On 9 January 2026, the Hong Kong Court of First Instance granted an interim injunction order in civil proceedings brought by the Hong Kong Securities and Futures Commission (SFC). The order was obtained under section 213 of the Hong Kong Securities and Futures Ordinance (SFO). It targets seven defendants alleged to have manipulated shares of Wan Cheng Metal Packaging Company Limited (Wan Cheng) (stock code: 8291). Three defendants are prohibited from removing, disposing of, or diminishing assets in Hong Kong up to HK$85.2 million. The asset freeze remains in effect until the next hearing on 13 March 2026. The SFC alleges the defendants are part of a sophisticated syndicate. The syndicate is suspected of orchestrating a ramp and dump scheme involving Wan Cheng shares between 22 December 2020 and 23 April 2021. Criminal proceedings against four defendants are ongoing at the District Court with the trial scheduled to commence on 14 September 2026.

Understanding Ramp and Dump Schemes under Hong Kong Regulations

This enforcement action involves parallel civil and criminal proceedings instituted by the SFC against an alleged sophisticated ramp and dump syndicate. As explained by the SFC in its press release dated 3 August 2023, a social media ramp and dump scam is “a form of stock market manipulation where fraudsters use different means to ‘ramp’ up the share price of a listed company and then induce investors via social media platforms to purchase the shares they ‘dump’ at an artificially high price.”

In this case, a syndicate is suspected of orchestrating a complex ramp and dump scheme involving shares in Wan Cheng Metal Packaging Company Limited (stock code: 8291), which has changed its name to Hong Kong Entertainment International Holdings Limited in 4 June 2024. The scheme is alleged to have involved the use of social media platforms to induce investors to purchase shares at artificially inflated prices. The alleged manipulation occurred between 22 December 2020 and 23 April 2021.

The SFC’s investigation spanned over three years and has involved cooperation from international authorities (including Department of Justice of Hong Kong, the Hong Kong Police Force, the International Criminal Police Organization, the Attorney General’s Chambers of Singapore, the Monetary Authority of Singapore, and the Singapore Police Force) and the first ever INTERPOL Red Notice obtained by the SFC for an SFO offence. This is also the first time a ramp-and-dump case was transferred to the District Court for criminal prosecution. The case marks several firsts for the SFC in its enforcement of ramp and dump market manipulation.

The SFC characterised the scheme, which was of a four-month duration, as both “large-scale” and “sophisticated”, resulting in the HK$85.2 million asset freeze in civil proceedings brought by the SFC. For details of the case and enforcement action by the SFC, please refer to the timeline below.

Developments in Proceedings against the Ramp and Dump Syndicate

The enforcement timeline spans over three years and involves multiple proceedings across different courts and jurisdictions.

3 August 2023: Mr Stevens Yip Chi Fai (Yip) and Ms So Lung Ying (So) were charged at the Eastern Magistracy. The SFC suspects that they are core members of a large-scale and sophisticated syndicate suspected of ramp-and-dump market manipulation. They were charged with conspiracy to employ a scheme with intent to defraud or deceive in transactions involving securities contrary to section 300 of the SFO and sections 159A and 159C of the Crimes Ordinance. No plea was taken and the court granted Yip and So a cash bail of HK$500,000 and HK$50,000 respectively.

29 January 2024: In addition to the two suspects previous identified, Mr Lau Ka Wing (Lau) was charged at the Eastern Magistracy as being a core member of the syndicate. He was charged with the same offence as Yip and So and a cash bail of HK$400,000 has been granted.

8 February 2024: The Eastern Magistrates’ Court granted an application by the Department of Justice to transfer the case involving Yip and So to the District Court. This is the first ramp-and-dump case to be transfer to the District Court for criminal prosecution.

27 February 2024: The first hearing in the District Court took place. The case was adjourned with the prosecution intending to apply for the case of Yip and So to be consolidated with the case involving Lau.

25 April 2024: The District Court granted the consolidation application. All three defendants, Yip, So, and Lau, appeared at the District Court.

