2023 Regulatory Mainline Review
01 The fintech sector steps into the "normalized supervision" stage after centralized rectification.
Following PBOC's official statement in January 2023that a normalized supervision framework has been preliminarily established for platform enterprises' financial business, and following multiple departments issuing penalty decisions on July 7, 2023, the PBOC, the NFRA, and the CSRC jointly announced that most of the prominent compliance issues concerning platform enterprises' financial business operation had been rectified and the key tasks for the financial regulatory authorities had shifted from centralized rectification to normalized supervision. This statement means that the financial business of platform enterprises is officially under "comprehensive supervision", which will improve the predictability, stability, uniformity, and standardization of the applicable regulatory mechanisms for platform enterprises.
At the same time, support mechanisms for normalized supervision are gradually being established and developed. At the departmental level, upon the financial regulatory revamp in March 2023,on November 10, 2023, the State Commission Office of Public Sectors Reform released the Provisions on the Functions, Structure, and Staffing of the National Financial Regulatory Administration, expressly providing for the establishment of the Technology Supervision Department (a new department in the NFRA). The Technology Supervision Department will be responsible for formulating and directing the implementation of information technology development plans and information technology risk supervision systems, supervising cybersecurity, data security, and critical information infrastructure to promote digital informatization. It is logical to expect that with the establishment of the Technology Supervision Department, regulatory work in fintech sector will be further centralized and professionalized.
02 Regulatory rules for technology ethics continue to evolve; governance mechanisms being improved
Rules and systems to regulate ethics in science and technology in the financial sector have been gradually established with the release of the Opinions on Strengthening Ethical Governance of Science and Technology, the Guidelines for Science and Technology Ethics in the Financial Sector, the Self-discipline Convention on Science and Technology Ethics in the Financial Sector, and other associated rules in recent years.
After the release of the Opinions on Strengthening Ethical Governance of Science and Technology by the General Office of the CPC Central Committee and the General Office of the State Council in early 2022, on September 7, 2023, the Ministry of Science and Technology, together with nine other departments including the MIIT, the National Health Commission, jointly issued the Measures for Ethical Review of Science and Technology (Trial). The measures serve as a comprehensive and generalized regulation covering the ethical review of science and technology in various fields and establish uniform requirements on the basic procedures, standards and conditions for the review.
In terms of fintech, in November 2023, the Beijing Fintech Industry Alliance released the Self-discipline Convention on Science and Technology Ethics in the Financial Sector at the 2023 Financial Street Forum. With the aim to promote self-discipline in science and technology ethics in the financial industry, the Convention establishes normative standards on the governance of key points such as algorithmic discrimination, big data discriminatory pricing, information leakage, digital divide, and disorderly competition. On November 27, 2023, the Shandong Branch of the PBOC issued a local group standard called the Guidelines for Ethical Governance of Fintech, proposing normative requirements for fintech ethical governance, such as forming fintech ethics committees, fintech ethical reviews, fintech ethical supervision, and fintech ethical education and promotion.
However, despite this rule development, ethical governance of science and technology has not yet been fully integrated into the internal management system of financial institutions and fintech enterprises. As Zeng Zhicheng, the deputy president of the PBOC Beijing Branch, mentioned in an exclusive media interview held at the end of 2023, the ethical governance of fintech is still in the exploratory stage, and the challenges of ethical governance of science and technology, such as the digital divide, algorithmic discrimination, privacy leakage, etc., are becoming increasingly prominent. Mr. Zeng added that these ethical issues may easily lead to discrimination in financial services and infringe on the rights and interests of financial consumers; moreover, they also contradict the original development idea of "maintaining integrity and seeking innovation" in fintech. Mr. Zeng ended by emphasizing that the financial industry should fully recognize the importance and urgency in establishing ethical governance over fintech; thus, the financial industry should establish a sound system of ethical governance in line with China's national conditions and with international standards.
We expect that with regulatory development for ethics in science and technology, support mechanisms and related practices on ethics governance in science and technology in the fintech sector will be further improved as well.
03 Cyber and data security legislation and law enforcement further improved and strengthened in the financial industry
Cybersecurity and data security legislation in the financial sector continued to develop in 2023.
