Internal and Government Investigations in China

Internal investigations in China: the essentials

Internal investigations in China are lawful and common, but they operate within constraints that investigators trained elsewhere often underestimate. There is no general legal professional privilege of the kind recognised in common law systems, so investigation materials may be obtainable by Chinese authorities. Employee personal information, important data and potential state secrets are protected by statute. Evidence and data generally cannot be sent to foreign authorities without approval. And because Chinese authorities can open their own investigation at any point, an internal inquiry must always be run on the assumption that its work could later be examined by a regulator, a prosecutor or a court.

Government investigations come from many directions. The relevant authority depends on the conduct and on who is involved, and an inquiry can begin with an information request, an on-site inspection, a dawn raid or the questioning of an employee. Companies that understand which authority is involved, what powers it has and how its process typically unfolds make better decisions in the first days, when the most important choices are made.

Who investigates: the main Chinese authorities

The Supervision Law, revised with effect from 1 June 2025, governs supervisory commissions, while the Criminal Procedure Law governs police and prosecutors. Administrative investigations follow the Administrative Penalty Law and sector rules, which give companies rights to be informed of the facts, to make representations and, for significant penalties, to request a hearing. Texts are available on the NPC national law database.

A government investigation can move between these authorities. A market regulator that finds commercial bribery above criminal thresholds will transfer the case to the police; a customs audit can be referred to the anti-smuggling bureau; and a supervisory commission investigating an official will refer a private-sector bribe-giver to the criminal justice system. Each transfer changes the stakes, the procedures and the rights available.

What to expect from a supervisory commission

Supervisory commissions are not courts or police, and their procedures differ. They may question officials under detention-like measures known as retention in custody, during which lawyers do not participate, and they may ask companies for documents, transaction records and witness interviews. A company asked to assist should confirm the request in writing where possible, provide accurate information through a coordinated channel and keep a record of what was supplied. Because the official's case may later lead to a referral of bribe-givers to prosecutors, the company should assess its own position in parallel and consider whether its own internal review is needed.

Whistleblowers and other triggers

Many internal investigations begin with a report through a hotline, an anonymous letter or a complaint from a former employee, distributor or competitor. Each report should be logged, assessed promptly by someone independent of the business concerned and either closed with reasons or escalated. Whistleblowers should be protected from retaliation, both because this is expected by foreign regulators and because a mistreated whistleblower is more likely to go to the Chinese authorities or the media.

Complaints made to authorities by disgruntled insiders are a frequent source of government investigations, which is another reason to respond to internal reports quickly and visibly. Where the allegation concerns senior local management, consider whether regional or global compliance should take control of the inquiry and whether outside investigators are needed to secure independence. Other triggers include audit findings, data analytics on expenses and payments, due diligence in a transaction and media reports.

A useful triage framework asks four questions: how serious is the alleged conduct; who is implicated, and how senior are they; is an authority already aware or likely to become aware; and are there reporting obligations to a stock exchange, auditor, lender or insurer? The answers determine who should lead, how quickly to move and what resources are needed.

Running internal investigations step by step

1. Scope and governance. Define the allegation, appoint a steering group independent of the business line involved and decide who will instruct the investigators. Record the terms of reference.
2. Preservation. Issue hold notices, secure devices owned by the company and suspend routine deletion. Avoid accessing personal devices or accounts without a lawful basis.
3. Data review. Under the Personal Information Protection Law, processing employee data needs a lawful basis, such as the necessity of human resources management under lawfully adopted rules, and individuals should be informed as required. Review should normally take place in China, with filtering for state secrets and important data before any transfer.
4. Financial analysis. Forensic accountants can trace payments, test invoices and compare transactions with market norms. Bank records of third parties cannot be obtained privately and must not be sought through informal channels.
5. Interviews. Employees have a general duty to cooperate with lawful employer inquiries, but interviews must not involve coercion or restriction of liberty. Record them accurately, offer interpretation where needed and consider whether the interviewee needs separate counsel.
6. Findings and action. Disciplinary dismissal generally requires evidence of a serious breach of the employer's rules or law, so findings must be documented to employment law standards; see employment investigations and due diligence.
7. Remediation and reporting. Fix the control weaknesses, report to the board and decide, with advice, whether any disclosure to authorities is appropriate.

Throughout, keep a contemporaneous record of decisions: why the scope was set as it was, why particular custodians were chosen, why certain steps were taken or not taken. If the inquiry is later examined by a Chinese authority or a foreign regulator, that record is the best evidence that it was conducted in good faith and with proper independence.

Timelines vary widely. A focused inquiry into a single expense issue might take a few weeks; a multi-year review of a sales model across several provinces can take many months. Interim reports help the board make decisions without waiting for the final picture, and allow urgent control fixes to start early.