4 October 2024: Ms Chan Sin Ying (Chan) appeared at the Eastern Magistrates’ Courts facing charges related to the ramp-and-dump scheme. She is accused of conspiring with three individuals, Yip, So and Lau and others to employ a fraudulent or deceptive scheme in securities transactions, contrary to section 300 of the SFO and sections 159A and 159C of the Crimes Ordinance.

Chan fled Hong Kong the day after the SFC searched her residence in November 2022 and remained uncontactable. An arrest warrant was issued, and she was placed on an INTERPOL Red Notice. Following further investigation, she was located in Singapore and arrested by local authorities on 18 July 2024. On application made under the Fugitive Offenders (Singapore) Order, Chapter 503Q of the Laws of Hong Kong, Chan was surrendered to Hong Kong on 3 October 2024.

This marks the first time the SFC has coordinated with international authorities to name an individual on the INTERPOL Red Notice and to secure the surrender of a fugitive wanted for prosecution under the SFO.

Chan’s bail application was rejected by the Court and she was remanded in custody.

15 April 2025: All four defendants pleaded not guilty and the District Court fixed the trial date for the criminal proceedings to be 14 September 2026.

9 January 2026: The Court of First Instance granted the interim injunction order freezing assets up to HK$85.2 million against three of the seven defendants in the section 213 civil proceedings.

Ramp and Dump actionable under Criminal Charges Pursuant to Section 300 Hong Kong SFO

All four defendants in the criminal proceedings are charged with the same offence: conspiracy to employ a scheme with intent to defraud or deceive in transactions involving securities contrary to section 300 of the SFO and sections 159A and 159C of the Crimes Ordinance.

Under section 300 of the SFO, it is an offence where a person (directly or indirectly), in a transaction involving securities, future contracts or leveraged foreign trading employ any device, scheme or artifice with intent to defraud or deceive or engage in any act, practice or course of business which is fraudulent or deceptive, or would operate as a fraud or deception A person who commits an offence under section 300 of the SFO is liable on conviction on indictment to a fine of $10,000,000 and to imprisonment for 10 years. Section 300 of the SFO is one of the principal criminal provisions targeting fraudulent and deceptive schemes in securities transactions.

The Hong Kong Court of First Instance Orders Interim Injunction Under Section 213 SFO

The SFC also brought civil proceedings under section 213 of the SFO which sought restoration orders against seven defendants. Section 213 of the SFO allows the Court of First Instance to make orders, including injunctions and restoration orders against a person who has contravened any relevant provision of the SFO. The interim injunction serves to secure assets within the jurisdiction to ensure that any restoration orders which may be made by the Court can be satisfied.

The Court of First Instance granted an interim injunction order on 9 January 2026. Under the Court order, three of the defendants are prohibited from (i) removing any of their assets which are within Hong Kong, or (ii) in any way disposing of or dealing with or diminishing the value of any of their assets which are within Hong Kong, up to the value of $85.2 million. As set out in the SFC’s 9 January 2026 press release, the interim injunction order serves to ensure that there are sufficient assets to meet the restoration orders sought by the SFC, if Hong Kong courts find the defendants in the proceedings in contravention of the relevant provisions of the SFO. The interim injunction order remains in effect until the next hearing for the civil proceedings on 13 March 2026.

Key Reminders for Licensed Persons and Role Specific Obligations

Beyond the specific facts of the enforcement action, licensed persons should consider the possible implications for their own compliance and conduct. The following analysis highlights key takeaways and reminders to help firms strengthen their internal controls and foster a culture of integrity. This analysis is for general reference only and does not constitute legal advice. Licensed persons should seek independent professional advice tailored to their specific circumstances.

