Corporate Compliance Programmes in China

What corporate compliance programmes in China need

Corporate compliance programmes in China need to do three things: prevent the misconduct Chinese authorities prosecute most often, satisfy the expectations of the parent company's home regulators, and produce evidence that they actually work. A policy manual translated from headquarters rarely achieves all three. Chinese operations face particular risks, including commercial bribery through distributors and service providers, customs and tax irregularities, data and information security rules, and conflicts of interest in procurement. The programme must be built around those risks and around the way decisions are really made in the Chinese business.

There is also a tangible legal incentive. Chinese prosecutors may take into account whether a company has an effective compliance system, or commits to building one, when deciding whether to prosecute a unit, what penalties to recommend and whether to grant leniency. A well-documented programme is therefore both a shield and a mitigation factor. Foreign regulators take the same view: the US Department of Justice, the UK Serious Fraud Office and other enforcers assess programme effectiveness when deciding how to resolve corporate cases.

The Chinese legal framework for compliance

China does not have a single compliance statute, but several instruments shape what regulators and prosecutors expect.

• Corporate criminal compliance reform. The Supreme People's Procuratorate began a pilot on compliance reform for companies involved in criminal cases in 2020 and extended it nationwide in 2022. Prosecutors can require a company to implement a compliance plan, assessed through a third-party supervision and evaluation mechanism, before deciding whether to prosecute.
• State-owned enterprise rules. The State-owned Assets Supervision and Administration Commission's measures on compliance management of central enterprises took effect on 1 October 2022, requiring chief compliance officers, compliance review of major decisions and accountability. They are widely used as a benchmark by other companies.
• Company Law. The revised Company Law, effective 1 July 2024, requires state-funded companies to strengthen internal compliance management, and its expanded duties of loyalty and diligence for directors, supervisors and senior managers increase personal accountability for control failures. See corporate governance and the Company Law.
• National standard. GB/T 35770-2022 on compliance management systems adopts the approach of ISO 37301 and gives Chinese companies a recognised reference for design and certification.
• Overseas operations. Guidelines issued by the National Development and Reform Commission and other departments in 2018 on compliance management for enterprises operating abroad set expectations for Chinese groups going global; see overseas compliance for Chinese enterprises.

Sector rules add layers. Financial institutions face specific compliance management requirements from their regulators, listed companies must meet internal control rules, and healthcare companies operate under detailed rules on interactions with medical institutions. The underlying laws can be found in the NPC national database of laws and regulations.

In parallel, the main substantive risk laws continue to evolve: Criminal Law Amendment XII on bribery and private-sector abuse (in force since 1 March 2024), the revised Anti-Money Laundering Law (since 1 January 2025), the revised Anti-Unfair Competition Law (since 15 October 2025) and the data, state secrets and counter-espionage laws. A programme's risk assessment should be refreshed whenever one of these changes.

Compliance also matters in administrative enforcement. The Administrative Penalty Law, revised with effect from 15 July 2021, provides for lighter or no penalties in specified circumstances, such as where a party actively eliminates or reduces the harm, cooperates with the authorities or commits a minor first violation that is promptly corrected. A company that can show it detected a problem through its own controls and fixed it is better placed to benefit from these provisions.

Core elements of corporate compliance programmes

Not every element needs the same weight. A trading subsidiary with no government customers may focus on customs, tax and procurement, while a pharmaceutical subsidiary must invest heavily in interactions with healthcare professionals. The key is that the reasoning behind the allocation of resources is written down and approved.

Third-party management deserves particular attention because it is where most Chinese and foreign enforcement cases originate. A proportionate approach classifies distributors, agents, consultants, logistics providers, travel agencies and marketing firms by risk; verifies ownership through public registration records and checks for links to officials or employees; examines whether fees are commensurate with genuine services; and requires evidence of performance before payment. Contracts should include compliance representations, audit rights, termination rights for breach and a requirement to cooperate with investigations. Higher-risk third parties should be re-reviewed periodically, not only at onboarding, and payment patterns monitored for red flags such as round-sum fees, rush payments, offshore accounts or invoices from unrelated entities.

Building the programme step by step

1. Map the business. List legal entities, products, sales channels, government touchpoints, licences, import and export flows and key third parties. Many programmes fail because they do not reflect how revenue is actually generated.
2. Assess risk. Combine interviews with local managers, transaction data analysis and a review of past incidents and enforcement in the sector. Rank risks by likelihood and impact under both Chinese and foreign law.
3. Close policy gaps. Draft or adapt policies in Chinese and English, adopting them through the procedures Chinese employment law requires for employer rules so that they can support discipline.
4. Design controls. Embed approvals, payment checks and documentation requirements into existing systems rather than relying on manual sign-offs.
5. Train and communicate. Use scenario-based sessions for high-risk functions and short messages for everyone else, and record attendance and understanding.
6. Monitor and test. Use data analytics on expenses and payments, periodic audits of third parties and an annual review of effectiveness.
7. Report and improve. Give management and the board regular, candid reporting, and track remediation to completion.

