. Updated data protection policies must also be implemented to comply with applicable regulations, such as the Personal Data (Privacy) Ordinance in Hong Kong and, if applicable, the General Data Protection Regulation. These updates should include safeguards such as encryption, access controls, and clear user consent protocols.

The internal control weaknesses also require immediate attention. Formal segregation of roles between sales and finance teams is necessary to prevent conflicts of interest and improve accountability. Sales commissions should no longer be calculated based on signed contracts but instead tied to actual customer payments. The practice of verbal approvals for major contracts must be discontinued in favor of a written approval policy that ensures all material agreements are reviewed and approved at the appropriate level. A formal credit control policy is also required to monitor customer payments and manage overdue accounts effectively. Training sessions should be conducted to educate employees on these new procedures and the importance of compliance.

2. Remedial Actions to Be Taken Immediately

Immediate remedial actions include ceasing all improper revenue recognition practices and conducting an internal audit to identify and resolve any inaccuracies in financial reporting. Financial statements should be restated where necessary to ensure compliance with HKFRS 15. The renewal of the expired Thai payment license should be prioritized, and communication with Thai regulatory authorities should commence without delay. Temporary AML measures, such as basic customer due diligence and transaction monitoring, must be implemented while a comprehensive AML policy is developed. Data servers must either be relocated to compliant jurisdictions or properly licensed, and updated data protection policies should be implemented. Internal control deficiencies should be addressed by formalizing segregation of duties, introducing a written approval process for contracts, and implementing a credit control policy. Immediate training sessions should also be conducted to ensure employee compliance with these new procedures.

3. Structuring Disclosure to Sponsors

Transparency is critical when disclosing these issues to sponsors. A detailed account of the identified issues, along with the steps taken to address them, should be provided. For instance, sponsors should be informed of the improper revenue recognition practices, the corrective actions being implemented, and the impact on financial reporting. The expired Thai payment license and the steps being taken to renew it, along with the implementation of temporary AML measures and updated data protection policies, must also be disclosed. It is important to clearly outline the materiality of each issue and its potential impact on the company’s financial stability, regulatory compliance, and internal controls. Disclosures should include a mitigation plan outlining the actions already taken, their current status, and a timeline for completing outstanding corrective measures. This approach demonstrates the company’s commitment to transparency and compliance with listing requirements.

4. Documentation to Be Prepared

The required documentation includes revised financial statements and audit reports reflecting corrected revenue recognition practices, as well as updated sales contracts and policies prohibiting verbal amendments or side agreements. Documentation of the renewal process for the Thai payment license, temporary AML procedures, and evidence of training sessions should be provided. Updated data protection policies and permits for data servers must also be included. Internal control documentation, such as written approval policies, segregation of duties, and a credit control policy, must be prepared. Disclosure documents explaining the issues, their materiality, and the remedial actions taken should also be included for review by the sponsors.

5. Managing Potential Sponsor Questions

Sponsors are likely to raise questions regarding the impact of incorrect revenue recognition on the company’s financial statements, the timeline for renewing the Thai payment license, and the adequacy of AML measures. Detailed and clear explanations should be prepared to address these concerns, supported by evidence such as revised financial statements, updated policies, and documentation of progress. Questions regarding internal controls, such as the adequacy of segregation between sales and finance teams or the new written approval policy, should also be anticipated. The provision of clear documentation, timelines, and evidence of implementation will be critical in reassuring sponsors of the company’s commitment to compliance and transparency.

Sponsors’ Counsel Perspective

1. Specific Due Diligence to Conduct

Due diligence would focus on verifying the company’s compliance with HKEX Listing Rules and other applicable regulations. For revenue recognition, all contracts, financial statements, and policies must be reviewed to confirm compliance with HKFRS 15. Verification of whether financial statements accurately reflect revenue timing and whether adjustments are required is essential. Any side agreements or verbal contract amendments must be identified and assessed for materiality and potential disclosure.

In regulatory compliance, it is necessary to confirm the status of the Thai payment license and the company’s progress in renewing it. Documentation of communication with Thai regulators and proof of submission for renewal should be examined. AML measures must be reviewed to assess whether they meet regulatory standards, and data protection policies and server compliance must be verified.

For internal control deficiencies, documentation demonstrating efforts to segregate roles between sales and finance, implement written approval processes, and establish a formal credit control policy should be reviewed. The revised sales commission structure must also be examined to ensure it reduces financial risk.

2. Expert Opinions to Require

Independent auditors should confirm that the company’s financial statements comply with HKFRS 15 and accurately reflect revenue timing. Compliance experts should provide reports on the adequacy of the company’s AML measures, data protection policies, and licensing status. Internal control experts may be engaged to assess the sufficiency of the new policies and procedures.

3. Verifying the Remedial Actions

Verification of remedial actions would involve reviewing all supporting documentation, such as correspondence with regulators, updated contracts, and evidence of training sessions. On-site visits may be conducted to confirm the implementation of new systems, such as transaction monitoring for AML compliance. Regular updates from the company should be requested to ensure outstanding measures are being addressed.

4. Additional Documents to Request

Additional documents to request include the company’s complete contract history, internal audit reports, and a timeline of actions taken to address the issues. Confirmations from the company’s board regarding the disclosure of all material issues and the implementation of remedial actions should also be provided.

5. Undertakings and Confirmations to Require

Undertakings and confirmations should include assurances that financial statements have been corrected, licenses have been renewed, and new policies have been implemented. The company should provide undertakings to maintain compliance with AML and data protection regulations and to prevent recurrence of improper revenue recognition practices. These measures ensure the protection of sponsors from potential liabilities and demonstrate the company’s commitment to regulatory compliance.