Building a Compliant Platform

If a platform first receives buyer payments into its own account and then forwards them to sellers, it is effectively operating a payment business. Running such a business requires explicit approval from the People’s Bank of China as well as a minimum registered capital of 100 million RMB, paid in cash. Operating without this approval leads to immediate shutdown, confiscation of all earnings, heavy fines, and personal penalties for owners and responsible staff; in severe cases, criminal charges may also apply. The only safe approach is to ensure that no funds ever land in the platform’s account.

Cost

No monetary cost is involved. However, it requires some time to integrate a product from a licensed payment institution — that is, a company holding a payment license issued by the People’s Bank of China. By using such institution’s split-payment or escrow features, buyer payments are transferred straight to sellers without ever entering the platform’s own accounts.

Benefit

According to regulations, a payment business is defined as “transferring monetary funds based on electronic payment instructions submitted by payers or payees.” In other words, it involves moving money on behalf of others per their instructions. To operate such a business, one must obtain a payment license from the People’s Bank of China, and the minimum registered capital must be 100 million RMB, paid in full. Unauthorized operation results in immediate closure, seizure of all profits, and fines ranging from 500,000 to 2 million RMB if no profit was generated or if profit fell below 500,000 RMB; additionally, a further fine of 100,000 to 500,000 RMB applies to legal representatives and responsible personnel. Criminal law also classifies “illegally conducting fund payment and settlement services” as illegal business activity; serious violations may lead to imprisonment of up to five years, while especially grave cases incur sentences exceeding five years. As of May 2024, the threshold for “serious” violations is defined as total illegal transaction volume exceeding 5 million RMB or illegal profits surpassing 100,000 RMB nationwide.

Note

Designing the payment flow so that funds never enter the platform’s account is the sole safe method. In industry parlance, this practice is sometimes called “second clearing,” though this term does not appear in official documents; instead, regulations refer to it as “indirectly engaging in payment services.” The Supreme People’s Court and Supreme People’s Procuratorate explicitly list only three scenarios as illegal: fabricating transactions for cash-out, using corporate accounts for cash-out, and using cheques for cash-out. Platform-based collection and redistribution of payments are not explicitly named, so this description strictly follows statutory wording without asserting that it automatically constitutes a crime.

Websites that charge users must first obtain a Value-Added Telecommunications Business License. This license is issued solely to companies; individuals cannot apply for it. Free websites, on the other hand, only need to be registered, and this process incurs no fees. Operating a paid website without the proper license may result in confiscation of revenues, fines, or even closure. This section does not determine whether your platform falls under the category of transaction-facilitating services; the reasoning is explained in the notes.

Cost

Registration is free of charge. Obtaining a Value-Added Telecommunications Business License, however, involves costs; this license governs whether websites that charge users can legally operate. To apply for this license, you must first establish a company. For operations limited to one province, the registered capital must be at least 1 million RMB; for nationwide operations, it must be at least 10 million RMB. The review period lasts 60 days, and the license remains valid for 5 years.

Benefit

The regulations state: “The state implements a licensing system for commercial Internet information services and a registration system for non-commercial ones. No entity may provide Internet information services without obtaining a license or completing registration.” In other words, paid services must first secure a license, while free ones must register; operating without either is prohibited. “Commercial services” are defined as activities involving paid provision of information or webpage creation to users. Platforms that facilitate transactions are classified under Online Data Processing and Transaction Processing Services, commonly abbreviated as EDI. These services involve using data and transaction platforms linked to public communication networks to handle data processing and transactions on behalf of users. Such activities include transaction processing, electronic data exchange, and data handling via network devices. Operating without a license or exceeding its scope of permission results in confiscation of all illegal revenues and fines ranging from 3 to 5 times that amount. If no illegal revenues exist or they are under 50,000 RMB, fines between 100,000 and 1,000,000 RMB apply; severe violations may lead to website closure nationwide.

Note

To determine whether your platform qualifies as an EDI service, compare its activities to the definitions listed in the Telecommunications Business Classification Catalogue. No official regulation explicitly states that e-commerce platforms handling transactions and payments must obtain an EDI license. The Ministry of Industry and Information Technology’s guidelines merely advise applying for the appropriate license based on actual business activities. Therefore, this section merely outlines definitions without making any definitive conclusions. Additionally, only legally incorporated companies may apply for this license; individuals are ineligible.