A realistic timeline for a mid-sized subsidiary is three to six months for the initial build, followed by an annual cycle of assessment and testing. Speed matters less than credibility: authorities in every jurisdiction can tell the difference between a programme built for show and one that is used. Groups with several Chinese subsidiaries often pilot the build in the highest-risk entity first, then roll it out across the others using the lessons learned, which keeps the effort manageable and produces early evidence of progress for the board.

Joint ventures and minority investments need a tailored approach. Where the foreign party does not control the board, it may not be able to impose its policies, but it can negotiate compliance covenants, information and audit rights, a compliance committee and termination or exit rights for serious breaches. Those rights should be agreed before investment, because they are very hard to obtain afterwards.

Adapting global corporate compliance programmes to China

Multinationals usually start from a global code of conduct shaped by US Department of Justice guidance on the evaluation of corporate compliance programmes, the UK guidance on adequate procedures under the Bribery Act and, since September 2025, the UK guidance on the failure to prevent fraud offence. These frameworks remain essential for the parent, but several adaptations are needed for corporate compliance programmes operating in China.

Employment law constrains discipline. Dismissal for misconduct generally requires a serious breach of lawfully adopted rules, so compliance policies should be adopted through the procedures required for employer rules and clearly communicated. Monitoring of employees engages the Personal Information Protection Law, which requires a lawful basis and transparency. Training should use real Chinese scenarios, such as academic conference sponsorship in healthcare or year-end gifts in government relations.

Reporting lines must also take account of the fact that some information cannot be freely transferred abroad. Hotline reports, investigation files and audit findings may include personal information, important data or material touching state secrets; our pages on cross-border data transfer and state secrets and audit working papers explain why. Hong Kong regional teams should be treated as a separate jurisdiction for these purposes.

Chinese groups going abroad face the mirror image. Their corporate compliance programmes may be built around state-owned enterprise rules or domestic expectations, and need to be extended to meet the standards of the US, the EU, Southeast Asian anti-corruption agencies and multilateral development banks where they operate.

Compliance in transactions, crises and common mistakes

Corporate compliance programmes are tested most severely in two moments. In acquisitions, a buyer inherits the target's history; pre-signing diligence on bribery, customs, tax and data, and post-closing integration plans, reduce the risk of successor exposure. Integration should include a specific timetable for rolling out the buyer's policies, training the target's staff and reviewing its third parties within the first months after closing.

In a crisis, such as a dawn raid, a whistleblower allegation or a regulator's enquiry, the programme's investigation protocol determines whether the company can respond quickly and lawfully. Related guidance appears on our pages on anti-bribery and corruption, internal and government investigations and antitrust compliance programmes.

The mistakes we see most often are predictable:

• Compliance staff who lack the seniority or language skills to challenge local management.
• Third-party due diligence that relies on questionnaires without verifying ownership, qualifications or the reality of services.
• Policies that ban practices outright without offering a compliant alternative, which drives conduct underground.
• Investigation findings that are never fed back into the risk assessment.
• Board reporting that consists of metrics on training completion rather than a frank account of risks and incidents.

Consider a worked example. A foreign industrial group discovers that its Chinese subsidiary's sales team has been using a consultancy to secure tenders with state-owned customers. A mature programme would already have flagged the consultancy as high risk, required evidence of services and capped fees. Without that, the group must investigate, decide whether to terminate the relationship, assess exposure under Chinese law and foreign law, and rebuild controls, all while sales continue. The cost of the second path is usually many times the cost of the first.

Measuring whether corporate compliance programmes work

Boards and regulators increasingly ask a simple question: how do you know the programme works? Answering it requires measures that go beyond training completion rates. Useful indicators include the number and nature of hotline reports and how quickly they are resolved, the proportion of high-risk third parties with current due diligence, exceptions found in expense and payment testing, the outcome of investigations and the time taken to implement remediation, and the results of staff surveys on whether people feel able to raise concerns.

Data analytics can help. Many companies now run periodic tests on expense claims, marketing spend and distributor rebates to identify anomalies, such as repeated claims just below approval thresholds or spending concentrated on particular customers. Analytics on Chinese data should be designed with personal information rules in mind, and processing should generally take place in China.

Reporting to the board should be candid. An annual report on corporate compliance programmes in China that identifies the top risks, the incidents of the year, the lessons learned and the resources needed is far more persuasive to a prosecutor or foreign regulator than a dashboard of green indicators. Where the parent company is listed, the audit committee will usually want China reported separately from other regions, reflecting both the scale of the business and the distinct legal environment.

How TRW & Co helps

We help multinationals and Chinese groups build corporate compliance programmes that work in China and satisfy foreign regulators. We conduct China-specific risk assessments, adapt global policies, design third-party due diligence and payment controls, draft investigation protocols and deliver scenario-based training for boards and local teams. We advise on foreign anti-bribery, fraud and sanctions laws where our lawyers are qualified, benchmark programmes against international guidance and Chinese standards, and test them through compliance reviews. Where PRC legal advice is needed, for example on employment rules or a compliance plan presented to prosecutors, we work with licensed PRC law firms. To review or build a programme, please contact us.