White-Collar Crime 2023

Last Updated October 24, 2023

China

Law and Practice

Authors



Topcom China Law Offices is a professional and efficient legal service provider, which consists of a team of professionals with rich experience in legal practice. With a high sense of responsibility and professional dedication, the team commits itself to providing clients with the highest quality legal services. Practice areas mainly involve compliance and investigation, dispute resolution, intellectual property, data protection, investment and M&A. All of the firm’s lawyers are equipped with international perspectives in servicing many Fortune Global 500 companies as well as leading domestic and international enterprises, covering key industries including chip manufacturing, food and agricultural products, health care, automobiles and e-commerce. The team consists of a group of like-minded young and senior lawyers with enthusiasm for law. The firm has handled China’s first case of illegally providing trade secrets to overseas entities and the top ten most important legal cases of 2016 that pushed forward China’s legal system.

According to the PRC Criminal Law, the main criminal offences are categorised based on the legitimate interests violated through criminal acts. The sub-chapters of the PRC Criminal Law include ten categories of the main crimes. Generally speaking, white-collar crimes refer to criminal offences where the defendant (i) breaches their legal duty as a public official, or (ii) takes advantage of their position to seek illegitimate interests.

The most commonly seen white-collar crimes could include the following five categories:

  • crimes related to corruption and bribery (eg, the crimes of accepting bribes by public officials, offering bribes to public officials, accepting bribes by non-public officials, offering bribes to non-public officials, bribing through influence peddling, misappropriation of corporate funds, etc);
  • abuse of privilege of position (eg, the crime of abuse of public office duties, abuse of duty by personnel from state-owned enterprises and institutions, leaking state secrets, retaliation, false imprisonment, illegitimate search and seizure, etc);
  • negligence of duty by public officials (eg, the crime of negligence of duty by public officials, negligence of duty by personnel from state-owned enterprises/institutions, and personnel from state-owned enterprises and institutions committing fraud in the name of contract signing, etc);
  • fraud for personal gains (eg, selling shares of state-owned assets at under-valued or discounted prices, illegitimate approval of eminent domain, confiscation or occupancy of land, illegitimate transfer of land use rights at low prices, etc); and
  • miscellaneous (eg, damaging the interests of a listed company by breach of fiduciary duty, insider trading, soliciting and defrauding investors to purchase or sell securities or futures, illegitimate issuance of financial instruments, illegitimate approval of bank loans, etc).

Under the general principle of the PRC Criminal Law, the constituent elements of crimes include (i) object (the damaged interests), (ii) objective aspects (actus reus/guilty act), (iii) subject (who commits the crime), and (iv) subjective aspects (mens rea/guilty mind). To establish a criminal offence, prosecutors have to establish concurrence of physical act and mental state, as well as harmful result and causation. However, for each specific criminal offence, the sub-chapter of the PRC Criminal Law defines its respective constituent elements.

For some crimes, prosecutors must prove intent or motive, for example, for the crime of offering bribes to public officials, the PRC Criminal Law requires the intention of “for the purpose of obtaining illegitimate interests”. However, there are also strict liability offences, where motive or intention is not a “must-have” constituent element. Strict liability offences are usually related to public security, national defence or public welfare. For example, producing and selling food that does not meet the safety standard is a strict liability offence, and therefore, defences that would negate the mens rea, such as mistake of fact or lack of intention or motive, are not applicable. 

According to the PRC Criminal Law, a person may be held liable for an attempted offence, even if the crime is not completed. Similar to common law theory, a criminal attempt is an act that, despite the intention of committing a crime, falls short of completing the crime. An attempt consists of three elements: (i) a specific intent to commit the crime, (ii) an overt act in furtherance of that intent; and (iii) the crime could not be completed due to reasons against the defendant’s will. To commit an attempted offence, the defendant must have committed an act beyond the mere preparation to commit the offence. The overt act must constitute a “substantial step in the course of a planned conduct to culminate in committing the crime”. For example, in the case that a bribe offeror attempts to offer a bribe to public official A, and after the bribe offeror pays the bribe to A, it turns out that A is not a public official. In this case, the bribe offeror still commits the crime of attempting to offer a bribe to a public official, despite the fact that A is not a public official. In other words, the defence of factual impossibility is not available for the attempted crime in this case. Notwithstanding the above, the punishment for an attempted crime could be alleviated or reduced compared to that for a completed crime.

According to the PRC Criminal Law, the statute of limitations is calculated based on the maximum sentence of each criminal offence stipulated by the PRC Criminal Law. The statute of limitations could range from five to 20 years, or even longer upon approval by the Supreme People’s Procuratorate.

For the main categories of white-collar crimes, the statute of limitations varies. For example, for the crime of accepting bribes by public officials, since the maximum sentence could be lifetime imprisonment or death penalty, the statute of limitations could be 20 years; for the crime of offering bribes to public officials, since the maximum sentence could be lifetime imprisonment (no death penalty), the statute of limitations is 20 years; for the crime of accepting bribes by non-public officials, since the maximum sentence could be lifetime imprisonment, the statute of limitations is 20 years; for the crime of offering bribes to non-public officials, since the maximum sentence is imprisonment of no more than ten years, the statute of limitations is ten years. Meanwhile, for the crime of offering bribes to an entity, since the maximum sentence is imprisonment of no more than three years, the statute of limitations is five years; and for the crime of offering bribes by an entity, since the maximum sentence is imprisonment of no more than five years, the statute of limitations is five years.