To host live streams or game commentary sessions, you must secure a provincial-level Online Cultural Activities License that explicitly lists “online performances” among its permitted activities. Approval is granted within 20 days, and the license stays valid for three years. All recorded streams must be retained for a minimum of 60 days. Operating without this license results in immediate suspension, warnings, and fines up to 30,000 RMB; repeat offenders face inclusion on a cultural industry blacklist. A separate permit is required to distribute audiovisual content online, and only state-owned or state-controlled organizations may qualify for it.

Cost

The so-called “Online Cultural Activities License” governs whether one may earn money via live streams or game commentary. It is issued by provincial-level cultural authorities within 20 days of application and remains valid for three years, after which renewal must be requested at least 30 days prior to expiration. The separate Audiovisual Content Distribution License determines eligibility to publish programs online; it mandates that applicants be wholly state-owned or state-controlled entities — private firms essentially cannot obtain it.

Benefit

Securing the proper licensing framework ensures legal operation within China’s digital media sector while avoiding punitive measures. Compliance safeguards both business continuity and reputation by adhering to stringent regulatory standards governing online cultural activities and audiovisual distribution.

Note

Detailed licensing requirements are comprehensively outlined in official directives issued by seven government departments. Platforms monetizing live streams must additionally secure ICP registration — a mandatory filing process administered by China’s Ministry of Industry and Information Technology. Entities distributing audiovisual content must obtain the requisite Audiovisual Content Distribution License or complete applicable registration procedures. News publishers require a separate Internet News Information Service License. Note that the 2011 version of the Interim Provisions on Internet Cultural Management, republished by China’s Government Portal in 2025, remains unamended; current compliance references must be drawn from the Ministry of Culture and Tourism’s latest official texts.

If you host a server inside China, you must register it before launching your website. Registration itself costs nothing and is handled alongside the server setup at your provider; it generally takes a few days to weeks. Failure to register results in a mandatory deadline to rectify the issue, followed by a fine of 10,000 RMB; continued non-compliance leads to site shutdown. Additionally, failing to display the registration number on your homepage incurs a penalty ranging from 5,000 to 50,000 RMB.

Cost

There is no fee for registration. It is submitted together with the server application at the service provider’s end, and usually takes several days to weeks to process. Checking whether a provider holds the required license takes just ten minutes.

Benefit

The regulation explicitly states: “Without prior registration, no entity may provide non-commercial internet information services within the People’s Republic of China.” This means even websites that do not charge users must register first if they are hosted domestically. Non-compliant sites face the same penalties: a deadline to rectify the issue and a 10,000 RMB fine, with persistent violations resulting in site closure. The same rules apply to your service provider: it is prohibited from offering internet access services to any organization or individual that has not completed registration or obtained the necessary license. The same restriction applies to payment processors. The regulation further clarifies that such providers cannot offer access or payment processing services to entities lacking either a valid license or proper registration. In other words, legitimate providers cannot host sites that lack both a license and registration. Moreover, data center hosting and cloud hosting services fall under the category of “Internet data center services” under the law, while broadband access is classified as “Internet access services”; both categories require a separate license from providers. Finally, sites that fail to display their registration number on their homepage must rectify the issue and face fines between 5,000 and 50,000 RMB nationwide.

Note

Before negotiating terms with a provider, verify first whether it holds the required license. Use the Ministry of Industry and Information Technology’s Telecom Services Market Comprehensive Management System at tsm.miit.gov.cn to check by company name or license number. For website registration status, consult beian.miit.gov.cn. If you choose a data center without the proper license, you will have no recourse in case of disputes. Hosting servers overseas does avoid the registration requirement, but if your users and revenue are based in China, you remain subject to all obligations outlined in sections 5 through 10 of this chapter, plus additional costs related to cross-border data transfers.

If you allow third parties to sell goods on your platform, you must first verify their identity, address, contact details, and business licenses, then add them to your registration records. After setting up these records, you must re-verify seller information at least every six months. You must also report seller details to market regulators and submit tax-related data quarterly. All product and transaction records must be retained for three years. Failure to comply with any of these requirements results in a mandatory rectification order; if ignored, fines ranging from 20,000 to 100,000 yuan apply.

