Compliance and Investigations in China

What compliance in China involves

Compliance in China covers the rules a business must follow to avoid corruption, fraud, money laundering, smuggling and national security violations, and the way a company responds when something goes wrong. For a multinational, the work sits at the intersection of two systems. Chinese law sets the substantive offences, the investigative powers of the authorities and strict limits on what information can leave the country. Home-country laws, such as the US Foreign Corrupt Practices Act, the UK Bribery Act and sanctions regimes, reach conduct in China and create expectations about how a company investigates and reports.

The practical consequence is that a programme or investigation designed for only one system tends to fail in the other. A programme modelled solely on US guidance may ignore Chinese rules on employee data, state secrets and the provision of evidence abroad. A purely local response may leave a parent company unable to show its home regulator that it found the facts and remediated. Our compliance and investigations practice is built to bridge that gap, for foreign companies operating in China and for Chinese companies whose business, listings or financing take them abroad.

The regulatory landscape for compliance in China

The enforcement environment has changed markedly since 2023. Anti-corruption work has extended from officials to those who pay bribes and to private companies. Financial crime rules have been modernised. National security legislation now shapes how information is gathered, stored and shared. The table below summarises the main instruments a compliance function should track.

Three themes run through this landscape. First, enforcement is coordinated: a matter that starts with a market regulator or customs can become a criminal case, and administrative findings increasingly feed civil claims. Second, both the company and responsible individuals are exposed. Chinese law recognises unit crime, so a company can be prosecuted alongside its managers.

Third, information control is now a compliance risk in its own right. Article 36 of the Data Security Law and Article 41 of the Personal Information Protection Law prevent data and personal information stored in China from being provided to foreign judicial or law enforcement bodies without approval, and the International Criminal Judicial Assistance Law contains a similar restriction for criminal matters. The full texts are available from the NPC national database of laws and regulations.

China has also built incentives for good compliance. Since a pilot launched by the Supreme People's Procuratorate in 2020 and extended nationwide in 2022, prosecutors may take a company's commitment to an effective programme into account when deciding whether to prosecute or what sentence to recommend. State-owned enterprises are subject to dedicated compliance management rules, and the revised Company Law requires state-funded companies to strengthen internal compliance management. Policy material from the Supreme People's Procuratorate on corporate compliance reform is a useful reference for any foreign-invested enterprise.

How the enforcers interact

Enforcement of compliance in China is not siloed. Supervisory commissions investigate officials and refer non-official suspects, including bribe-givers, to the police and procuratorate. Market regulators that find commercial bribery above criminal thresholds transfer the case to the public security organs. Customs post-clearance audits can lead to referrals to the anti-smuggling police, and tax inspections can uncover invoice fraud that becomes criminal. Financial regulators share information with the PBOC on suspicious flows.

For companies, this means the first authority to make contact is not necessarily the last, and an administrative matter should be handled with an eye to how it would look if it became criminal. Consistency between what is said to each authority, and to foreign regulators and auditors, is essential. A short matter log, recording each contact, request and response, makes that consistency much easier to achieve and gives the board a reliable picture of where the company stands at any moment.

Who we work with and the risks they face

Our clients fall into three broad groups. Foreign companies with operations, distributors or suppliers in China need programmes that satisfy both their home regulator and Chinese law, and support when allegations arise. Chinese companies listed abroad, or with overseas subsidiaries, face foreign regulators, auditors and lenders whose requests have to be reconciled with Chinese restrictions on data, archives and evidence. Investors, boards and individuals, including foreign executives and researchers in China, need clear information about their personal exposure and about how to respond if the authorities make contact.

Building a roadmap

For a company starting or refreshing its approach to compliance in China, a practical sequence is: a China-specific risk assessment; a gap review of policies, controls and third-party arrangements against both Chinese law and the parent's home regulators; an investigation and dawn raid protocol; targeted training for high-risk functions; and periodic testing. Each step should produce documents that show what was found and what was done, because evidence of operation is what authorities examine when something goes wrong. Smaller subsidiaries can adopt a lighter version, provided the risk-based reasoning is recorded.

Our compliance and investigations services

The practice is organised around thirteen areas. Each page explains the Chinese legal environment, the cross-border issues and the practical steps that matter most.

• Corporate compliance programmes: designing, testing and documenting programmes that work under Chinese law and international standards, including risk assessment, third-party controls and compliance as a mitigation factor in prosecutorial decisions.
• Anti-bribery and corruption: official and commercial bribery under the Criminal Law and the Anti-Unfair Competition Law, alongside the FCPA and UK Bribery Act, with a focus on high-risk channels such as distributors, healthcare and procurement.
• Anti-money laundering: the revised AML Law, beneficial ownership filing, customer due diligence and sanctions screening for financial institutions, fintech businesses and designated non-financial businesses.
• Internal and government investigations: scoping and running internal investigations in China, handling dawn raids and regulator enquiries, and managing employees, evidence and data lawfully.
• Cross-border regulatory investigations: responding to the US Department of Justice, the SEC, OFAC, the UK Serious Fraud Office and other foreign authorities while respecting Chinese blocking, data and evidence rules.
• White-collar crime: fraud, embezzlement, duty encroachment, illegal fund-raising, tax invoice and securities offences affecting companies as victims or suspects, and their managers.
• Criminal defence: what happens when a foreign national or executive is detained, how the Chinese criminal process works, and how families and employers coordinate with licensed PRC defence counsel and consular officials.
• Smuggling cases: customs undervaluation, misclassification, origin and bonded-goods issues that can escalate from administrative penalties to criminal smuggling charges.
• State secrets and audit working papers: the revised State Secrets Law, overseas listing confidentiality rules and the handling of audit inspections and regulator requests for working papers.
• National security compliance for foreign individuals and research: counter-espionage, data, human genetic resources and mapping rules affecting due diligence, consultancy, academic collaboration and fieldwork.
• NGO and INGO regulation: registration, temporary activity filings, professional supervisory units and operational compliance for overseas non-governmental organisations working in mainland China.
• Professional services regulation: the rules that govern foreign law firm representative offices, accounting and consulting firms, and other professional service providers in China.
• Legal and compliance technology: e-discovery, monitoring and compliance tools deployed in China, and the data localisation and personal information issues they raise.

