Fintech Regulation in China

How fintech regulation in China works

Fintech regulation in China starts from one principle: financial activity is licensed activity, and technology does not change that. Taking deposits, lending, processing payments, distributing funds or insurance, operating trading venues and providing credit reporting all require approval from a financial regulator. A technology company that wants to take part in these markets must either obtain the relevant licence through a qualifying entity or work as a service provider to a licensed institution, with the institution remaining responsible for the regulated activity.

This approach hardened after the platform finance rectification campaign that began in late 2020, during which large internet groups were required to hold financial businesses in licensed entities, break the link between payment services and other financial products, and stop using data advantages in ways regulators considered unfair. That process is now largely complete, and supervision has moved to what the authorities describe as normalised oversight. The direction is clear: innovation is encouraged, but only within licensed, capitalised and supervised entities.

Innovation channels exist, but they also run through licensed institutions. The PBOC's fintech innovation supervision tool, piloted in a number of cities since the end of 2019, allows licensed institutions and their technology partners to test new products under disclosure and consumer protection conditions, and securities regulators have run comparable pilots for capital market technology. Projects admitted to these schemes still need the underlying licence; the pilots manage risk around new technology rather than create a separate licensing route for unlicensed firms.

The regulators and the perimeter of fintech regulation in China

Since the 2023 institutional reform, the main financial regulators are the People's Bank of China (PBOC), the National Financial Regulatory Administration (NFRA), the China Securities Regulatory Commission (CSRC) and the State Administration of Foreign Exchange (SAFE). Local financial regulatory bureaux oversee certain local institutions, including microlenders and financing guarantee companies. The Cyberspace Administration of China (CAC) regulates data, algorithms and AI services that fintech businesses rely on.

A draft Financial Law, submitted to the National People's Congress Standing Committee for first reading in June 2026, would sit above the sector statutes and is reported to strengthen full-cycle supervision of institutions and a backstop mechanism so that no financial activity falls outside supervision. The Xinhua report on the draft summarises its structure.

Where the perimeter is enforced

The consequences of operating outside the perimeter can be severe. Unlicensed financial business may be treated as illegal business operation, and taking funds from the public without approval can amount to illegal fundraising under the Criminal Law and the Regulations on the Prevention and Disposal of Illegal Fundraising, which took effect on 1 May 2021. Administrative penalties, confiscation of income and orders to cease business are also common. For foreign groups, the reputational effect of being named in an enforcement notice can matter as much as the penalty itself.

Recent rules that shape fintech regulation in China

Several recent instruments define the current environment.

• Payments. The Regulations on the Supervision and Administration of Non-bank Payment Institutions took effect on 1 May 2024, with PBOC implementing rules issued on 9 July 2024. See payments and bank card clearing.
• Platform lending. An NFRA notice on commercial banks' internet loan facilitation applied from 1 October 2025, requiring head-office partner lists, fee controls and a prohibition on platforms charging borrowers.
• Infrastructure. PBOC and CSRC measures on financial infrastructure took effect on 1 October 2025. See digital platforms and financial market infrastructure.
• Trading technology. Programme trading rules now apply in both securities and futures markets. See quantitative and programme trading rules.
• Digital assets. A February 2026 notice from eight authorities restated the ban on virtual currency business and extended it to stablecoins and RWA tokenisation. See Web3 and virtual assets.
• Data and AI. The amended Cybersecurity Law took effect on 1 January 2026, alongside the 2025 Network Data Security Management Regulations and AI content labelling rules. See generative AI in financial services.
• Anti-money laundering. The revised Anti-Money Laundering Law took effect on 1 January 2025, widening customer due diligence and beneficial ownership obligations. See anti-money laundering.

Consumer protection runs through all of these instruments. The PBOC's Measures for the Implementation of Financial Consumer Protection, in force since 1 November 2020, and NFRA rules for banking and insurance require clear disclosure, suitability, fair marketing and complaint handling, and limit the bundling or default selection of financial products. Regulators frequently test fintech products against these standards when reviewing partnerships.

Partnering with licensed institutions

For most foreign technology firms, and for many Chinese platforms, the practical route into financial services is a partnership with a bank, insurer, securities firm or payment institution. Regulators accept these models but scrutinise them closely. Points that commonly attract attention include:

• whether the technology partner effectively controls credit decisions, pricing or customer funds;
• whether fees paid to the partner are proportionate and disclosed, and whether borrowers are charged indirectly;
• whether the institution has retained core risk management functions rather than outsourcing them;
• how customer data is collected, shared and stored, and whether consent is valid under the Personal Information Protection Law;
• whether marketing makes clear which licensed institution is providing the product.

Illustrative example: a wealth technology partnership

The following example is hypothetical. A foreign investment technology company wants to offer its portfolio construction tool to mainland retail investors. Offering fund recommendations directly would involve fund distribution and investment advisory activity, both licensed by the CSRC. The company therefore licenses its tool to a mainland securities firm with the relevant qualifications. The securities firm owns the customer relationship, runs suitability checks, chooses which outputs are shown to clients and takes responsibility for advice.