Cost

No direct monetary cost. However, the platform must perform background checks on sellers’ qualifications and maintain a registration database. Tax-related information must be reported quarterly, while transaction data must be kept for at least three years. The main challenge is that this is an ongoing obligation rather than a one-time task.

Benefit

Legal regulations set specific obligations for platforms. The official wording states that platforms must require sellers to provide authentic identity, address, contact, and licensing information, then verify and register this data while maintaining updated records. This means sellers must submit their basic details and required permits before joining, which you must then confirm and log into a database. Periodic re-verification is also mandatory. The exact interval for re-verification is defined as “at least every six months” under relevant administrative rules. Additionally, you must submit seller identity data to market regulators and tax authorities, as required by tax administration laws. All product, service, and transaction data must be retained for no less than three years from the date each transaction concludes. Non-compliance triggers a rectification order; persistent violations incur fines of 20,000–100,000 yuan, while severe cases may lead to temporary suspension of operations and fines of 100,000–500,000 yuan. Tax reports must be submitted within the month following each quarter’s end, with identical penalties for late submissions nationwide.

Note

Sellers themselves must also register as market entities. Certain exceptions apply: individuals selling self-produced agricultural or handmade goods, or providing small-scale services that do not require permits, are exempt. The threshold for “small-scale” activities is set at an annual transaction volume of 100,000 yuan under current online trade regulations. Platforms also bear two additional responsibilities: clearly marking registered versus unregistered sellers, and prohibiting the removal of consumer reviews.

Platforms are legally responsible for any issues arising from user content. You must set up a full system: user registration, post and comment moderation, daily monitoring, and clear procedures for handling incidents. Place a prominent reporting link on your site. When illegal content is found, immediately stop its distribution, document everything, and report it to authorities. Failure to do so can result in fines ranging from 50,000 to 500,000 yuan, with even harsher penalties for serious violations.

Cost

It costs money to hire moderators — this is the platform’s biggest ongoing expense. Reporting portals and records of every moderation action must be kept. The real challenge is that this work needs constant oversight; even a single day without it can lead to serious problems.

Benefit

Regulations require platforms to “fulfill primary responsibility for managing user-generated content.” This means platforms must regulate everything users post. Specific requirements include establishing rules for registration, account management, post and comment moderation, page management, real-time monitoring, emergency response, and handling of misinformation and illegal networks. Every step — from registration and posting to daily checks and incident response — must be clearly documented. Platforms must also provide an easily accessible reporting link in a highly visible spot. Upon spotting illegal content, they must “immediately take necessary actions, preserve records, and report to authorities” as mandated by the Cybersecurity Law. Non-compliance brings warnings, mandatory corrections, and fines up to 500,000 yuan; repeat or severe violations can lead to fines up to 2 million yuan, suspension of operations, website or app shutdowns, or even revocation of business licenses. Individuals directly responsible may also face fines of 50,000–200,000 yuan nationwide.

Note

You don’t need to invent moderation rules from scratch — just follow existing ones. Article 15 of the Internet Information Service Management Regulations explicitly lists nine categories of prohibited content. For live-streaming platforms, three extra obligations apply: they must set up a dedicated content moderation system, be able to instantly cut off any ongoing stream (“immediate blocking” per law), and retain both stream content and logs for at least 60 days. The same retention period applies to recorded online performances.

If your website allows posting or chatting, you must collect users’ real identity details at sign-up. Those who refuse to provide such information cannot be allowed to use the service. The recommended approach is to store the real name in the backend and let users pick their own nickname; phone number verification is sufficient for this purpose. Failure to enforce real-name policies results in mandatory corrective orders. Persistent violations attract fines ranging from 50,000 to 500,000 yuan, and may even lead to site shutdowns.

Cost

Implementing a real-name verification system involves paying per-use fees for the verification channel. The service should be designed under the principle of “real names stored in the backend, nicknames displayed to users” — meaning the actual name is kept on file while users can choose any nickname they prefer on the interface.