In February 2023, the CSRC formally issued the Administrative Measures for Cyber and Information Security in the Securities and Futures Industry, requiring core institutions (such as securities and futures trading venues, securities registration and settlement institutions, and futures margin depository and monitoring institutions) as well as operating institutions (such as securities companies, futures companies, and fund management companies) to establish sound cybersecurity management systems to enhance capacities in safeguarding network operation.
In June 2023, the NFRA issued to banks, insurance companies, wealth management companies and other institutions the Notice on Strengthening the Management of Cyber and Data Security in Third party Cooperation. As a response to multiple security incidents caused by the outsourcing service providers used by banking and insurance institutions, the Notice required banking and insurance institutions to understand potential cyber and data security risks in digital ecological cooperation, and to formulate corresponding risk rectification plans.
On July 24, 2023, the PBOC issued the Measures for the Administration on Data Security in People's Bank of China Business Areas (Consultation Draft), setting out protection requirements throughout the data lifecycle.
In August 2023, the NFRA, together with four other departments, jointly issued the Notice on Matters related to Regulating the Data Service of Currency Brokerage Companies, aiming to regulate data services provided by currency brokerage companies, encourage lawful and reasonable data use, ensure data security, and enhance market information transparency.
In terms of cybersecurity risk management products, on July 2, 2023, the MIIT and the NFRA announced the Opinions on Promoting the Standard and Healthy Development of Cybersecurity Insurance, providing various guiding opinions on the operation, development and management of cybersecurity insurance, and calling for the establishment of sound supporting policies and standard system. In addition to these measures, notices and opinions enhancing cybersecurity and data security in legislation, law enforcement was active in cybersecurity and data security in 2023.
In the securities sector, law enforcement subjected many securities firms to regulatory measures due to their system failures. Among the enforcement actions taken by law enforcement bodies, a securities firm was subject to regulatory measures by the CSRC Shenzhen Branch, the Shanghai Stock Exchange, and the Shenzhen Stock Exchange due to a system failure incident in June 2023. Three regulators taking action against a securities firm for one incident is uncommon as compared to past regulatory practice. In the banking and insurance sector, law enforcement penalized a number of banking or insurance companies for failing to comply with regulatory requirements on data security, such as failures in data security management, in reporting information security incidents, and in sufficient control over production data security.
04 AIGC regulations begin to emerge, industry develops under supervision
Driven by the rapid development in the artificial intelligence industry, regulatory rules on artificial intelligence have been gradually formulated and implemented.
On January 10, 2023, China's first specialized departmental regulation for deep synthesis services, the Administrative Provisions on Deep Synthesis of Internet Information Services, came into force. Subsequently, on June 20, 2023, the CAC released the first batch of domestic deep synthesis service algorithms (41 in total) that have completed filing with the CAC, covering a number of popular apps such as Meituan, Kuaishou, Taobao, Daimai, Kugou Music, and Baidu Wenxin Yige.
Further to these provisions, on July 10, 2023, the Cyberspace Administration of China (CAC) and six other departments jointly issued the Interim Measures for the Administration of Generative Artificial Intelligence Services ("Interim Measures"), which clarified the definition of artificial intelligence generated content (AIGC) and established specific compliance requirements for AIGC products and services.
On August 31, 2023, companies and organizations, including Baidu, Byte Dance, Sense time, Chinese Academy of Sciences, Baichuan Intelligence and Zhipu Huazhang, completed algorithms filing for their large-scale model products — the first batch of filed products announced after the Interim Measures came into effect. Among these filed products, Baidu's Ernie Bot has provided access to Shenwan Hongyuan, Guangfa Securities, Industrial Securities and other securities firms to pursue cooperation in wealth management and other fields.
In addition to industry-specific regulations offering comprehensive compliance guidance for AIGC, additional regulatory documents, self-regulatory rules and industry norms were formulated and developed in response to industry concerns about data security and other derivative risks in the application of AIGC.
On April 10, 2023, the Payment and Clearing Association of China issued the Proposal on the Cautious Use of ChatGPT and Other Tools by Payment Industry Participants.
