On December 17, 2023, the State Council of China promulgated the Regulations on Supervision and Administration of Non-bank Payment Institutions (in Chinese:非银行支付机构监督管理条例) ("New Regulations"). The formal promulgation of the New Regulations concludes the three years of public reviews and discussions over the draft for comment version of the Regulations on Supervision and Administration of Non-bank Payment Institutions which was promulgated on January 20, 2021 ("Draft for Comments"). This article seeks to provide a brief overview on the key points introduced by the New Regulations.

Reclassification of Payment Business

The current prevailing legal framework in China on the regulation of payment services was established around 2010, with the main regulation being the Administrative Measures of People's Bank of China on Payment Services Provided by Non-financial Institutions (in Chinese:非金融机构支付服务管理办法) ("PBoC Measures").

The PBoC Measures regulates the payment business in three categories:

With the development of various recent technologies, especially QR code payment services, the boundaries between online payment and other categories of payment services are very much blurred. As a result, the market sometimes finds it difficult to determine the applicable regulation category for certain products.

The New Regulations simplifies the categorization. Based on whether the payer's prepaid funds can be received, payment business is divided into two types, namely, stored-value account operation and payment transaction processing. 

It is noteworthy that the two categories system under the New Regulations is not a "natural transition" from the PBoC Measures system. As such, after the New Regulations take effect on May 1, 2024, how the currently existing payment licenses under each of the three categories operate under the new two-category system, is yet to be clarified by the authorities.

Services to Corporate Customers

In the Draft for Comments, it was proposed that there should be restrictions on the opening of accounts for corporate users ("2B Accounts"). The legislators were concerned that, compared with commercial banks, payment institutions very often have weaker KYC (a.k.a. know your customers) and KYB (a.k.a. know your business) systems. In a few recent case reports, it is also indeed true that certain payment institutions provided payment services to corporate accounts which are related to criminal activities such as telephone fraud, etc. due to failure to verify transaction parties and relevant information.

The New Regulations replaces the restriction by a general proposal, which recommends that "the government shall encourage non-bank payment institutions to cooperate with commercial banks, in order to provide payment services for institutional users through bank accounts".

It is our understanding that the legislation has moved away from the restriction of 2B business for payment institutions, and embraces a more carefully monitored arrangement, with still room for 2B business.

Clarification on Cross-border Payment Business by Foreign Institutions

Article 2 of the New Regulations stipulates that, where a non-bank institution outside China intends to provide cross-border payment services to domestic users, it shall establish a non-bank payment institution in China pursuant to the provisions hereof, unless otherwise stipulated by the State.

For a long time, there have been no unified and explicit normative documents regarding the cross-border payment services provided by foreign payment institutions.

Based on the wording of the New Regulations, it should not be necessary for foreign institutions to maintain a licensed business presence in China if its operations are for payment transactions completely outside China, regardless of whether its customers are based in China or not.

The wording of the New Regulations also seems not to forbid the current practice in the market where foreign institutions cooperate with Chinese payment service providers to provide cross-border payment services. Article 19 of the New Regulations clearly stipulates that payment institutions providing payment services for cross-border transactions shall comply with the relevant provisions on cross-border payment, cross-border RMB business, foreign exchange management and cross-border data flow.

Considering that the PBoC issued the Administrative Measures on Cross-border Payment Services in 2021 (“Exposure Draft") after the Regulations had established the regulatory framework of the payment industry, we believe that we can look forward to the promulgation of detailed rules on cross-border payments soon.

Stricter Requirements on Personal Information Protection

Article 32 of the New Regulations sets forth requirements relating to the protection of personal information obtained by payment institutions. In general, the New Regulations reflect the relevant requirements expressly provided in China’s Personal Information Protection Law. For example, the New Regulations emphasize the principle of legality, appropriateness, necessity and integrity in the processing of users' information, require payment institutions to disclose the rules for processing users' information, expressly state the purpose, methods, and scope of processing users' information, and obtain users' consent (unless otherwise required by laws and administrative regulations). The New Regulations also requires payment institutions not to collect users' information unrelated to the services they provide, and not to refuse to provide services for reasons such as users' disagreement with the processing of users' information or withdrawal of users' consent.

In addition, when sharing users' information with affiliated companies, the New Regulations requires payment institutions to inform users of the name and contact details of such affiliated companies, to obtain the users' separate consent on the content of information to be shared, as well as the purpose, duration, methods, and protection measures for the processing of information, etc. Furthermore, the New Regulations requires payment institutions to supervise their affiliated companies to ensure compliance with the laws and regulations and controllable risks. These requirements are significantly stricter than those under the Draft for Comments, and it is the first time that a financial regulatory document explicitly stipulates the sharing of users' information by relevant financial institutions with affiliated companies.

Concluding Remarks

The New Regulations comprehensively iterates and upgrades the regulatory rules in the payment industry. With respect to the type of business, the New Regulations reclassifies the payment business into two types and makes room for payment institutions to conduct 2B business. The New Regulations explicitly provides for the supervision of cross-border business. In terms of data and systems management, the New Regulations emphasizes the independence of payment institutions' operations and systems and provide for the protection of personal information. During a press interview on December 18, 2023, the respective responsible persons from the People’s Banks of China and Ministry of Justice introduced that the authorities next work plan will be making the rules for the transition from the PBoC Measures to the New Regulations, and further refining the administrative approvals and punishment procedures. We will continue to follow up with the latest developments.