Benefit

The law explicitly states: “Internet service providers offering network access, domain registration, telephone services, or information publishing and instant messaging must demand authentic identity data from users at the time of agreement signing or service activation. Users who fail to supply such data cannot be granted service access.” Non-compliance — whether by neglecting to request real names or by knowingly allowing unverified users to join — triggers corrective orders. Serious or repeated breaches incur fines of 50,000–500,000 yuan, suspension of operations, mandatory business rectification, closure of websites or apps, and revocation of business licenses. Individual responsible parties face additional penalties of 10,000–100,000 yuan. Live streaming platforms must follow the same “backend real names, frontend nicknames” model, using mobile phone numbers for verification. For live commerce specifically, stricter rules apply: verification must rely on official identification documents and the unified social credit code — the unique identifier printed on every business license nationwide.

Note

The article numbering has been updated. The Cybersecurity Law was amended in 2025 and took effect on 1 January 2026. The real-name provisions moved from Article 24 to Article 26, while related penalties shifted from Article 61 to Article 64; the wording itself remains unchanged. Any existing documentation still referencing the old article numbers must be updated accordingly.

People younger than 16 cannot sign up for a live streaming account on this platform. Those aged 16 or older must have their identity verified and must also obtain permission from a parent or other guardian. Tipping is restricted based on age: children under 8 are not allowed to tip at all; those aged 8–16 may tip only with guardian consent; and anyone over 16 may tip only with guardian consent or proof of income. If a minor spends money without a guardian’s approval, the guardian can request a refund, and a court is required to grant it. A total of 2020 such cases have been reported to date.

Cost

There are no direct costs. The process simply requires adding two extra steps during registration and payment: first verify the user’s age, then confirm that a guardian has given consent.

Benefit

The law clearly states that “online live streaming service providers must not offer account registration services to minors under 16; when providing such services to minors aged 16 or older, they must verify their identity and obtain consent from a parent or other guardian.” It also mandates “a dynamic verification mechanism for the real identity information of live streamers,” meaning platforms must be able to recheck a streamer’s identity at any time. Additionally, platforms must “reasonably limit the maximum amount a minor may spend per transaction and per day,” establishing spending caps based on age. Tipping rules are similarly tiered: “Tipping services must not be offered to minors under 8; for those aged 8–16, consent from a guardian is required; for those over 16, consent or proof of income is required.” Finally, if a minor lacking full legal capacity spends money without guardian approval, a court must return those funds to the guardian. Minors lacking full legal capacity are defined as those who cannot make independent decisions under the law.

Note

In any dispute involving refunds, rulings must favor the minor. The wording of this policy has changed over time. In 2022, four government agencies and the National Radio and Television Administration both stated that minors were completely prohibited from tipping. However, a new notice issued in April 2026 introduced age-based limits at 8 and 16 years old, without explicitly revoking earlier rules or explaining how they relate. Therefore, the claim that “minors are entirely barred from tipping” is no longer accurate.

If someone sends you an infringement notice with preliminary evidence, you must promptly delete, block, or remove the relevant content and forward the notice to the seller. Failing to act in time means you and the seller will be jointly liable for any additional losses incurred. After receiving the seller’s defense, forward it to the claimant and wait 15 days. If the claimant files no complaint or lawsuit during this period, you can restore the content.

Cost

No cost involved. You must establish a fixed workflow: receive the notice, forward it to the seller, collect the seller’s defense arguments, and publicly disclose the final outcome. All steps must be documented.

Benefit

Rights holders are entitled to request e-commerce platforms to take necessary measures such as deleting, blocking, or removing links to infringing content, as well as terminating related transactions and services. Such notices must include preliminary evidence of infringement. Merely sending a generic statement is insufficient. Once a platform receives a valid notice, it must act promptly and forward the notice to the seller; failure to do so makes the platform jointly liable for any additional damages incurred. After a seller submits a defense, the platform must wait 15 days after forwarding the statement to the rights holder before lifting any measures, provided no complaint or lawsuit is filed. If a platform knows or should know of infringement yet fails to act, it will also bear joint liability with the seller. Regulatory authorities may also order the platform to make corrections within a set timeframe; failure to comply may result in fines ranging from 50,000 to 500,000 RMB for minor violations, and 500,000 to 2,000,000 RMB for serious cases. Conversely, if a party maliciously issues false notices causing losses to sellers, they must pay double the compensation owed (applies nationwide).