On April 18, 2023, the Supreme People's Procuratorate of China issued the Opinions on Strengthening the Internet-related Rule of Law by Procuratorial Organs in the New Era. The opinions proposed strengthening research on legal issues related to new technologies and new forms of business such as artificial intelligence. Further, the opinions proposed conducting timely detection and precise punishment of criminal activities using new technologies or new business as disguise.
In terms of risk prevention and control and security management mechanisms, on August 6, 2023, the State Administration for Market Supervision and Administration and the Standardization Administration issued the Technical Requirements for Intelligent Risk Prevention and Control in Internet Finance, setting out the required technical framework for intelligent risk prevention and control technology in Internet finance.
On October 11, 2023, the National Information Security Standardization Technical Committee (TC 260) issued the Basic Requirements for the Security of Generative AI Services (Consultation Draft). The draft document provides basic guidelines on security matters faced by AIGC services providers, such as corpus security, model security, security measures, security assessments and filing applications, and offers standard implementation guidance for the security requirements provided under the Interim Measures.
05 Special department established to promote data development; accounting rules for data assets are further specified
In 2023, institutional reforms and rules were promulgated to promote the use and development of data resources.
In terms of institutional establishment, on October 25, 2023, the National Data Administration was inaugurated. In accordance with the Plan on Reforming Party and State Institutions issued in March 2023, the National Data Administration's responsibilities include coordinating and promoting the construction of basic data systems; coordinating the integration, sharing, development, and application of data resources; and promoting the planning and building of Digital China, digital economy and digital society. In view of the responsibilities assigned to the National Data Administration and the positioning of the National Data Administration within the government hierarchy, it is reasonable to expect that the establishment of the National Data Administration will help coordinate the integration, development, and application of data resources and will facilitate focused exploration of feasible solutions to key issues such as data rights confirmation and data assetization.
In terms of rule promulgation, on August 1, 2023, the Ministry of Finance officially issued the Interim Provisions on Accounting Treatment of Enterprise Data Resources, further clarifying and specifying accounting rules for data assets. On September 8, 2023, the China Appraisal Society issued the Guiding Opinions on Data Asset Appraisal, which clarified data asset appraisal, including attributes and definitions, appraisal objects, operational requirements, appraisal methods and disclosure requirements, and provided useful guidance for standardized data asset appraisal activities. On December 31, 2023, the National Data Administration and 16 other departments jointly issued the "Data Elements x" Three-Year Action Plan (2024-2026). The Plan refers to the application of "Data Elements and Financial Services" as one of the key actions in 12 areas. and explicitly supports financial institutions to share risk control data among each other and integrate and analyze multidimensional data such as financial markets, credit assets, and risk inspection to leverage the driving role of fintech and data elements. On the same day, the Ministry of Finance issued the Guiding Opinions on Strengthening Data Asset Management, which includes tasks such as "accelerating the construction of a data asset property rights system with scientific classification" and "promoting the construction of standards relating to data assets, such as technology, security, quality, classification, value evaluation, management, and operation standards."
Under the guidance of the aforementioned policies and rules, provinces such as Shandong, Guizhou, Guangdong, Beijing, and Shanghai also introduced corresponding policies to actively explore building local basic data element systems and methods of data rights confirmation and accounting approaches, and to encourage local pilot programs. These local efforts have achieved results. For example, in April 2023, Shenzhen Weiyan Technology Co., Ltd. obtained the first "no asset pledge" data asset loan in the country, based on data assets listed on the Shenzhen Data Exchange for trading. In another example, in October 2023, Wenzhou Big Data Operation Co., Ltd. successfully registered its data product as a "data asset". This registration was the first publicly reported instance of enterprise's data assets recognition guided by financial authorities.
06 Outbound data transfer rules continue to develop, showing regulatory intention to "facilitate cross-border data transfer"
Rules for cross-border data transfer were further developed and improved in 2023.
In February 2023, the CAC issued the Measures on the Standard Contract for the Outbound Transfer of Personal Information ("Standard Contract Measures"). Later in May 2023, the CAC further issued the supporting Guidelines for the Filing of the Standard Contracts for the Outbound Transfer of Personal Information to clarify the applicable rules, standard contract terms and filing mechanisms for outbound data transfers using a "standard contract". Based on these measures, Beijing, Shanghai, Fujian and other regions successively introduced guidelines for filing standard contracts for outbound personal information transfers to provide further local guidance for the orderly filing of the standard contracts. According to the Standard Contract Measures, outbound personal information transfers that do comply with its provisions need to complete relevant rectifications by November 30, 2023.
