1. What happened
On Tuesday afternoon, 22 September, a Hong Kong-based Morgan Stanley employee sent an email with an attached file detailing more than 100 deals in the bank's pipeline, the South China Morning Post reported, citing several sources familiar with the matter. Bloomberg News, which reported the leak on Wednesday and says it has seen a copy verified by people familiar with it, describes an internal document listing investment-banking deals the firm is pitching and monitoring.
The bank later sent a second email asking recipients not to open the attachment. By then, according to the Post's sources, the list had already been widely circulated in the financial sector. Bloomberg reports that a blurred copy was also posted online.
2. What was in the file
According to the Post's sources, the document named the companies and institutional investors involved in each deal. It covered initial public offerings, private equity arrangements, pension fund positions and other projects, at every stage: pitches, ongoing discussions and deals put on hold. Bloomberg adds that the list focused mostly on Asia and also covered Europe, the Middle East and Africa.
Morgan Stanley confirmed the incident. In a statement to Bloomberg, it said it takes client confidentiality extremely seriously, adding: "We promptly took steps to address this inadvertent sharing of information and we continue to engage with relevant parties." It has not detailed what those steps were or which parties it has contacted.
3. Why it matters: the pipeline is the product
An investment bank sells two things: execution and discretion. A pipeline list is the map of both. It tells rivals which companies Morgan Stanley is courting, it tells clients' competitors who is preparing to raise money, and it tells investors which private equity and pension funds are positioned in which deals. The Post reports the leak alarmed Hong Kong's banking industry, listed issuers and regulators.
The timing sharpens the damage. Hong Kong has just had its strongest first half for listings in five years, and Morgan Stanley is one of its leading underwriters: the Post says it was the second-largest bookrunner for IPOs and other equity fundraising in Hong Kong in the first half of 2026.
4. The legal exposure
Two distinct risks follow. The first is for the bank: client confidentiality obligations and the controls that are meant to keep deal information inside a restricted group. The second is for everyone who received the file: some of what it contains could be price-sensitive information on listed companies, which is why any unusual trading in names on the list will draw scrutiny.
The episode also lands on an old wound. In January 2024, Morgan Stanley paid about 249 million dollars to settle US Securities and Exchange Commission and Justice Department cases over its block-trading business. The SEC found that from 2018 to 2021, the head of its US equity syndicate desk, Pawan Passi, and another employee disclosed confidential information about upcoming block trades to investors, and charged the bank with failing to enforce its information barriers.
WHAT TO WATCH
Regulators. Whether Hong Kong's Securities and Futures Commission, or regulators in India and South Korea, open an inquiry into the leak or into trading around the named companies.
Clients. Whether any issuer or fund on the list changes bank, or delays a transaction.
Trading. Unusual price moves in listed companies named on the file would be the first place regulators look.
Controls. Whether Morgan Stanley tightens how pipeline documents are shared internally, and says so.