Note

If you operate a general website rather than a full e-commerce platform, you should follow the notice-and-takedown rules outlined in the Civil Code. The key difference lies in the waiting period after receiving a seller’s defense: the E-commerce Law specifies a mandatory 15-day window, while the Civil Code only requires a “reasonable timeframe.” Additionally, the E-commerce Law explicitly mandates that platforms disclose all received notices, seller defenses, and final resolutions to the public, as required under Article 44.

Transferring personal information of Chinese users to servers abroad constitutes a cross-border data transfer. Simply hosting servers overseas does not mean the data stays within China. There are four approved pathways for such transfers: a security assessment by the Cyberspace Administration, certification by authorized agencies, signing a standard contract, or compliance with other legal provisions. You must also disclose to users who receives their data, what it will be used for, and obtain their explicit consent for this specific purpose.

Cost

No cost involved. The simplest solution is to keep user data within China. If transfer overseas is unavoidable, follow standard contracts or obtain proper certification.

Benefit

To lawfully provide personal information to overseas entities — whether to foreign companies or foreign servers — at least one of four conditions must be met: passing a security assessment by the Cyberspace Administration; obtaining personal information protection certification; signing a standard contract drafted by the Cyberspace Administration; or meeting other requirements set by laws or administrative regulations. Additionally, you must inform users of the overseas recipient’s name, contact details, processing purpose, methods, and types of data involved, and obtain their separate consent. Threshold limits apply based on cumulative user counts. For most businesses not classified as critical information infrastructure operators, the exemption threshold is “fewer than 100,000 personal records (excluding sensitive information) transferred overseas in a calendar year.” Below this threshold, no assessment, contract, or certification is required. Between 100,000 and 1,000,000 records, a standard contract or certification is mandatory. For over 1,000,000 records, or when sensitive information of more than 10,000 individuals is involved, a formal security assessment is required (effective nationwide since March 2024).

Note

Hosting servers overseas does not equate to “data never leaving China.” If a user registers within China and their data is sent to foreign servers, this is still a cross-border transfer. Certain scenarios are exempt from assessment, certification, or standard contracts: cross-border shopping, shipping, or booking flights/hotels, provided these actions are necessary to fulfill a contract involving the user. Note also that user counts are calculated on a cumulative basis starting from January 1 of each year, not as a rolling 12-month period.

The main difference among these three options isn’t price — it’s what resources you’ll have at hand when something goes wrong. Big providers offer registration pathways, publish their credentials, issue outage notices, and include compensation clauses in their contracts, so help is readily available. Smaller vendors may charge half as much, but they often over‑sell capacity, disappear without notice, or get cut off by upstream providers; in such cases you won’t know who to turn to. For static websites that contain no user data, a cheap VPS costing just a few dozen yuan is perfectly adequate.

Cost

Cloud instances from major providers typically cost several hundred to several thousand yuan per month. VPS plans from smaller vendors start at just a few dozen yuan per month. A VPS is essentially a virtual mini‑server. Dedicated server hosting starts at several thousand yuan per year, and you must also purchase the hardware yourself.

Benefit

Again, the key distinction isn’t price but the support you can rely on during an emergency. Major cloud providers provide registration channels, disclose their qualifications, announce any outages, and guarantee compensation under their contracts, ensuring you can get assistance when needed. Smaller vendors can offer prices roughly half of those rates, yet when they over‑sell resources, shut down unexpectedly, or lose upstream connectivity, you have no recourse. Therefore, before negotiating a price, verify whether the vendor holds a valid value‑added telecommunications license via the Ministry of Industry and Information Technology database. Dedicated server hosting only makes sense if two conditions are met: the bandwidth or hardware costs are noticeably lower, and you have in‑house staff capable of managing the server. For static sites without user data, the cheapest VPS is sufficient; for sites that handle user registrations and transactions, choose a cloud instance that offers elastic scaling and snapshot backups, and store those backups in at least two separate locations.

Note

This entry is a guideline rather than a piece of evidence. The only verifiable item within it is the vendor’s licensing status. To save money, cut costs on configuration and bandwidth rather than on ensuring proper licensing.

If a breach, tampering, or loss of personal information occurs or is suspected, you must immediately deploy remedial containment, notify regulatory authorities, and alert affected users. Concealing breaches leads to regulatory orders for rectification; non-compliance carries fines up to 1 million RMB, or up to 50 million RMB for egregious violations. If users suffer damages and you fail to prove absence of fault, you bear tort liability. Taking reasonable security measures, executing incident response protocols, and reporting promptly can mitigate or waive penalties.