On July 25, 2023, the State Council issued Opinions on Further Optimizing the Foreign Investment Environment and Increasing Efforts to Attract Foreign Investment, which explicitly set "exploring a convenient security management mechanism for cross-border data flow" as a future task. On September 28, 2023, the CAC issued the Provisions on Regulating and Promoting Cross-border Data Flow (Consultation Draft). These draft provisions set out exemptions for outbound data transfer scenarios that are of particular concern to multinational enterprises (including international financial groups) in terms of regulatory requirements such as security assessments and filings for standard contracts. These draft provisions also clarify that the scope of important data should be determined based on the catalogue/list declared by the competent authorities. Once implemented, the draft provisions will significantly reduce the cost of data export compliance for international institutions and will facilitate the efficient operation of multinational financial institutions and cross-border financial activities. On November 26, 2023, the State Council issued the Overall Plan for Promoting High level Institutional Opening-up in the China (Shanghai) Pilot Free Trade Zone by Comprehensively Aligning with International High-standard Economic and Trade Rules. This plan provides clear instructions on the outbound transfers of financial data and supports the Shanghai Pilot Free Trade Zone in taking the lead in formulating important data catalogues. On December 13, 2023, the CAC and the Innovation, Technology and Industry Bureau of Hong Kong jointly issued the Standard Contract for the Cross-boundary Flow of Personal Information Within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong (the "Regional SCC for Greater Bay Area")). The Regional SCC for Greater Bay Area sets out special rules and requirements for applicable standard contracts on the cross-border flow of personal information between the mainland area within the Guangdong Hong Kong-Macao Greater Bay Area and Hong Kong, and aims at safeguarding personal information security while fully promoting reasonable cross-boundary personal information flows within the Greater Bay Area.
07 Regulations on non-bank payment institutions finally released, bank card clearing industry continues to open up
On December 9, 2023, nearly three years after the consultation draft was issued, the Regulations on the Supervision and Administration of Non-bank Payment Institutions (the "Non-bank Payment Regulations") were finally released and will take effect on May 1, 2024. As the first administrative regulation governing the non bank payment institutions, the Non-bank Payment Regulations recognize the significant role of the non-bank payment industry in promoting transactional activity and market prosperity, supporting the development of the real economy, and improving people's livelihoods.
By reconstructing the payment business categories and the supporting regulatory rules in the payment sector on the basis of the existing regulatory rules and in conjunction with the characteristics of the industry's development, the formal implementation of Non bank Payment Regulations will help strengthen supervision of the payment industry, promote market standardization, prevent risks, and achieve the stable development of the payment industry.
Meanwhile, the opening-up of the payment and clearing sector continues to progress steadily. In November 2023, the PBOC approved the business commencement application submitted by MasterCard NUCC Information Technology (Beijing) Co., Ltd., and on November 17, 2023, issued to it the bankcard clearing business license. According to publicly available information, MasterCard NUCC Information Technology (Beijing) Co., Ltd. is a joint venture company in China initiated and established by MasterCard and NUCC. After obtaining the bank card clearing business license, the company, being the second joint venture bank card clearing institution in China, is qualified to authorize member institutions to issue and accept RMB bank cards under the MasterCard brand within China.
08 Credit reporting embraces standardized development
On June 30, 2023, the transition period of the Measures for the Administration of Credit Reporting Business ended. With that end, the credit reporting business officially enters a new period in which the direct connections between the financial institution and the credit information provider will be disconnected.
In addition, on August 16, 2023, the PBOC issued the revised Regulations on Handling Credit Reporting Complaints (Consultation Draft) —— one of the normative documents in the credit reporting business sector. Compared with the current version issued in 2014, the new Regulations on Handling Credit Reporting Complaints (Consultation Draft) mainly revised and adjusted the existing provisions to create a more convenient and standard complaint filing and handling process.