The statute of limitations begins running from the day the criminal offence is committed; if the criminal offence continues to occur, the statute of limitations starts running from the day the criminal offence ends. If the defendant escapes or conceals the criminal offence after the judicial authorities have established the case, the statute of limitations defence is not applicable in this circumstance.

In practice, the statute of limitations is the first thing a defence attorney shall consider. When a case is filed with the public security authorities, the attorney shall examine whether the statute of limitations has been exceeded.

Additionally, in the event that the defence attorney argues that the defendant shall be charged with another crime carrying a lighter sentence (eg, changing from a felony to a misdemeanour), it is crucial to review the statute of limitations. For example, if the prosecuted crime is extortion with the maximum sentence of more than ten years and the statute of limitations of 15 years, the defence attorney argues that the charged crime shall be changed to forging evidence with the maximum sentence of only three years and therefore the statute of limitations of only three years. In this case, the defence could claim that the case is beyond the statute of limitations.

According to the PRC Criminal Law, the courts can exert extraterritorial jurisdiction based on personal jurisdiction and protective jurisdiction.

  • Under personal jurisdiction, when a PRC citizen commits a crime outside the territory of the PRC, the courts can exert jurisdiction over the PRC citizen. However, if the maximum sentence of such crime is no more than three years under the PRC Criminal Law, the defendant could be exempted from criminal liability by the PRC courts. In addition, the courts can exert extraterritorial jurisdiction if a PRC government official or military officer commits a crime outside the PRC.
  • Under protective jurisdiction, if a foreigner commits a crime against the PRC or PRC citizen(s), and if the minimum sentence of such crime is imprisonment of no less than three years under the PRC Criminal Law, the courts could have jurisdiction, unless such crime is not punishable at the place where the criminal activity occurs.

A legal entity could be subject to criminal liability if the entity commits a “unit crime”. 

Under the unit crime doctrine, the person directly responsible (eg, legal representatives), other responsible person (eg, managers) and the company could be held liable for a criminal offence. Traditionally, the unit crime can be charged only when the sub-chapter of the PRC Criminal Law has explicitly provided for a unit crime in addition to the crime committed by an individual. In other words, in order to hold a company criminally liable, it is a pre-requisite to simultaneously hold the relevant personnel criminally liable. The unit crime is usually charged when the following three elements are met: (i) the decision is made collectively by the management of the company; (ii) the criminal offence is committed in the name of company; and (iii) the criminal offence is committed for the benefit of the company. 

However, there are some recent developments for the “unit crime”, where only relevant personnel is held criminally liable, while the company could be exempted from the criminal liability of the unit crime. For example, in a pilot programme, for unit crimes where the responsible personnel could be sentenced to imprisonment of no less than three years but no more than ten years, if the company satisfies the condition for non-prosecution due to compliance, the procuratorate will only prosecute the relevant personnel, and the company’s criminal liability could be exempted.

In the context of a merger and acquisition, if the management of the successor entity knowingly continues the criminal offences committed by the target entity, the successor entity could be held liable; but if the management of the successor entity completely ceases the criminal offence and successfully remediates the harm caused, the successor entity shall not be held liable for the criminal offences committed by the target entity prior to the acquisition.

In judicial practice, public security and procuratorates are inclined to hold a corporate liable, mainly because monetary penalties such as fines and confiscation of property can be better enforced in the case of unit crimes in comparison to personal crimes.

However, in the investigation stage of criminal offences, it is not uncommon for the unit to abdicate responsibility to employees in order to protect the unit and its officers, mainly considering difficulties in discovering evidence for the unit crime, and economic compensation available for the employees as the balance factor in practice. 

The victims of a white-collar offence have two legal grounds to claim compensation for their loss: (i) a criminal incidental civil litigation; or (ii) a separate civil litigation. Therefore, depending on the corresponding legal proceedings chosen by the plaintiff, both the criminal court and the civil court could have jurisdiction to allocate damages to the victims of a white-collar offence. In addition, class actions are admitted in the PRC courts. For example, according to the Civil Procedure Law and the Securities Law, representatives of plaintiffs of securities disputes arising from fraudulent misrepresentation, insider trading and market manipulation could file class actions at the competent court.

In July 2023, the Twelfth Amendment of the PRC Criminal Law (Draft) (“Draft Twelfth Amendment”) was submitted to the Standing Committee of the National People’s Congress for review. 

The Draft Twelfth Amendment further raises the criminal liability for the unit crime of bribery, in particular, the crime of accepting bribes by an entity, offering bribes by an entity, and offering bribes to an entity. In practice, since the criminal liability for bribery-related unit crime is lighter than that of an individual offender, there are a lot of cases where defendants offer or accept bribes in the name of corporates in order to mitigate the criminal liabilities. In light of these criminal schemes to use corporates as a cover for bribery, the Central Disciplinary Commission specifically requested to further strengthen the relevant anti-bribery laws and regulations to prevent and punish systematic corruption. Therefore, the Draft Twelfth Amendment proposes the following revisions:

  • raise the sentencing for the crime of accepting bribes by an entity – the maximum sentence for the responsible person will be raised from five years to ten years’ imprisonment;
  • raise the sentencing for the crime of offering bribes by an entity – the maximum sentence for the responsible person will be raised from five years to ten years; and
  • raise the sentencing for the crime of offering bribes to an entity – the maximum sentence for the responsible person will be raised from three years to seven years.