Obligations for Licensed Corporations and Persons

The Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission (Code of Conduct) imposes specific obligations on licensed corporations relevant to combatting ramp-and-dump schemes. These obligations include, under General Principles 1 and 2, a general duty to act in the best interests of clients and uphold market integrity. Paragraph 5.1 requires licensed corporations to take all reasonable steps to establish clients’ true and full identities, as well as their financial situation, investment experience, and investment objectives. Paragraph 5.4 further requires licensed corporations to be satisfied as to the identity, address, and contact details of the person or entity ultimately responsible for originating a transaction instruction, as well as the person or entity that stands to gain the commercial or economic benefit from the transaction or bear its risk, and to verify the instruction given by such person or entity. Additionally, paragraph 12.5(f) obliges licensed corporations to report to the SFC any material breach, infringement, or non-compliance with the market misconduct provisions set out in Part XIII or Part XIV of the SFO by their clients. To meet these requirements, licensed corporations should ensure that proper measures and controls are implemented in client onboarding procedures and client and transaction monitoring processes.

Ramp and dump schemes may also be particularly relevant to corporations licensed to carry out the following types of regulated activities:

Type 1 (Dealing in Securities): The alleged ramp and dump scheme involved the manipulation of listed securities on The Stock Exchange of Hong Kong. Type 1 intermediaries executing client orders in shares targeted by ramp and dump syndicates may become unwitting conduits for the manipulative scheme if they fail to detect and report suspicious trading patterns. Licensed corporations must ensure that their order execution and surveillance systems are capable of identifying anomalous trading activity consistent with ramp and dump patterns, including sudden price and volume spikes, concentrated buying from multiple accounts, and subsequent rapid selling.

Type 4 (Advising on Securities): Type 4 licence holders recommending shares targeted by ramp and dump syndicates face the risk of facilitating the “dump” phase of the scheme. Advisers must exercise heightened due diligence when collating market information and recommending shares that have experienced unusual price and volume movements. Social media driven investment narratives about small cap or GEM listed stocks should trigger enhanced scrutiny.

Type 7 (Providing Automated Trading Services): Type 7 licence holders operating trading platforms or dark pools must ensure that their surveillance systems are calibrated to detect ramp and dump patterns. Automated trading systems must incorporate pre-trade and post-trade controls capable of identifying and blocking orders that form part of a manipulative scheme.

Type 9 (Asset Management): Type 9 licence holders managing portfolios that include listed securities must ensure that their investment decision making process is insulated from social media driven market narratives. Portfolio managers must exercise independent judgment and apply enhanced scrutiny to investments in securities exhibiting price and volume anomalies consistent with ramp and dump activity.

Role Specific Compliance Obligations

Responsible Officers (ROs): ROs bear supervisory responsibility for ensuring that the licensed entity maintains adequate systems and controls to detect and prevent market manipulation. ROs must ensure that suspicious transaction reporting procedures are in place and operating effectively.

Managers in Charge (MICs): MICs of the Core Function of Dealing bear direct responsibility for the integrity of order execution processes and the detection of manipulative trading patterns. MICs of the Core Function of Compliance must ensure that the firm’s surveillance systems are calibrated to detect ramp and dump indicators, including nominee trading clusters, sudden volume spikes in small cap stocks, and correlated social media activity. MICs of the Core Function of Risk Management must assess the firm’s exposure to reputational and legal risk arising from client participation in manipulative schemes.

Directors: Directors of listed companies whose shares are the subject of ramp and dump schemes face potential liability under the SFO if they are found to have been complicit in or to have facilitated the manipulation. Directors must ensure that the company’s share registrar information is monitored for unusual changes in shareholding patterns and that any suspicious activity is reported to the SFC and The Stock Exchange of Hong Kong.

Independent Non-Executive Directors (INEDs): INEDs of both licensed intermediaries and listed companies must exercise independent oversight of compliance and surveillance systems. Where unusual trading activity in the company’s shares is identified, INEDs should ensure that the board investigates and, where appropriate, reports the matter to the relevant authorities.

Red Flag Loopholes and Pattern Indicators

Ramp and Dump Misconduct Indicators

The enforcement action and the broader Wan Cheng prosecution reveal several misconduct indicators that compliance teams must be equipped to detect.

