China

Art. 38 permits an outbound transfer only on one of: a security assessment under Art. 40, certification by a professional body, a standard contract issued by the cyberspace authority, or another condition in law or treaty. Art. 39 separately requires notice and separate consent. Certification is one option among several, not the only route.

Art. 13 lists seven bases for processing, of which consent is one. Art. 17 requires notice before processing covering identity, purpose, methods, categories, retention and how to exercise rights. Arts. 44-50 give rights to know, decide, restrict, refuse, access, copy, transfer, correct, delete and obtain explanation of rules.

Art. 52 requires processors above the regulator's volume threshold to appoint a responsible person and report their contact details. Art. 54 requires regular compliance audits. Arts. 55-56 require a prior impact assessment for sensitive data, automated decisions, entrusted processing, sharing, disclosure and cross-border transfers, with records kept at least three years.

For incidents rated larger or above, Art. 4 requires critical information infrastructure operators to report as soon as possible and within 1 hour, central government departments and their direct subordinate units within 2 hours, and other operators to the provincial cyberspace authority within 4 hours. Art. 8 requires a summary report within 30 days after handling ends.

Art. 10 requires a written contract to be signed within one month of the start of work where none exists. Art. 82 requires double wages for each month of failure beyond one month and under one year. Art. 4 requires rules affecting workers' interests to be discussed with the staff congress or all staff and publicised.

Arts. 15-20 require banks and payment institutions to run due diligence and identify beneficial owners, scrutinise or refuse abnormal account openings within national account limits, monitor accounts and payments for fraud patterns (with powers to delay payments or restrict services), transmit accurate merchant and payer data, and cooperate in freezing suspected fraud funds. Art. 40 sets fines of RMB 50,000 to 5,000,000.

Art. 29 requires due diligence when a business relationship is established or a one-off service above a set amount is provided, when money laundering is reasonably suspected, or when earlier identity data is doubtful, including identifying the beneficial owner (defined in Art. 19). Art. 28 bars anonymous or fictitious-name accounts.

Art. 27 requires institutions to build an AML internal control system and set up a dedicated body or designate an internal unit to lead AML work; the institution's head is responsible for implementing it. The text does not use the term compliance officer.

Art. 16 requires financial institutions, once a customer or counterparty is found on a list, to take special preventive measures immediately (stop services, funds and asset transfers) without advance notice (Art. 3). Arts. 13-15 require screening when a list is issued or changed, at account opening and on identity-data changes. Art. 18 requires prompt written reports to the PBOC.

Art. 69 requires banking and insurance institutions to report data security incidents to the NFRA or its local office within 2 hours and to submit a written report within 24 hours. For especially major incidents they must also act immediately, notify users as required and report to the local public security authority, with updates every 2 hours until handling ends. A post-incident assessment and improvement report is due within 5 working days after handling ends.

Art. 37 requires banking and insurance institutions to report to the regulator (the CBIRC when issued, now NFRA) or its local office 20 working days before signing contracts for whole-IT, whole-data-centre, major-architecture, strategic-consulting, qualifying off-site, related-party and cross-border outsourcing. Art. 11 bars outsourcing of IT strategy, IT risk management and IT internal audit; Art. 5 bars outsourcing of IT management and cybersecurity responsibility.

Art. 34 requires customer identity records to be kept for at least ten years after the business relationship ends, and transaction records for at least ten years after the transaction.

Art. 6 requires PBOC approval and a payment business licence, and the name must include 'zhifu' (支付). Art. 8 sets minimum paid-in capital of RMB 100 million, which the PBOC may raise. Art. 10 gives the PBOC six months from acceptance to decide. Art. 47 penalises unlicensed operation.

Arts. 27-29 bar misuse of customer reserve funds, require the ratio of net assets to the average daily reserve balance to meet PBOC requirements (Art. 28) and require the funds to be held at the PBOC or approved banks (Art. 29). Art. 21 bars outsourcing of core business and technical services involving fund or information security; Arts. 18-19 require systems, backups and domestic transaction data to be kept in China.

Art. 64 names real estate developers and agents, accountants, law firms and notaries (when handling specified client transactions), dealers in precious metals and gems above a set amount, and others the AML authority designates. Art. 42 applies AML duties to them for specified activities, scaled to risk. Art. 58 sets fines up to RMB 50,000 for lesser breaches and RMB 50,000 to 500,000 for serious or uncorrected ones.