Furthermore, in practice, the enforcement authorities tend to impose more severe punishment on bribe recipients rather than bribe offerors, and as a result, there are many cases where the bribe recipients are punished while the bribe offerors are not charged with criminal liability. However, according to the instruction from the top leaders, during the Nineteenth and the Twentieth National People’s Congress, it was suggested to “investigate the bribe recipients together with the bribe offerors”. Therefore, the Draft Twelfth Amendment added the aggravated factors for the crime of offering bribes to public officials. The newly added aggravated factors include:

  • offering bribes multiple times or to multiple recipients;
  • the bribe offeror is a public official;
  • offering bribes in the course of the nation’s critical work and projects;
  • offering bribes in projects of human resource, judicial enforcement, environmental protection, finance management, safety production, food and pharmaceutical, disaster relief, social pension, and education and healthcare;
  • offering bribes for the purpose of criminal activities; and
  • using illicit gains to offer bribes.

Based on the authors’ experience, the Chinese enforcement authorities usually carry out intensive enforcements after a new amendment is issued. The authors will pay close attention and follow up on legislation, and recommend to their clients to seek legal advice if they have frequent interactions with government authorities, state-owned enterprises or institutions.

In China, there is no specialised police squads, judges or criminal courts for white-collar offences. The oversight authorities, the procuratorate, the public security bureau, and various administrative authorities have investigative powers against white-collar offences. The procuratorate is responsible for prosecuting the white-collar offences committed by both public officials and non-public officials. The criminal courts are responsible for adjudicating white-collar crime cases.

The oversight commission is mainly responsible for investigating criminal offences and misconduct by public officials. The public security bureau is responsible for investigating other white-collar offences committed by non-public officials. In addition, administrative authorities, such as CSRC, finance, tax, foreign exchange, market regulation, customs and anti-monopoly authorities, also have investigative power for civil or administrative violation cases within the scope of their respective duties. For example, tax authorities can investigate tax evasion-related cases, CSRC can investigate misrepresentation cases during IPO or issuance of securities, foreign exchange authorities can investigate cases on the usage of converted foreign currency registered capitals, the anti-monopoly authorities can investigate monopoly agreements, etc. 

In recent years, the central government has endeavoured to improve the transfer of cases from administrative authorities to judicial authorities. In the process of investigating administrative violations, if the administrative authorities find potential criminal offences related to the crime of destruction of socialist economic order (eg, the crimes of tax evasion, smuggling, financial frauds, infringement of intellectual properties, etc) or obstruction of management of social order (eg, the crime of obstruction of justice and destruction of environmental resources, etc), the administrative authorities must transfer the cases to the public security bureaus for further investigation. It is prohibited for administrative authorities to charge administrative penalties instead of transferring the case to the public security bureaus. The procuratorate and the oversight commission shall monitor the process of transferring the case to the public security bureaus by administrative authorities.

The oversight commission, the procuratorate and the public security bureau initiate investigations upon (i) whistle-blower allegations, (ii) confession of an offender, or (iii) cases transferred by administrative authorities. The administrative authorities can initiate investigations in accordance with the law, including but not limited to (i) industrial sweeping investigations, (ii) regular on-site inspections, or (iii) investigations based on whistle-blower allegations from competitors, terminated business partners (vendors, suppliers, agents, etc), or disgruntled former employees.

Generally speaking, the Criminal Procedure Law governs the initiation of a criminal investigation. Meanwhile, various administrative authorities have issued their respective rules that govern the administrative investigations initiated by China Securities Regulatory Commission (CSRC), finance, tax, foreign exchange, market regulation, customs, and anti-monopoly authorities, etc. As mentioned above, when the administrative authorities discover potential criminal offences during an investigation of administrative violations, they must transfer such cases to an oversight commission or the public security bureau for further investigation. Public security bureaus should establish the criminal cases for further investigation upon receiving the cases from administrative authorities. The procuratorate and the oversight commission should monitor the following two situations: (i) cases that the administrative authorities fail to transfer to the public security bureaus for further investigation; and (ii) cases that the public security bureaus refuse to establish upon receiving the cases from administrative authorities. Notwithstanding the above, in practice, when the administrative authorities transfer the cases to the public security bureaus, the administrative authorities must transfer evidence that is sufficient to establish a criminal case so that the public security bureau is willing to accept and establish the criminal case.

According to the PRC Criminal Procedure Law and the PRC Oversight Law, the investigative authorities usually have broad investigative powers to gather information and documents related to white-collar offences, including but not limited to, interrogating the suspects, inquiring the witness, conducting deposition, search and seizure, examination, and authentication, etc. During the criminal investigation proceeding, the investigative authority shall collect all relevant evidence that could prove the suspects guilty or innocent. Therefore, the investigative authority has the power to (i) demand the company to produce documents, provided however, that the documents are relevant to the facts of the case, (ii) raid a company and search and seize the relevant documents, and (iii) interrogate or submit the employee, officer or director of a company to an inquiry; or (iv) require an employee, officer or director of a company under investigation, or a third party, to be interviewed.