Nominee Networks and Beneficial Ownership Opacity: Ramp and dump syndicates typically employ networks of nominee accounts to accumulate shares during the “ramp” phase and distribute them during the “dump” phase. “Large-scale and sophisticated” syndicates may use multiple nominee structures to disguise beneficial ownership and create the appearance of broad based market interest. Compliance teams must implement beneficial ownership verification procedures that go beyond the registered holder and identify the ultimate beneficial owner of trading accounts.

Trading Clusters and Correlated Activity: The alleged scheme involved multiple syndicate members executing coordinated transactions. Compliance teams must deploy surveillance systems capable of identifying clusters of trading activity across multiple accounts that exhibit correlated patterns, including contemporaneous buying, sequential order placement, and coordinated selling at elevated prices.

Unusual Trading Activity: The SFC has also set out examples of unusual trading activities in its circular dated 29 June 2021 which may indicate a potential ramp and dump scheme. Licensed corporations should remain vigilant for clients whose transaction amounts are generally incommensurate with their reported profiles, such as an unemployed individual with limited trading experience conducting a large volume of trades in a short period. Other red flags include clients who regularly acquire shares through bought and sold notes or free-of-payment transfers, receive large third-party deposits, or engage in suspicious timing patterns—for instance, buying shares on a delayed settlement basis and selling them before the payment date following a substantial price rise, or trading near the close to artificially raise the closing price of thinly-traded, small-cap stocks. Further scrutiny is warranted where clients sell large volumes shortly before an unexplained share price collapse, particularly if they seek early release of funds.

Social Media Driven Price Movements: The SFC’s definition of a social media ramp and dump scam expressly references the use of social media platforms to induce investors to purchase shares at artificially inflated prices. Compliance teams should monitor social media channels for coordinated promotional activity targeting specific listed securities, particularly small cap or GEM listed stocks. Unusual social media activity coinciding with price and volume spikes should trigger enhanced surveillance.

Cross Border Dimensions: The involvement of Singapore in the arrest and surrender of Chan indicates that ramp and dump syndicates may have cross border dimensions. Compliance teams should be alert to the use of offshore accounts, cross border fund transfers, and foreign nominee structures to facilitate market manipulation.

Linkages to SFC Surveillance Typologies

Ramping Patterns: The SFC’s surveillance framework identifies “ramping” as a pattern involving the artificial inflation of a security’s price through coordinated buying, often using multiple accounts controlled by the same beneficial owner(s) or syndicate. The Wan Cheng case exemplifies this typology. Compliance systems must be calibrated to detect sequential or contemporaneous buying across multiple accounts in the same security, particularly where the accounts share common characteristics such as the same introducer, same authorised third party to manage the accounts, similar account opening dates, linked funding sources or sharing common personal particulars like telephone numbers or email addresses.

Anti-Money Laundering (AML) Linkages: Ramp and dump schemes generate proceeds from the sale of artificially inflated securities. These proceeds constitute the proceeds of crime for the purposes of the Organized and Serious Crimes Ordinance (OSCO) and the Anti Money Laundering and Counter Terrorist Financing Ordinance (AMLO). Licensed intermediaries must ensure that suspicious transaction reports (STRs) are filed with the Joint Financial Intelligence Unit (JFIU) where there are grounds to suspect that a client’s trading activity is connected to a ramp and dump scheme.

Hong Kong Compliance Recommendations

Deploy Surveillance Triggers

Licensed intermediaries should implement the following surveillance triggers:

• Automated alerts for price movements exceeding defined thresholds in GEM listed or small cap securities, with lower trigger points than those applied to Main Board securities.
• Volume alerts for securities experiencing trading volumes materially above their historical averages or the client’s reported profiles, particularly where the volume increase coincides with social media promotional activity.
• Account clustering alerts to identify multiple accounts trading the same security in a correlated pattern, including accounts sharing common introducers, linked funding sources, similar account opening dates, or matching personal information.
• Cross account monitoring to detect the transfer of securities between accounts controlled by the same beneficial owner or connected persons prior to a price spike.
• Post trade surveillance to identify the “dump” phase, characterised by rapid selling at elevated prices following a period of accumulation and price inflation.
• Unusual trading alerts where trading activity display characteristics as identified above.