Common mistakes in internal investigations in China include:

• Letting the business line under suspicion run or staff the inquiry.
• Collecting data without checking the lawful basis or informing employees as required.
• Exporting raw data to headquarters before review for state secrets, important data and personal information.
• Interviewing key witnesses before documents have been preserved and reviewed.
• Dismissing employees quickly on thin evidence, inviting labour arbitration claims and losing their cooperation.
• Failing to update the board, leaving it unprepared when an authority makes contact.

Using e-discovery and data analytics

Large internal investigations depend on technology. E-discovery platforms allow search, de-duplication and review of email and chat data, while analytics can identify unusual payment patterns, related-party links and anomalies in expense data. In China, the choice of vendor matters: data should generally be processed on servers located in China, by personnel subject to appropriate confidentiality terms, and exported only after review and any required approvals. Chinese-language search terms, slang and messaging apps such as WeChat require local expertise. Collections from messaging apps on company devices raise particular personal information questions and should be planned carefully.

Dawn raids and authority requests

When an authority arrives unannounced, the first hour matters. Reception staff should know whom to call; the legal function should verify the officers' identity and legal basis; and someone should accompany each inspection team and record what is copied or seized. Staff should cooperate and must not destroy, conceal or alter documents, which can be a separate offence.

Requests for documents should be logged and answered accurately, and the company should consider early whether the matter must be reported to a parent company regulator, an auditor or a stock exchange. Licensed PRC counsel should be engaged at once for any interaction with the authorities. After the raid, the company should debrief the employees involved, reconstruct what was taken and assess whether an internal review is needed to understand the facts before the authority does.

A dawn raid protocol should be short, translated and tested. It should name the response team, set out the first steps, include template communications to staff, and explain how to handle requests for access to IT systems and data held outside China. Annual drills, particularly for reception, IT and finance staff, make a real difference.

Written information requests

Not every government investigation starts with a raid. Many begin with a written notice requiring documents or explanations within a short deadline. The response should be coordinated by the legal function, checked for accuracy against the underlying records and reviewed by licensed PRC counsel. Incomplete or inconsistent answers can be treated as obstruction or as aggravating factors. Where the request is broad or the deadline unrealistic, it is often possible to discuss scope and timing with the authority, but this should be done early and politely.

Privilege, confidentiality and employees

Because Chinese law does not recognise a general privilege that allows a company to withhold documents from authorities, the content and form of investigation records matter. Reports should be factual and precise, avoid speculation and be shared on a need-to-know basis. Where the investigation may be relevant to proceedings in the US, the UK or Hong Kong, foreign privilege rules may still protect certain communications, and the structure of the engagement, including who instructs whom, should be designed with that in mind.

Employees' positions also need care. Interviewees may become suspects in a criminal case, and their interests may diverge from the company's. They should be told who the interviewer represents and that the company may share what they say with authorities. Retaliation against cooperating employees, or pressure on witnesses, can create additional legal exposure and undermine the credibility of internal investigations in the eyes of regulators.

Board oversight and independence

Boards and audit committees should receive regular updates on significant internal investigations, decide on major steps such as disclosure and disciplinary action, and ensure that those implicated have no role in directing the inquiry. Where local management may be involved, the investigation should report to a committee or officer outside the Chinese business. Independence is one of the first things that foreign regulators examine when assessing whether a company's investigation can be relied on.

Cross-border dimensions of internal investigations

Most internal investigations involving a foreign group also have a foreign audience: the parent's board, auditors, a US or UK regulator, or lenders. Article 36 of the Data Security Law and Article 41 of the Personal Information Protection Law restrict providing data stored in China to foreign judicial or law enforcement authorities without approval, and the cross-border data transfer rules apply even to transfers to the parent; see the CAC provisions on cross-border data flows.

Reporting should therefore be designed carefully, often with onshore review and summary reporting abroad. Our pages on cross-border regulatory investigations and cross-border data transfer discuss these issues in more depth, and our employee personal information page covers monitoring and HR data.

Consider a worked example. A US-listed company learns that a Chinese subsidiary may have inflated sales through side agreements with distributors. Its audit committee needs facts quickly for its auditors and possibly the SEC. The investigation team collects data onshore, reviews it in China with a vendor that can host data locally, interviews staff with Chinese-language counsel present, and prepares a report for the audit committee that summarises findings without transferring underlying personal data. Where the SEC requests documents, the company engages with the SEC about Chinese restrictions and the approval process. Each step is designed to work for both audiences.

How TRW & Co helps

We plan and manage internal investigations in China for multinational and Chinese groups, from scoping and preservation to interviews, forensic review and board reporting. We coordinate forensic accountants and e-discovery providers so that data is reviewed onshore and handled lawfully, prepare dawn raid protocols and train front-line staff. We advise on the laws of the jurisdictions where our lawyers are qualified, including disclosure and reporting under foreign anti-bribery, sanctions and securities regimes. Interaction with Chinese authorities, PRC legal advice and any criminal or administrative proceedings are handled by licensed PRC law firms with which we work closely. To discuss a concern or prepare a response plan, please contact us.