The oversight commissions and the public security bureaus usually have much broader investigative powers than the administrative authorities, because the oversight commissions and the public security bureau have the right to detain the suspects, which the administrative authorities do not. In practice, the oversight commissions sometimes do not necessarily demand the maximum six-month detention period, while the duration of detention by public security bureaus is usually strictly limited by the Criminal Procedure Law.

There is no mandatory legal requirement for a company to conduct an internal investigation. However, companies usually will conduct an internal investigation when a competent authority knocks on the door, in order to (i) understand facts and assess risks, and (ii) co-operate and fully disclose relevant facts to the investigative authority. 

Furthermore, according to the Measures for Establishing, Evaluating and Examining Compliance Program of Enterprises (Trial), whether a company employs a robust compliance programme and conducts effective and full internal investigation is a heavily weighed factor when the effectiveness of the compliance programme is assessed. Depending on the effectiveness of the compliance programme, the procuratorate has the discretion to decide not to arrest or prosecute, change mandatory measures, or propose leniency. Therefore, completeness and thoroughness of the internal investigation could impact the prosecution and ultimate sentencing of a criminal offence.

China has entered into mutual legal assistance treaties in criminal matters with more than 60 countries, including but not limited to the US, UK, France, Italy, Russia, Spain, New Zealand, Japan, Korea, and Australia, etc. In 2018, the PRC International Criminal Mutual Legal Assistance Law took effect, pursuant to which the Chinese government and the foreign country will provide reciprocal assistance to inspect, investigate, prosecute, adjudicate and enforce a criminal case, including but not limited to servicing the legal documents, collecting evidence, arranging witness, seizure, preservation or attaching property, forfeiture and extradition, etc. The National Oversight Commission, the Supreme People’s Court, the Supreme People’s Procuratorate, the Ministry of Public Security Bureau and the Ministry of National Security are the governing authorities, responsible for the review of (i) requests that the PRC government raises to foreign countries, and (ii) requests raised by foreign countries to the PRC government.

Extradition is a major effective way for the PRC government to pursue overseas fugitives and illegitimate gains. Courts usually assess extradition requests based on the commitment of sentencing (eg, no death penalty), attitude of the extraditee, and acknowledgement of self-disclosure. As of December 2021, China has entered into bilateral extradition treaties with more than 60 countries. According to the PRC Extradition Law, if both the requesting country and China conclude that the alleged act constitutes a crime, the foreign country could request the PRC government to extradite the fugitive from the PRC to the requesting country to be tried for the crime, provided however that the criminal offence is punishable by imprisonment for no less than one year at both the requesting country and the PRC. A foreign country could also request the PRC government to extradite the incarcerated person from the PRC to the requesting country to be punished, if the remaining sentence is no less than six months at the time the extradition request is raised. Therefore, if a fugitive commits white-collar crimes such as bribery or corruption that violate the criminal law of both the requesting country and China, the PRC Extradition Law could apply if the above prerequisites are satisfied.

According to the PRC Criminal Procedure Law, the procuratorate is responsible for prosecuting crimes. Before prosecuting a criminal case, the procuratorate will assess whether (i) the facts of the criminal offence are clear, (ii) the evidence is true and sufficient, (iii) the crime alleged is correct, (iv) if there is any missing criminal offence or suspect; (v) if there is any civil proceeding attached to the criminal litigation, and (vi) if the investigative activities are carried out in accordance with the Criminal Procedure Law.

The PRC Criminal Law has stipulated the sentencing, the aggravator factors and the mitigating factors for each criminal offence based on the facts, nature, circumstance and extent of harm of the crime. The courts may exercise discretion to charge a company or individual who commits a white-collar offence within the scope of sentencing stipulated by the law and the judicial interpretations issued by the Supreme People’s Court.

There is no direct reference to deferred prosecution agreements or non-prosecution agreements under the PRC Criminal Law or the PRC Criminal Procedure Law. However, the PRC Criminal Procedure Law does provide a similar mechanism to resolve a criminal investigation without a trial.

Non-prosecution based on a compliance programme has been officially introduced across China since 2022. This means that the prosecuting authorities for unit crime cases can decide not to arrest or prosecute in order to propose a lighter sentence under the plea system of leniency by requiring enterprises suspected of specific crimes to make compliance commitments and actively rectify in order to promote compliance and law-abiding business. The application of the non-prosecution based on compliance programme includes both unit crime cases and individual crime cases related to the production and operation of enterprises.

For an enterprise-related criminal case that meets all of the following conditions, the People’s Procuratorate may apply the Guiding Opinions on Establishment of a Third-party Supervision and Evaluation Mechanism for the Compliance of Enterprises Involved in Cases (for Trial Implementation) (the “Guiding Opinion”) as the case may be: (i) The enterprise or individual involved in the case pleads guilty and accepts punishment; (ii) The enterprise involved in the case can carry out normal production and operation, makes a commitment to establish or improve the corporate compliance system, and meets the basic conditions to launch a third-party supervision and evaluation mechanism (the “Third-party Mechanism”); and (iii) The enterprise involved in the case voluntarily applies the Third-Party Mechanism.