At the same time, law enforcement in credit reporting was also progressing. Several penalties imposed on banking institutions for violating regulations on credit information collection, provision, inquiry, and credit reporting business management.
Furthermore, on August 4, 2023, the PBOC announced a penalty for Baihang Credit Services Corporation. According to this announcement of PBOC, Baihang Credit Services Corporation was warned and fined CNY 515,000 for violating regulatory rules for credit reporting agency and illegal acts such as violating regulations on credit information collection, provision, and inquiry. The persons at Baihang Credit Services Corporation responsible for the illegal acts were also punished accordingly.
2024 Regulatory Outlook
01 Fintech continues to empower ESG
As one of the key tasks set by the Financial Technology Development Plan (2022-2025), green finance remained a key topic in the fintech sector in 2023. In February 2023, the Central Committee of the CPC and the State Council issued the Plan for the Overall Layout of Building a Digital China, explicitly stating that "digitalization" and "greening" have become the two important directions of post epidemic economic recovery. And on October 31, 2023, the Central Financial Work Conference also set "green finance" as one of the five major "articles" on finance.
Meanwhile, driven by the development and application of ESG evaluation systems, fintech is undertaking a more prominent role in empowering financial institutions to implement ESG practices in recent years. For example, in December 2022, relying on fintech technology, the China Construction Bank was the first bank to successfully develop and apply an automated ESG rating tool for its full-range institution customers. And in December 2023, it further integrated ESG elements into its customer credit ratings.
According to the 2023 China Fintech Enterprise Chief Insight Report, green finance and ESG investment have been ranked among the top three blue ocean business areas of fintech for two consecutive years.
With the further development and improvement of the fintech regulatory system, the synergistic development between fintech and ESG will inevitably become more prominent.
02 Top-level legislation may be released to protect financial consumers
In 2023, financial consumer protection continued to receive regulatory attention.
In terms of institutional establishment, according to the Provisions on the Functions, Structure, and Staffing of the National Financial Regulatory Administration issued on November 10, 2023, the Financial Consumer Protection Bureau will be established under the NFRA.
The Financial Consumer Protection Bureau will be responsible for formulating development plans and systems to protect financial consumers' rights and interests. It will also concurrently undertake work related to the compliance and suitability management of financial products related to consumer protection, organize investigations, and handle cases involving infringement of the legitimate rights and interests of financial consumers.
The establishment of the Financial Consumer Protection Bureau will effectively resolve the issue of multiple and conflicting regulation from the PBOC, the CSRC and the former China Banking and Insurance Regulatory Commission. It will centralize and unify responsibilities for protecting financial consumers and will eliminate regulatory redundancy and arbitrage. Therefore, the Financial Consumer Protection Bureau will be conducive to the interconnection of regulatory resources and the improvement of regulatory efficiency.
In terms of rule formulation, following the official implementation of the Administrative Measures for the Protection of Consumers' Rights and Interests of Banking and Insurance Institutions in March 2023, the NFRA issued the Notice on Work Arrangements for Handling Matters Reflected by Financial Consumers in May 2023. The Notice requires financial institutions to actively and properly resolve conflicts and disputes with financial consumers in strict accordance with the complaint handling requirements. Being the first regulatory document issued after the NFRA's establishment, its issuance signals a regulatory intention to focus on protecting financial consumers and that the NFRA will place importance on protecting financial consumers in future regulatory work.
With an integrated regulatory powers and departments and the clear importance of financial customers protection in regulatory work, it is reasonable to expect that top-level legislation on financial consumer protection will be placed on the agenda. At the same time, as the fintech sector enters the stage of "normalized supervision", consumer protection in the online promotion and sale of financial products and in other e-commercial activities involving financial products will also become the focus of future law enforcement activities under "normalized supervision".
03 Rules for cross-border data transfer continue to be refined; regulations for data assetization are expected to be further improved
Although the Provisions on Regulating and Promoting Cross border Data Flow (Consultation Draft) will significantly reduce the compliance thresholds for cross-border data flows (especially the outbound transfer of personal information), the new thresholds (as draft rules) cannot serve as an effective basis for an outbound data transfer. Given the regulators have shown a clear intention to remove barrier in and facilitate cross-border data transfer required for normal business operation, it is predictable that following the announcement of the Provisions on Regulating and Promoting Cross border Data Flow (Consultation Draft), the legislative department will focus on formulating or finalizing rules on cross-border data transfers that aim at "facilitating cross-border data transfer", as well as issuing catalogues and identification criteria for important data.