The contract fixes a technology licence fee rather than a share of client assets or returns, gives the securities firm audit and model validation rights, and keeps client personal information within the firm's systems in China. The foreign company receives anonymised performance data only, after confirming that the data export rules do not apply or have been satisfied. Marketing materials name the securities firm as the service provider.

What a regulator-ready partnership file contains

Licensed institutions increasingly expect technology partners to help them evidence compliance. A well-prepared partnership file usually includes:

• a role description showing which party performs each regulated and unregulated function;
• the fee schedule and the rationale linking each fee to services actually provided;
• data processing terms, consent records and any data export assessments;
• model documentation, validation results and change-control procedures for any scoring or recommendation tools;
• business continuity, incident reporting and exit arrangements, including how customers are protected if the partnership ends.

Preparing this material at the outset shortens the institution's internal approval process and puts the partnership in a stronger position if a regulator asks questions later.

Data, cybersecurity and AI in fintech regulation in China

For most fintech businesses, the data rules are as important as the financial licences. Customer onboarding, credit scoring, fraud detection and personalised marketing all depend on personal information, and much of it is sensitive personal information, such as financial accounts and transaction records, which requires separate consent and a specific purpose under the Personal Information Protection Law. Financial regulators also issue sector data standards, including data classification guidance for the banking, securities and insurance industries, which institutions apply to their technology partners.

Three questions recur. First, whether data collected by a platform can lawfully be shared with a licensed institution, and on what basis. Second, whether any of the data is important data, which carries risk assessment and reporting duties under the Data Security Law and the 2025 Network Data Security Management Regulations. Third, whether data will leave the mainland, for example to a group data centre, a global fraud model or an overseas cloud service, in which case the cross-border data provisions of March 2024 determine whether a security assessment, standard contract or certification is needed. See cross-border data transfer.

Algorithms and AI add a further layer. Recommendation algorithms used in consumer-facing apps may require filing with the CAC, and public-facing generative AI services require security assessment and filing. The amended Cybersecurity Law, effective 1 January 2026, increased penalties for breaches of network security obligations, which raises the stakes for incident response planning across the partnership.

Foreign investment and market access

Most financial licences are now open to foreign-invested entities on the same conditions as domestic applicants, and the financial services sector no longer carries general foreign ownership caps for banks, securities firms, fund managers or insurers. Market access, however, remains approval-driven, and applicants must meet capital, shareholder, governance, technology and data localisation conditions. Foreign-invested payment institutions, for example, must process domestic payment data within China. Our market entry and financial institution establishment pages explain the wider process.

In practice, an application by a foreign-invested applicant is assessed on the same substantive criteria as a domestic one, but the file often takes longer to prepare. Regulators look at the ultimate shareholders and their regulatory standing at home, the source of capital, the experience of proposed senior managers, and whether systems, data and key functions will sit in China. Groups should plan for detailed questions on intra-group outsourcing, because reliance on overseas group systems can conflict with localisation and data export requirements. Any timetable should be treated as indicative: review periods run only once a file is accepted as complete, supplementary questions are common, and licensing decisions involve a significant element of regulatory judgement.

Chinese fintech companies expanding abroad face the reverse set of questions: licensing in target markets such as Hong Kong, Singapore or the EU, outbound investment approvals at home, and rules on exporting data collected in China.

See outbound direct investment approvals for the home-country procedures that often run in parallel with overseas licensing.

A step-by-step approach to fintech regulation in China

Whether a business is entering the mainland or expanding a domestic product, a structured review helps identify the licences, partners and documents needed. The steps below reflect the order in which questions usually need answering.

1. Describe the product in functional terms. Who receives funds, who bears credit or market risk, who gives advice, who holds data?
2. Map each function to a regulated activity and the responsible regulator, using the perimeter table above.
3. Choose the route for each regulated function: own licence, acquisition of a licensed entity, licensed partner or removal from the product.
4. Test the economics. Check that fees, revenue shares and incentives are consistent with the role chosen and with current sector rules.
5. Design data flows to meet personal information, important data and data export requirements, including any localisation rules for the sector.
6. Document roles in partnership, outsourcing and customer agreements, and align marketing materials.
7. Plan for change by building review points for new rules, including the draft Financial Law.

Common mistakes

• Assuming that a technology label or an offshore entity places a product outside fintech regulation in China.
• Rewarding partners by reference to loan volumes, interest or returns, which can suggest the partner is carrying on the financial business.
• Collecting customer data under the platform's privacy policy and then sharing it with a licensed institution without a separate lawful basis.
• Launching cross-border features, such as foreign currency wallets or offshore investment access, without considering foreign exchange rules.
• Relying on informal comfort from local officials instead of the published rules and the views of licensed PRC counsel.

How TRW & Co helps

We help fintech businesses and financial institutions understand how the Chinese regulatory environment affects their products and partnerships, and we design structures that work across mainland China, Hong Kong and other markets. Our work includes regulatory mapping, cross-border structuring, drafting and negotiating technology, outsourcing and cooperation agreements, and advising on the laws of the jurisdictions in which our lawyers are qualified. We manage licensing and market entry projects end to end, coordinating licensed PRC law firms where PRC legal advice or filings with mainland regulators are required, and liaising with advisers in Hong Kong and elsewhere. To discuss your project, please contact us.