According to the Guiding Opinion, the Third-Party Mechanism refers to a third-party supervision and evaluation organisation selected and appointed by the Administration of Third-Party Supervision and Assessment Mechanism to investigate, evaluate, supervise and inspect the compliance commitment of the enterprise involved when the procuratorate handles a corporate unit criminal case which meets the applicable conditions for the corporate compliance reform. The investigation results shall serve as an important reference for the procuratorate to handle the case in accordance with the law.

The Third-Party Mechanism is applicable to financial crimes and duty-related crimes involved in production and operation activities of companies and enterprises, which include not only the crimes committed by companies and enterprises, but also the crimes committed by actual controllers, operation and management personnel and key technical personnel of companies and enterprises that are directly responsible for the production and operation activities.

A defendant can acknowledge charges in exchange for a conviction on reduced charges.

According to the Sentencing Guidance for Commonly Seen Crimes (Trial):

  • if the defendant reaches a criminal settlement agreement or a plea agreement, the criminal liability could be reduced by no more than 50% of the base sentence, taking into full consideration the nature of the crime, the amount of the compensation, the candidness and sincerity of the remorse and apology; in case of minor offences, the criminal liability could be reduced by more than 50% or completely exempted; and
  • if the defendant pleads guilty and accepts the punishment, the criminal liability could be reduced by no more than 30% of the base sentence, taking into full consideration the nature of the crime, the severity of the offence, the timing, extent, value and degree of the defendant’s remorse. If the defendant conducts self-disclosure, confesses material facts, voluntarily returns illicit gains, or reaches a settlement with the victim and compensates the victim for losses, the criminal liability could be reduced by no more than 60% of the base sentence. Furthermore, in case of minor offences, the criminal liability could be reduced by more than 60% of the base sentence or completely exempted.

Any criminal suspect who voluntarily pleads guilty, accepts punishment and accepts the sentencing recommendation and applicable procedures shall sign an affidavit on plea of guilty and punishment acceptance in the presence of their defence lawyer. The presiding judge shall examine the voluntariness of their plea of guilty and punishment acceptance, as well as examine the authenticity and legality of the contents of the affidavit. When rendering a judgement, the court will usually adopt the charges and sentencing recommendations proposed by the procuratorate in accordance with law.

Besides, if the defendant pleads guilty and accepts punishment, and the case meets other necessary conditions, including a non-prosecution based on compliance programme, as mentioned in 2.7 Deferred Prosecution, the Guiding Opinions could apply.

There are more than 50 criminal offences that could be imputed to unit crime according to the PRC Criminal Law. In recent years, unit crimes against which competent authorities have taken severe enforcement actions include bribery and corruption, tax evasion, illegitimate solicitation of funds, manipulation of securities and futures markets, money laundering, leaking state secrets, infringement of commercial secrets, infringement of personal information, and crimes of intrusion into computer systems, etc.

As was introduced in 1.4 Corporate Liability and Personal Liability, a legal entity could be held criminally liable if it commits a “unit crime”. Under the unit crime doctrine, the person directly responsible, other responsible persons (eg, legal representatives, managers, etc) and the company could be held criminally liable. The unit crime is committed when the following three elements are met: (i) the decision is made collectively; (ii) the criminal offence is committed in the name of the company; and (iii) the criminal offence is committed for the benefit of the company.

There are various criminal offences under the PRC Criminal Law that could be imputed to the company. In addition to the above three elements, the defendant shall also meet the constituent elements of various crimes. For example, in addition to the above three elements, the crime of offering bribes to public officials by an entity also includes the following constituent elements: (i) motive – for the purpose of seeking improper interests, (ii) subject – the bribe offeror must be an entity, and (iii) object – the integrity and incorruptible nature of the duty of public officials; and (iv) objective aspect – the recipient must be a public official, and the bribes could be offered in the form of kickbacks or commissions.

Under the PRC Criminal Law, the main bribery-related crimes are as follows:

  • accepting bribes by public official(s), maximum sentence of lifetime imprisonment or death penalty plus forfeiture;
  • offering bribes to public official(s), maximum sentence of lifetime imprisonment plus a fine or forfeiture;
  • accepting bribes by non-public official(s), maximum sentence of lifetime imprisonment plus a fine;
  • offering bribes to non-public official(s), maximum sentence of imprisonment of no more than ten years plus a fine;
  • accepting bribes using influence, maximum sentence of imprisonment of more than seven years plus a fine or forfeiture;
  • offering bribes to personnel with influence, maximum sentence of imprisonment of no more than ten years plus a fine;
  • offering bribes to an entity, maximum sentence of imprisonment of no more than three years plus a fine;
  • offering bribes to public official(s) by an entity, maximum sentence of imprisonment of no more than five years plus a fine;
  • bribery peddling, maximum sentence of imprisonment of no more than three years plus a fine; and
  • offering bribes to foreign public official(s) or official(s) from international organisation(s), maximum sentence of imprisonment of no more than ten years plus a fine.