Cost

Free. Requires having a predefined data incident emergency response plan in advance: designating decision-makers, establishing containment protocols, and preparing communication templates for affected users. The psychological friction is the natural instinct to cover up the incident to avoid reputational damage.

Benefit

Article 57 of the Personal Information Protection Law (PIPL) provides that upon the occurrence or potential occurrence of personal data leaks, alterations, or loss, processors must immediately take remedial actions and notify supervisory authorities and affected individuals. Breach notifications must detail: (1) categories of data compromised, root cause, and potential harm; (2) remedial countermeasures taken and self-protection steps available to users; and (3) processor contact credentials. Notification to users may be waived only if remedial measures effectively prevent harm, though regulatory authorities retain the power to compel notification if harm remains possible. The Network Data Security Management Regulations permit notifications via telephone, SMS, instant messaging, email, or public announcements. Discovered criminal leads must be reported immediately to public security or state security agencies. Failure to fulfill data protection obligations triggers orders for correction, warnings, confiscation of unlawful gains, and suspension/termination of offending apps. Refusal to correct incurs fines up to 1 million RMB (with responsible supervisors fined 10,000–100,000 RMB). Severe violations incur fines up to 50 million RMB or 5% of annual turnover, with executives fined 100,000–1,000,000 RMB. Under civil tort law (Article 69), processors bear presumed liability unless they prove absence of fault. Under Cyberspace Administration of China (CAC) incident reporting rules, breaches affecting over 1,000,000 individuals constitute "major network security incidents" requiring formal reporting to provincial cyberspace authorities within at most 4 hours (e.g. via the 12387 hotline), followed by a comprehensive summary report within 30 days. Conversely, entities maintaining verified baseline defenses, following incident contingency plans, and reporting proactively may receive mitigated penalties or exemption from administrative liability.

Note

Even for small web services where breaches affect hundreds or thousands of users, the PIPL remedial and user notification requirements apply, although the 4-hour CAC threshold is not triggered. When notifying users, provide specific guidance: suggest which account credentials to reset and warn against incoming social engineering or phishing scams mimicking support personnel. Retaining security audit logs for at least 6 months is essential to trace intrusion vectors during post-incident investigations (see Chapter 11, Rule 16). For end-user defense against data breaches, see Chapter 14.

When selling auto-renewing memberships, operators must display conspicuous disclosures before initial user signup and prior to each recurring charge date, allowing consumers to make an explicit choice. Platforms must provide an easily discoverable, simple mechanism to cancel or modify recurring subscriptions at any time without charging unreasonable cancellation fees. Silent automatic renewals can incur administrative fines between 1 and 5 times the illegal gains, or up to 300,000 RMB where no illegal gains are established.

Cost

Free. Clearly describe recurring terms on subscription enrollment pages, dispatch an automated notification prior to each renewal deduction, and provide an unambiguous one-click cancellation button in user profile settings. The commercial friction is that a subset of users may choose to cancel upon receiving renewal reminders.

Benefit

Under Article 18 of the Measures for the Supervision and Administration of Online Transactions, businesses offering services via auto-renewal or auto-extension must conspicuously alert consumers prior to service initiation and prior to each automatic renewal billing date, allowing the consumer to decide autonomously. Throughout the active service period, providers must offer prominent, simple options for consumers to cancel or alter subscriptions at any time without imposing unreasonable fees. Article 10 of the Regulations for the Implementation of the Law on the Protection of Consumer Rights and Interests establishes identical statutory notification requirements. Failure to provide mandatory renewal notifications incurs administrative orders for rectification, formal warnings, confiscation of illegal revenue, and fines ranging from 1 to 5 times the unlawful proceeds (or up to 300,000 RMB in the absence of unlawful revenue). Serious violations may lead to business suspension or business license revocation. Failing to provide convenient cancellation interfaces incurs correction orders and administrative fines up to 30,000 RMB.

Note

Statutory rules do not dictate the exact visual UI layout for "prominent reminder," but standard compliance practice is dispatching a dedicated SMS, email, or in-app push notification 5 days before each billing renewal and preserving system delivery logs. For end-user steps to cancel existing automated subscriptions, see Chapter 5, Rule 1.