AML and Counter-Financing of Terrorism (CFT) measures

Licensed intermediaries should implement the following AML and CFT measures:

• Prohibit the use of anonymous accounts or accounts opened with fictitious names.
• Licensed intermediaries must ensure that ramp and dump indicators are integrated into their AML risk assessment frameworks.
• Client accounts involved in trading patterns consistent with ramp and dump activity should be subject to enhanced due diligence, including source of funds and source of wealth verification.
• Further examination on transactions that are complex, large, and unusual and have no apparent economic or lawful purpose.
• Suspicious transaction reports must be filed with the JFIU where there are reasonable grounds to suspect that a client’s trading activity is connected to market manipulation or that the proceeds of such manipulation are being laundered through the firm’s accounts.
• Transaction monitoring systems must be configured to detect layering patterns, including the rapid movement of funds following the liquidation of positions in securities subject to price manipulation.

Due Diligence on Client Accounts

Licensed intermediaries should implement the following Due Deligence on client records:

• Licensed intermediaries must conduct enhanced due diligence on clients trading in GEM listed or small cap securities that exhibit ramp and dump indicators.
• Account opening procedures must include verification of beneficial ownership, with specific enquiries to identify nominee arrangements, powers of attorney, and third party instructions. These procedures may also include identifying the client’s source of wealth and source of funds, and applying enhanced due diligence measures in all high-risk situations.
• Ongoing monitoring must include periodic review of client trading patterns, with escalation to compliance where a client’s activity is inconsistent with their stated investment objectives or risk profile.
• Intermediaries should consider implementing enhanced KYC requirements for clients who trade predominantly in GEM listed or small cap securities, including more frequent reviews and lower thresholds for suspicious activity reporting.

Governance Frameworks

Licensed intermediaries should implement the following governance frameworks:

• Boards and senior management of licensed intermediaries must establish governance structures that ensure:
• A dedicated market surveillance function with sufficient resources and technology to detect ramp and dump patterns across all traded securities.
• Regular reporting to the board on surveillance alerts, investigations, and suspicious transaction reports filed with the JFIU, with specific reporting on ramp and dump indicators.
• Clear allocation of responsibility among ROs, MICs, and senior management for market surveillance, suspicious activity reporting, and engagement with the SFC’s enforcement division.
• A compliance culture that encourages the reporting of suspicious trading activity and protects whistleblowers from retaliation.
• Regular training of staff members on the red flag indicators of ramp and dump schemes.

Escalation Pathways

Licensed intermediaries must establish formal escalation pathways that require:

• Immediate escalation to the MIC for Compliance and the RO upon identification of trading patterns consistent with ramp and dump activity.
• Timely filing of suspicious transaction reports with the JFIU, with documented rationale for the filing and the supporting evidence.
• Engagement with the SFC’s enforcement division where the intermediary has identified trading activity that may form part of a broader manipulative scheme.
• Escalation to the board where the identified suspicious activity involves senior clients, large transaction volumes, or potential reputational risk to the firm.
• Preservation of all relevant records, including trading data, client communications, surveillance alerts, and internal investigation notes, in anticipation of potential regulatory enquiry.

Independent Audits

Licensed intermediaries should engage independent auditors to:

• Conduct periodic reviews of the firm’s market surveillance systems, testing their effectiveness in detecting ramp and dump patterns against simulated scenarios and historical case studies.
• Audit the firm’s suspicious transaction reporting procedures, including the timeliness, quality, and completeness of reports filed with the JFIU.
• Review the firm’s AML framework for its integration of market manipulation indicators, including ramp and dump typologies.
• Assess the firm’s compliance with the SFC’s Code of Conduct, including paragraphs 5.1A (investor characterisation), 5.3 (derivative products), and 12.5 (reporting of misconduct).
• Evaluate the firm’s governance framework for market surveillance and enforcement cooperation, including the adequacy of escalation pathways and board reporting.