Meanwhile, with intensified explorations in the data element market and the importance of "data assetization" being further highlighted in the development of the data economy, we believe that starting with the establishment of the National Data Administration, top level system design and supporting measures for data assetization may already be on the agenda.
04 Detailed regulations for third-party payment businesses to be introduced; business scenarios further broadened for cross-border payments and e-CNY
Although the Non-bank Payment Regulations reclassified and re set regulatory requirements for third-party payment business, implementation details have yet to be clarified. Examples of those unclarified implementation details include the identification criterion for different types of payment businesses and the transition between new and old licenses. Therefore, to fill these gaps, further implementation rules and regulatory documents will likely be introduced to ensure proper operation of third-party payment business under the Non-bank Payment Regulations.
Meanwhile, with the joint release of the Opinions on Providing Financial Support to the Building of the Guangdong-Macao In Depth Cooperation Zone in Hengqin by the PBOC and four other departments in February 2023, business scenarios in the cross border payment sector are expected to further expand, considering that the opinions propose regional pilot initiatives such as "supporting banks and non-bank payment institutions to collaborate in providing facilitated cross-border services for the remittance and payment of personal salaries based on the actual salary level" and "promoting the universal use of mobile electronic payment tools in the cooperation areas".
Additionally, for cross-border payment and clearing, the development and policy support of e-CNY in bulk commodities trading is also noteworthy. According to information publicly reported in July 2023, Industrial Bank, as a spot clearing member of the Shanghai Clearing House, successfully launched the first e-CNY settlement service for spot clearing of bulk commodities at its Qingdao branch. As one of the first eight commercial banks to implement this e-CNY settlement service, Industrial Bank has laid the groundwork for e-CNY to be used in bulk commodity spot trading scenarios.
Furthermore, during the "Cross-border Application and Prospect of e-CNY in Hong Kong" forum at Hong Kong Technology Week, Di Gang, deputy director of e-CNY Research Institute of the PBOC, also indicated that the regulator will study the use of e-CNY for cross border payments in commodity and services trading, such as in oil and gas industry, under the framework of bilateral cooperation in the future.
05 Fintech innovation presents a stable development trend; supporting regulatory rules are expected to be further improved
In 2023, fintech innovation pilot programs were steadily promoted.
On May 16, 2023, Beijing Zhongguancun National Innovation Demonstration Zone became the seventh pilot financial reform zones for scientific and technological innovation. This designation was announced in the Overall Plan for the Construction of a Pilot Zone for Science and Technology Innovation Finance Reforms in the Beijing Zhongguancun National Innovation Demonstration Zone, jointly issued by nine ministries and commissions, including the PBOC, the National Development and Reform Commission, the Ministry of Science and Technology, the MIIT, the Ministry of Finance, the China Banking and Insurance Regulatory Commission, the CSRC, the State Administration of Foreign Exchange, and the National Intellectual Property Administration. In having a pilot zone located in the city, Beijing follows Jinan in Shandong Province and five cities in Yangtze River Delta, Shanghai, Nanjing, Hangzhou, Hefei and Jiaxing.
On June 7, 2023, the CSRC issued the Letter on Supporting the Pilot Project of Capital Market Fintech Innovation in Jinan City, making Jinan the sixth city approved to conduct the pilot project for capital market fintech innovation. Jinan follows Beijing, Shanghai, Guangzhou, Shenzhen, and Nanjing.
Soon afterwards, in November 2023, Chengdu was the seventh city approved to conduct a pilot project for capital market fintech innovation.
It is foreseeable that with the further expansion of the fintech innovation pilot programs and with the gradual popularization of innovative products and business models, regulatory rules will be correspondingly developed for financial innovations incorporating AIGC, cloud computing, big data, blockchain and other technologies. Similarly, IT-related legislation and law enforcement of financial innovation will be steadily promoted with the establishment of the Department of Science and Technology Supervision of the National Administration of Financial Regulation.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