General Introduction of the Constituent Elements for Bribery-Related Crimes

The constituent elements of the crime of receiving bribes by public official(s)are as follows:

  • object (the interests injured) – the integrity and incorruptible nature of the duty of public officials;
  • objective aspect (actus reus/guilty act) – the defendant has taken advantage of their capacity as a public official to solicit or accept property from others, including kickbacks or commission fees, etc;
  • subject (who commits the crime) – the defendant must act in the capacity of a public official; and
  • subjective aspect (mens rea/guilty mind) – the defendant must have the motive to seek interests for the bribe offeror.

The constituent elements of the crime of offering bribes to public official(s) are as follows:

  • object (the damaged interests) – the integrity and incorruptible nature of the duty of public officials;
  • objective aspect (actus reus/guilty act) – the defendant has offered property to the public official(s);
  • subject (who commits the crime) – any individual; and
  • subjective aspects (mens rea/guilty mind) – the defendant must have the motive to seek improper interests.

Among the constituent elements for accepting or offering bribes, the “property” refers to money, material objects and property interests. Property interests include material interests that could be converted to money – eg, decoration, acquittance of debts, and any other payable interests, including membership service and travel, etc. 

The definition of “public officials” covers a broad range, and therefore has been a frequently used defence in bribery cases. For decades, the laws and judicial interpretations have been amended from time to time on this point. In particular, the Regulation on Implementation of the PRC Oversight Law implemented in September 2021 defines “public officials” as follows: (i) government officials, (ii) management personnel of state-owned enterprises, (iii) personnel who perform organisational, leadership, management or supervisory duties in education, scientific research, cultural, healthcare or sports institutions that are invested by government authorities or other organisations using state-owned assets for the purpose of social welfare; (iv) the preliminary level of people’s autonomous organisations (eg, the sub-district offices); and (v) other relevant personnel who perform public duties (eg, representatives of People’s Congress, representatives of the People’s Political Consultative Congress, etc). In addition to the criminal offence of offering or accepting bribes to the PRC public officials, it is also a criminal offence to offer bribes to “foreign public officials” who work on behalf of foreign governments or international organisations.

In addition to the bribery between public officials, bribery between private entities could also be criminalised under the PRC Criminal Law. According to the PRC Criminal Law, it is a criminal offence to offer kickbacks or off-the-books commissions in economic transactions between private entities. In fact, under the administrative law regime, the PRC Anti-Unfair Competition Law provides that it is commercial bribery to offer bribes to entities that (i) are entrusted by the counter-party to handle relevant affairs; or (ii) have the power to influence the transactions. Private entities are allowed to pay legitimate discounts or commissions, provided however, that such discounts or commissions are explicitly and truly recorded in the accounting books; otherwise, kick-backs or off-the-books commissions are illegitimate, and could lead to commercial bribery risks. The Administrations of Market Regulation could pursue administrative liabilities against private entities that commit commercial bribery. Furthermore, during the process of administrative investigation, if the Administrations of Market Regulation find that the private entities violate criminal laws, the administrative authority must transfer the case to the public security bureau for criminal investigation.

Generally speaking, an ordinary employee who does not owe a fiduciary duty to the company has no specific obligation to prevent bribery, merely because the employee has knowledge of the bribery but did not conspire or participate in the bribery. However, if the employee (i) owes a fiduciary duty to the company, or (ii) conspires or participates in the bribery, then when the company commits the unit crime of bribery, the employee has the obligation to prevent, because otherwise, the court would probably presume that the employee is a conspirator or accomplice or accessory to the unit crime of bribery.

In China, state-owned enterprises are strictly regulated. The State-Owned Assets Supervision Commission stipulates that state-owned enterprises are obliged to maintain a compliance programme. According to the Central State-Owned Enterprise Compliance Management Guidance (Trial), the management of state-owned enterprises has an obligation to develop a compliance programme. If the company fails to do so, and if the non-compliance misconduct results in criminal activities, both the company and the responsible personnel could be held liable.

Furthermore, under the mechanism of non-prosecution based on a compliance programme, if a company chooses to implement a robust compliance programme, the procuratorate may, at its discretion, decide not to arrest or prosecute, change the mandatory measures, or propose leniency, depending on the effectiveness of the compliance programme. An effective and robust compliance programme usually includes, but is not limited to:

  • effective identification and control of compliance risks;
  • promptly dealing with irregularities and violations;
  • reasonable allocation of compliance department and personnel;
  • development of compliance policy and sufficient human resource and financial support;
  • normal operation of detection, whistle-blowing, investigation and handling mechanisms; and
  • continuous remedial actions and compliance culture.

According to the PRC Criminal Law, the main offences related to insider trading and criminal banking law are as follows.

  • The crime of insider trading – the defendant, who has knowledge of inside information, purchases or sells securities or futures during the course of issuance or trading of securities, or before the disclosure of information that could have material impact on the price of securities or futures; or the defendant who has knowledge of inside information leaks such information and explicitly or implicitly requests others to purchase or sell the underlying securities or futures. The corresponding sentence could range from detention to imprisonment of no more than ten years plus a fine.
  • The crime of financial solicitation – the defendant solicits funds from the public in violation of the financial laws and regulation. The corresponding sentence could range from detention to imprisonment of more than ten years plus a fine. The constituent elements of this crime are as follows.
    1. the defendant fails to obtain authorisation from relevant government authorities, or solicits funds in the name of legitimate business operation;
    2. the defendant publicly promotes or solicits through the internet, media, sales meetings, product catalogues or cell phone text messages;
    3. the defendant promises to repay or reward the principal and interests in the form of money, material objects or equity within the stipulated time frame; and
    4. the defendant solicits funds from unidentified personnel of the public.

