KYC in China – new requirements and considerations

China already has over one billion internet users and is the largest internet audience globally. New enhanced Know Your Customer (KYC) requirements in China are already written, and their enactment is coming soon (temporarily postponed from March 1, 2022.) Understanding and effectively implementing these Customer Due Diligence procedures are critical for ensuring compliance and prospering in this significant market.

In general, Know Your Customer (KYC) procedures are critical to assessing customer risk and a legal requirement to comply with Anti-Money Laundering (AML) laws. Obliged entities include financial service organizations such as banking, wealth management, insurance and financing. Effective KYC involves knowing a customer’s identity, their financial activities and the risk they pose.

According to the Financial Action Task Force (FATF) in their 2021 follow-up report on China, the country “has made progress to address the above noted deficiencies” in their AML initiatives, and the new requirements are a further step to ensure robust AML/KYC regulations. The new requirements are called Administrative Measures for Financial Institutions on Customer Due Diligence Investigations and Keeping of Customer Identity Information and Transaction Records.

China KYC requirements for a person

Under existing and new KYC requirements, obliged entities need to collect and keep a person’s:

• Name
• Gender
• Nationality
• Occupation
• Address
• ID certificate number

An identity verification needs to rely on well-sourced and independent proof materials, data or information. Sources for this information include:

• The Resident Identity Card, the national standard for proof of identity and compulsory for all Chinese citizens
• Banking data
• Mobile phone number data

The significant difference with the new requirements is the regulatory stipulation of “customer due diligence investigations” instead of “customers’ ID identification.” Beyond effective identity processes, KYC is about understanding the customer’s financial situation and transactions:

• Collecting information to determine their risk level effectively
• Obtaining enhanced due diligence information, if appropriate
• Monitoring transactions to ensure the transactions fit the profile
• Reviewing the account and other ongoing due diligence measures to ensure understanding of the risk and appropriate actions are in place

Specifically, when opening an account, or if transaction thresholds are exceeded (such as a single cash transaction by a person at/above RMB 50,000), then more due diligence is needed if:

• Money laundering or terrorist financing is suspected, or
• The authenticity, validity or completeness of the customer identity information is in doubt

To the second point, those with accounts in China might consider ensuring their identity information on record with financial organizations is authentic, valid, complete and current to help bypass the need for further due diligence.

China KYC requirements for an entity

Similarly, entities require initial and ongoing customer due diligence procedures often referred to as Know Your Business (KYB).

KYB includes the customer identification process noted above, as well as:

• Understanding the nature of the business, such as the industry, jurisdictions, type and amount of transactions and the products or services they offer
• Understanding the business ownership and control structure
• Identifying its beneficial owners
• Taking reasonable measures to verify the entity’s beneficial owners

A beneficial owner, similar to many other jurisdictions, is defined as any person who directly or indirectly has one of these ownership or control factors:

• Has 25% or more equity or partnership interest
• Has 25% or more income or earning rights
• Has control (or joint control) over the entity

There are several indicators of controlling the entity, including the ability to make decisions regarding:

• Directors or senior management
• Major business and management decisions
• Financial revenue and expenditure
• Important assets or major funds

If there’s no beneficial owner, senior management needs identification and steps for verification. Also, enhanced measures are necessary if any beneficial owner is a politically exposed person.

Doing business in China

There are also three Chinese laws designed to provide a comprehensive approach to cybersecurity, data security and data privacy that might require consideration for doing business in China, the Cybersecurity Law, the Data Security Law, and the Personal Information Protection Law.

Combined, these laws prescribe rules around how organizations should:

• Process citizens data
• What categories of data must be stored in China, rather than overseas
• Restrict cross-border transfers
• Provide disclosure and get personal consent
• Operate data security
• Deliver data breach notifications
• Protect, process and use personal information

Understanding the legal requirements around data rights and KYC and proactively implementing measures to ensure compliance will help avoid potential issues.

Trulioo has been helping businesses expand their operations into China for over five years. If you want to understand how to help ensure compliance, maximize your identity verification rates and grow your business in China, please contact us to talk about how we can support your growth in this key market.