Back to all jurisdictions

China

CN · CHN · Asia-Pacific

6 regulators · 16 laws & regulations · 15 obligations · 34 enforcement actions · 2 upcoming deadlines

Officially known as the People’s Republic of China (PRC), China is an East Asian superpower that ranks second in the world economy on the basis of nominal GDP.

China — hero image

Regulatory pulse · 90 days

Laws & Regulations Enforcement News
18 AUGSEPOCT15 NOV · TODAY

Overview

Officially known as the People’s Republic of China (PRC), China is an East Asian superpower that ranks second in the world economy on the basis of nominal GDP. Geopolitical and macroeconomic factors make China function as the leading manufacturer on the global level. Yet, it remains preoccupied with making difficult economic transitions, including measures to boost domestic consumption, cope with an aging population, deal with problems in the real estate industry, and develop its green energy base. In connection with all this, the internal operating environment has become highly complicated.

In terms of governance structure, China is considered a centrally governed unitary Marxist-Leninist single-party state under the leadership of the Chinese Communist Party (CCP). There is a high level of centralized regulation for all aspects of society and the economy. The key concerns in terms of governance revolve around technological sovereignty, national security, and stringent systemic risk management. The latest policies indicate a clear attempt to reform the organizational and financial frameworks through the introduction of extensive guidelines set up by the National Financial Regulatory Administration and the People’s Bank of China that are aimed at tightening internal control and stakeholder regulation. At the same time, the State Council makes use of extensive planning frameworks in the form of five-year plans to regulate market access and data flow.

With respect to sanctions and compliance, there has been an evolution of the legal framework into a more aggressive approach. Despite the fact that China adheres to the sanctions imposed by the United Nations through the Ministry of Foreign Affairs, there is a well-developed system of countering sanctions designed to protect domestic entities from foreign countries. Notable changes in this area include regulations for countering improper extraterritorial jurisdiction by foreign states and blocking orders by the Ministry of Commerce (MOFCOM). These orders punish companies for implementing foreign sanctions, including the U.S. Specially Designated Nationals (SDN) list, in mainland territory. In addition, the new measures target foreign due diligence firms.

Thus, regulatory risk for international companies has become a systemic issue due to the emergence of a situation in which “universal compliance” is impossible. The multi-tier structure of laws such as the Data Security Law, the Personal Information Protection Law, and the recently updated Cybersecurity Law requires strict data localization, mandatory reporting of cybersecurity incidents, and annual and bi-annual compliance audits. This becomes more complex due to the recent adoption of the draft Anti-Cross-Border Corruption Law that extends the enforcement of China's anti-corruption measures to foreign companies but also prevents the disclosure of evidence to foreign law enforcement authorities. Thus, from the perspective of international compliance officers, complying with Western sanctions and disclosure regulations can result in serious civil litigation, asset freezes, or business bans in China.

Recent enforcement

Open tracker →
Enforcement actions in China
Date Entity Regulator Action Source
Oct 2026 中信银行股份有限公司 SAFE Disgorgement / Restitution Monetary Penalty official
Oct 2026 华夏银行股份有限公司 SAFE Disgorgement / Restitution Monetary Penalty official
Sep 2026 厦门国际银行股份有限公司珠海分行 SAFE Disgorgement / Restitution Monetary Penalty official
Sep 2026 中国民生银行股份有限公司 SAFE Disgorgement / Restitution Monetary Penalty official
Sep 2026 中国建设银行股份有限公司 SAFE Disgorgement / Restitution Monetary Penalty official

Essential obligations

All obligations →
Obligation Timing Regulator Source Detail
Conditions for transferring personal information abroad Before each transfer abroad CAC official
Lawful basis, notice and individual rights for personal information Ongoing CAC official
Personal information protection officer, audits and impact assessments Ongoing; impact assessment before the activity CAC official
Report cybersecurity incidents within 1, 2 or 4 hours 1 hour (CII operators), 2 hours (central government departments), 4 hours (others) CAC official
Sign a written employment contract within one month of starting work Within one month of the start of work — source
Account due diligence and suspicious account monitoring against telecom fraud Ongoing — source

Quick links — official sites

Newsletter

Get CRCGS Weekly

A free weekly email from the Centre for Risk, Compliance & Governance Studies: the week's regulatory news, new regulations, updated country profiles, and the Knowledge Hub's latest reading and events.

Free. We first email you a link to confirm the address; you can unsubscribe at any time. How we handle your address: our Privacy Policy.