According to the PRC Criminal Law, there are several specific offences related to tax fraud – eg, tax evasion, fraudulent claim of export tax refund, and false issuance of special invoices for value-added tax, etc.

Among these tax-related crimes, the most pervasive crime is tax evasion. If a taxpayer files fraudulent tax returns or fails to file tax returns through deception or concealment from the tax authorities, resulting in an underpayment of more than 10% of the tax payables, it constitutes a crime of tax evasion. If the withholding agent fails to pay or underpays the withheld taxes, it may also constitute a crime of tax evasion.

There is no mandatory obligation to prevent tax evasion for an ordinary employee merely because the employee is aware of the fact of tax evasion. Neither is it a criminal offence for an ordinary employee to fail to prevent tax evasion. However, the personnel in charge of the company (eg, the legal representative) and the personnel directly responsible for approving, filing or preparing tax returns (eg, CFO or finance manager) should bear the obligation to prevent tax evasion, because tax evasion could be a unit crime, where both the company and the responsible personnel could be held criminally liable. If the responsible personnel fails to prevent tax evasion and the company continues to engage in tax evasion activities, the personnel responsible will be held criminally liable together with the company.

According to the PRC Criminal Law, there are two criminal offences related to record-keeping:

  • the crime of concealing or intentional destruction of accounting vouchers, accounting books and financial statements; and
  • the crime of disclosure or non-disclosure of material information in violation of relevant laws and regulations. 

For the crime of concealing or intentional destruction of accounting vouchers, accounting books and financial statements, the competent authorities shall establish the defendant’s obligation to keep accurate financial records, but the defendant fails to meet such obligation. For the crime of disclosure or non-disclosure of material information in violation of relevant laws and regulations, the competent authority shall establish that (i) the defendant has the obligation to disclose such material information to the shareholders or the public, (ii) the defendant either discloses fraudulent financial statements that conceal material information or fails to disclose material information in accordance with legal requirements, and (iii) the defendant has caused material damage to the interests of the shareholders or other personnel.

For the crime of concealing or intentional destruction of accounting vouchers, accounting books and financial statements, the corresponding sentence ranges from detention to imprisonment of no more than five years plus a fine. For the crime of disclosure or non-disclosure of material information in violation of relevant laws and regulations, the corresponding sentence could range from detention to imprisonment of no more than ten years plus a fine.

According to the PRC Criminal Law, the criminal offence related to cartels is conspiracy for the bidding, where the defendant conspires on the bidding price that could be detrimental to the interests of the tenderers or other bidders. The corresponding sentence could range from detention to imprisonment of no more than three years plus a fine.

Furthermore, according to the PRC Anti-Monopoly Law, competitors are prohibited from entering into horizontal monopoly agreements for price fixing or changing prices of commodities. The corresponding administrative liabilities include: (i) termination of the monopoly agreement, (ii) forfeiture, and (iii) a fine imposed in the amount of 1%–10% of the previous year’s sales revenue, or CNY5 million if there is no sales revenue in the previous year. If a monopoly agreement has been signed but has not been implemented, the competent authority could impose a fine of no more than CNY3 million. The legal representative, the principal responsible personnel and a fine of no more than CNY1 million could be imposed on the personnel directly responsible for the monopoly agreement.

According to the PRC Criminal Law, it is a criminal offence to manufacture or sell products that are mixed with impure ingredients, fake products, defective products or disqualified products. The corresponding sentence could range from detention to lifetime imprisonment plus a fine or forfeiture.

According to the PRC Consumer Rights Protection Law, if a business operator commits fraud in providing commodities or services, consumers could demand compensation of three times the price of the services or commodities. In addition to civil liability, the competent authority could (i) order the business operator to rectify, (ii) issue warnings, (iii) order a forfeiture, (iv) impose a fine of one to ten times the illicit gain, (v) impose a fine of no more than CNY500,000 if there is no illicit gain, and (vi) order to suspend the business for rectification or revoke the business licence.

According to the PRC Criminal Law, criminal offences related to cybercrimes and computer fraud and their respective constituent elements are as follows:

  • illegal intrusion into computing system – the defendant intrudes into the computer system of government affairs, national security construction, and cutting-edge scientific technology. The corresponding sentence could range from detention to imprisonment of no more than three years;
  • illegal acquisition of data from the computer system or illegal control of the computer system – the defendant intrudes into computer systems that are not related to government affairs, national security construction, or cutting-edge scientific technology; obtains data stored, processed or transmitted from the computer system through technical means; or exerts illegitimate control of the computer system. The corresponding sentence could range from detention to imprisonment of no more than seven years plus a fine; and
  • providing programs and tools for intrusion into, or illegal control of, computer systems – the defendant provides specialised programs and tools to intrude into or illegally control the computer system; or provides other personnel with programs and tools knowing that other personnel will intrude into, or illegally control, the computer system. The corresponding sentence could range from detention to imprisonment of no more than seven years plus a fine.