How cross-border investigations are structured

An investigation touching China usually follows a recognisable sequence, although the order and intensity vary with the trigger.

1. Triage. Assess the allegation, the people and entities involved, whether any authority is already aware, and whether there are reporting obligations to a stock exchange, auditor or lender.
2. Preservation and data mapping. Issue hold notices, identify where data sits, and plan onshore review so that personal information, important data and potential state secrets are handled lawfully.
3. Fact-finding. Conduct interviews, forensic accounting and third-party checks, respecting employee rights and avoiding conduct that could be characterised as unlawful information gathering.
4. Analysis and reporting. Evaluate exposure under each relevant legal system and decide what can be reported, to whom and in what form, including whether any foreign request must be routed through official channels.
5. Remediation. Discipline, control improvements, contract terminations and, where relevant, engagement with Chinese authorities on compliance commitments.

Because the same facts can engage cross-border data transfer rules, export controls and sanctions and the Anti-Foreign Sanctions Law and blocking rules, investigation teams should include specialists in those areas from the outset. Companies listed abroad will also need to consider securities compliance and CSRC enforcement.

Cross-border angles: Hong Kong, the US, the EU and ASEAN

Hong Kong is often where regional compliance and legal teams sit. It has its own legal system, regulators and, generally, common law legal professional privilege, which can help structure an investigation, but it does not displace mainland restrictions on data and state secrets when material originates in the mainland. Treating Hong Kong as a separate jurisdiction, rather than a convenient extension of the mainland, avoids many problems.

US authorities remain the most frequent foreign counterpart in matters involving compliance in China, through the DOJ, the SEC, OFAC and the Bureau of Industry and Security. European authorities are increasingly active through sanctions enforcement, the EU Foreign Subsidies Regulation and member state anti-corruption laws. For Chinese groups expanding into Southeast Asia, local anti-corruption agencies and multilateral development bank integrity units add further layers; see overseas compliance for Chinese enterprises.

A worked example

Suppose a European medical device group receives an anonymous report that its Chinese distributor is funding hospital hospitality from inflated margins. The group must decide quickly whether to audit the distributor under its contract, how to review its own sales team's emails lawfully, whether the facts raise exposure under Chinese bribery law, the UK Bribery Act or the FCPA, and what it can tell its auditors. If the review finds evidence, the group must then weigh remediation, termination of the distributor, possible disclosure abroad and the risk that Chinese authorities open their own case. Each step involves both Chinese and foreign considerations, which is why a single coordinated plan matters.

Common mistakes in compliance in China

• Translating, not adapting. Global policies issued in English without local scenarios, approval procedures or Chinese-language training rarely change behaviour on the ground.
• Treating distributors as someone else's problem. Payments made by channel partners from margins the company funds are a common source of liability in both Chinese and foreign enforcement.
• Exporting data first and asking later. Sending investigation files to headquarters or to foreign counsel without considering Chinese data, state secrets and evidence rules can create a second problem while solving the first.
• Using private investigators to obtain personal data. Buying bank, travel or telephone records is a criminal offence in China and taints the evidence.
• Ignoring individuals. Executives and employees may need their own advice and may face exit restrictions; failing to consider their position damages trust and the investigation.
• Forgetting the record. Compliance in China is judged, by Chinese prosecutors and foreign regulators alike, on evidence that the programme operated. Minutes, training logs and remediation files matter.

Trends in compliance in China for 2026 and 2027

• Pressure on bribe-givers. Amendment XII and national policy statements emphasise investigating those who pay bribes as well as those who take them, raising the stakes for companies relying on intermediaries.
• Sector campaigns. The nationwide campaign against corruption in the pharmaceutical and healthcare sector, launched in 2023, continues to shape sales and marketing practices.
• Financial crime modernisation. Beneficial ownership filing and customer due diligence rules under the revised AML Law are bedding in, with more scrutiny of shell companies and trade-based laundering.
• Shifting foreign enforcement. US enforcement priorities under the FCPA were reset in 2025, while the UK introduced a failure to prevent fraud offence in September 2025. Multinationals need programmes that are robust regardless of any single regulator's emphasis.
• Information security. State secrets, counter-espionage and data rules continue to make due diligence, audits and research more complex, especially for foreign individuals.
• Protection for private business. The Private Economy Promotion Law opposes using criminal measures to intervene in economic disputes, which may help companies facing tactical criminal complaints.

Our China regulatory tracker follows these and other changes through the year, and we update this guide as new rules, judicial interpretations and enforcement priorities emerge.

How TRW & Co helps

From our Shenzhen representative office, we help clients design compliance programmes and run investigations that stand up in more than one jurisdiction. We advise on the laws of the jurisdictions where our lawyers are qualified, including foreign anti-bribery, sanctions and securities laws, and provide information on the Chinese legal environment. We plan and project-manage investigations, coordinate forensic accountants and e-discovery providers, prepare board reports and negotiate with foreign authorities. Where PRC legal advice, filings, criminal defence or representation before Chinese authorities, courts or arbitral tribunals is needed, we work with licensed PRC law firms and keep the overall strategy consistent. To discuss a programme or a live matter in confidence, please contact us.