China
6 regulators · 16 laws & regulations · 15 obligations · 34 enforcement actions · 2 upcoming deadlines
Officially known as the People’s Republic of China (PRC), China is an East Asian superpower that ranks second in the world economy on the basis of nominal GDP.
Regulatory pulse · 90 days
Laws & Regulations Enforcement NewsOverview
Officially known as the People’s Republic of China (PRC), China is an East Asian superpower that ranks second in the world economy on the basis of nominal GDP. Geopolitical and macroeconomic factors make China function as the leading manufacturer on the global level. Yet, it remains preoccupied with making difficult economic transitions, including measures to boost domestic consumption, cope with an aging population, deal with problems in the real estate industry, and develop its green energy base. In connection with all this, the internal operating environment has become highly complicated.
In terms of governance structure, China is considered a centrally governed unitary Marxist-Leninist single-party state under the leadership of the Chinese Communist Party (CCP). There is a high level of centralized regulation for all aspects of society and the economy. The key concerns in terms of governance revolve around technological sovereignty, national security, and stringent systemic risk management. The latest policies indicate a clear attempt to reform the organizational and financial frameworks through the introduction of extensive guidelines set up by the National Financial Regulatory Administration and the People’s Bank of China that are aimed at tightening internal control and stakeholder regulation. At the same time, the State Council makes use of extensive planning frameworks in the form of five-year plans to regulate market access and data flow.
With respect to sanctions and compliance, there has been an evolution of the legal framework into a more aggressive approach. Despite the fact that China adheres to the sanctions imposed by the United Nations through the Ministry of Foreign Affairs, there is a well-developed system of countering sanctions designed to protect domestic entities from foreign countries. Notable changes in this area include regulations for countering improper extraterritorial jurisdiction by foreign states and blocking orders by the Ministry of Commerce (MOFCOM). These orders punish companies for implementing foreign sanctions, including the U.S. Specially Designated Nationals (SDN) list, in mainland territory. In addition, the new measures target foreign due diligence firms.
Thus, regulatory risk for international companies has become a systemic issue due to the emergence of a situation in which “universal compliance” is impossible. The multi-tier structure of laws such as the Data Security Law, the Personal Information Protection Law, and the recently updated Cybersecurity Law requires strict data localization, mandatory reporting of cybersecurity incidents, and annual and bi-annual compliance audits. This becomes more complex due to the recent adoption of the draft Anti-Cross-Border Corruption Law that extends the enforcement of China's anti-corruption measures to foreign companies but also prevents the disclosure of evidence to foreign law enforcement authorities. Thus, from the perspective of international compliance officers, complying with Western sanctions and disclosure regulations can result in serious civil litigation, asset freezes, or business bans in China.
| Law or regulation | Type | Year | Regulator | Source |
|---|---|---|---|---|
| 关于进一步防范和处置虚拟货币等相关风险的通知(银发〔2026〕42号) (Notice on Further Preventing and Dealing with Virtual Currency and Related Risks, Yinfa [2026] No. 42) | Notification | 2026 | PBOC | official |
| 反洗钱特别预防措施管理办法 (Measures for the Administration of Anti-Money Laundering Special Preventive Measures) | Regulation | 2026 | PBOC | official |
| 大型个人信息处理者个人信息保护规定(征求意见稿) (Regulations on Personal Information Protection of Large Personal Information Processors, Draft for Comment) draft | Regulation | 2026 | CAC | official |
| Cybersecurity Law | Act | 2025 | CAC | official |
| 国家网络安全事件报告管理办法 (National Cybersecurity Incident Reporting Management Measures) | Regulation | 2025 | CAC | official |
| 中华人民共和国监察法(2024修正) (Supervision Law of the People's Republic of China, 2024 amendment) | Act | 2024 | — | official |
| 银行保险机构数据安全管理办法(金规〔2024〕24号) (Data Security Management Measures for Banking and Insurance Institutions) | Regulation | 2024 | NFRA | official |
| No instruments match these filters. | ||||
Recent enforcement
Open tracker →| Date | Entity | Regulator | Action | Source |
|---|---|---|---|---|
| Oct 2026 | 中信银行股份有限公司 | SAFE | Disgorgement / Restitution Monetary Penalty | official |
| Oct 2026 | 华夏银行股份有限公司 | SAFE | Disgorgement / Restitution Monetary Penalty | official |
| Sep 2026 | 厦门国际银行股份有限公司珠海分行 | SAFE | Disgorgement / Restitution Monetary Penalty | official |
| Sep 2026 | 中国民生银行股份有限公司 | SAFE | Disgorgement / Restitution Monetary Penalty | official |
| Sep 2026 | 中国建设银行股份有限公司 | SAFE | Disgorgement / Restitution Monetary Penalty | official |
Industry compliance
Essential obligations
All obligations →| Obligation | Timing | Regulator | Source | Detail |
|---|---|---|---|---|
| Conditions for transferring personal information abroad | Before each transfer abroad | CAC | official | |
Art. 38 permits an outbound transfer only on one of: a security assessment under Art. 40, certification by a professional body, a standard contract issued by the cyberspace authority, or another condition in law or treaty. Art. 39 separately requires notice and separate consent. Certification is one option among several, not the only route. |
||||
| Lawful basis, notice and individual rights for personal information | Ongoing | CAC | official | |
Art. 13 lists seven bases for processing, of which consent is one. Art. 17 requires notice before processing covering identity, purpose, methods, categories, retention and how to exercise rights. Arts. 44-50 give rights to know, decide, restrict, refuse, access, copy, transfer, correct, delete and obtain explanation of rules. |
||||
| Personal information protection officer, audits and impact assessments | Ongoing; impact assessment before the activity | CAC | official | |
Art. 52 requires processors above the regulator's volume threshold to appoint a responsible person and report their contact details. Art. 54 requires regular compliance audits. Arts. 55-56 require a prior impact assessment for sensitive data, automated decisions, entrusted processing, sharing, disclosure and cross-border transfers, with records kept at least three years. |
||||
| Report cybersecurity incidents within 1, 2 or 4 hours | 1 hour (CII operators), 2 hours (central government departments), 4 hours (others) | CAC | official | |
For incidents rated larger or above, Art. 4 requires critical information infrastructure operators to report as soon as possible and within 1 hour, central government departments and their direct subordinate units within 2 hours, and other operators to the provincial cyberspace authority within 4 hours. Art. 8 requires a summary report within 30 days after handling ends. |
||||
| Sign a written employment contract within one month of starting work | Within one month of the start of work | — | source | |
Art. 10 requires a written contract to be signed within one month of the start of work where none exists. Art. 82 requires double wages for each month of failure beyond one month and under one year. Art. 4 requires rules affecting workers' interests to be discussed with the staff congress or all staff and publicised. |
||||
| Account due diligence and suspicious account monitoring against telecom fraud | Ongoing | — | source | |
Arts. 15-20 require banks and payment institutions to run due diligence and identify beneficial owners, scrutinise or refuse abnormal account openings within national account limits, monitor accounts and payments for fraud patterns (with powers to delay payments or restrict services), transmit accurate merchant and payer data, and cooperate in freezing suspected fraud funds. Art. 40 sets fines of RMB 50,000 to 5,000,000. |
||||
| No obligations match these filters. | ||||
Quick links — official sites
Newsletter
Get CRCGS Weekly
A free weekly email from the Centre for Risk, Compliance & Governance Studies: the week's regulatory news, new regulations, updated country profiles, and the Knowledge Hub's latest reading and events.