According to the White Paper on Crimes Committed by Employees of Financial Institutions in China of Year 2022, the five main types of financial crimes are: (i) illegal absorption of public deposits, (ii) fraud, (iii) illegal issuance of loans, (iv) embezzlement, and (v) misappropriation of corporate funds.

There are two main categories of criminal offences related to trade or customs sanctions: (i) illegal business operation and (ii) indirect smuggling.

According to the PRC Criminal Law, the defendant who engages in any of the following acts commits the crime of illegal business operation: (i) selling special products that are prohibited or restricted to be sold without an appropriate permit; (ii) selling import and export licences, certificates of origin, business licenses or other approvals as required by relevant laws and regulation; (iii) engaging in the business of securities, futures, and insurance without approval from the competent governing authority, or engaging in illegal cash settlement business; or (iv) any other form of illegal business that disturbs the market economic order.

According to the PRC Criminal Law, the defendant commits the crime of indirect smuggling under any of the following circumstances: (i) directly purchases from the smuggler products prohibited to be imported or other smuggled goods or products in relatively large quantities; or (ii) transports, purchases or sells products prohibited to be imported or exported at continental sea, territorial waters, boundary rivers or boundary lakes; or transports, purchases or sells goods and products that are restricted to be imported and exported in relatively large quantities, without legitimate licence.

According to the PRC Criminal Law, it is a criminal offence if the defendant has knowledge of the illicit gain and the relevant proceeds and knowingly conceals, transfers, acquires, sells or disguises, or conceals such illicit gains and proceeds in any other forms. To establish the criminal offence of concealment, the competent authority must identify (i) the defendant has the knowledge, (ii) the gains and proceeds are illicit, and (iii) the defendant carries out acts of concealing, transferring, acquiring, selling or disguising. The predicate offence of concealment includes but is not limited to corruption and bribery-related crimes, tax evasion, money laundering, financial frauds, terrorist activities, etc. Generally speaking, a person could not be held liable for both the predicate offence and concealment, because the lesser offence (ie, the crime of concealment) is merged into the more serious offence (eg, the crime of bribery, tax evasion, money laundering, etc).

A defendant who conspires with or aids and abets others to commit a corporate offence could also be held liable. 

For conspiracy, each conspirator shall be charged with the crimes they conspired to commit. For aiding and abetting, the accomplice’s sentence could be mitigated or reduced or they could be exempted from criminal liability. 

According to the PRC Criminal Law, it is a criminal offence to conduct money laundering. The constituent elements of money laundering include concealing and disguising illicit gain and the relevant proceeds of crimes through the following means: (i) offering bank accounts; (ii) converting the property to cash, financial instruments or securities; (iii) transferring funds via wire transfer or other payment settlement methods; (iv) transferring assets across borders; or (v) any other means. The predicate offences of money laundering include drug crimes, crimes related to underworld organisations, terrorist activities, smuggling, corruption and bribery, destruction of financial management order, and financial fraud. The corresponding sentence could range from detention to imprisonment of no more than ten years plus a fine.

According to the PRC Anti-Money Laundering Law, financial institutions within the territory of the PRC and certain non-financial institutions shall have the obligation to take measures to prevent and monitor money-laundering, including (i) Know-Your-Client policy, (ii) record keeping of client identity and transaction, and (iii) large transaction and suspicious transaction reporting. If the financial institution fails to fulfil the anti-money laundering obligations set out in points (i) to (iii) above, and if the financial institution (iv) transacts with clients of unknown identity, opens anonymous accounts or fake accounts for clients, (v) leaks information in violation of confidentiality requirements, (vi) refuses or obstructs anti-money laundering inspection and investigation; and (vii) refuses to provide investigation materials or intentionally provides fake materials, which leads to the occurrence of money laundering transactions, the financial institution shall be subject to an administrative penalty ranging from CNY500,000 to CNY5 million. The director, the senior management and other direct responsible person could be fined in an amount ranging from CNY50,000 to CNY500,000. The competent authority could also recommend (i) revoking the qualification or banning relevant personnel; (ii) ordering the financial institution to cease business operation and take remedial actions, and (iii) revoking the licence of the financial institution.

The competent enforcement authorities mainly include, but are not limited to, the People’s Bank of China, the Public Security Bureau, the National Oversight Commission, the Supreme People’s Court, the Supreme People’s Procuratorate, and the National Administration of Finance Supervision, etc.

Depending on the circumstances, the main common defences for white-collar offences include (i) lack of legal duty, (ii) lack of capacity as a public official; (iii) error or ignorance of facts when the law specifically requires knowledge; (iv) lack of malice and intent; or (v) acting under duress or coercion, which is a mitigating factor; and (vi) the criminal offence is a trivial or harmless error.

As discussed in 2.4 Internal Investigations, according to the Measures for Establishing, Evaluating and Examining Compliance Program of Enterprises (Trial), whether a company has adopted a robust compliance programme and effective and comprehensive internal investigations are critical weighting factors when assessing the effectiveness of the compliance programme. Depending on the effectiveness of the compliance programme, the procuratorate has the discretion to make a decision not to arrest or prosecute, change the mandatory measures, or propose leniency. 

The non-prosecution decision based on the compliance programme could be applicable for most of the unit crimes, where both the entity and the relevant personnel are subject to criminal liability. The unit crimes could include all the relevant crimes listed in 3.1 Criminal Company Law and Corporate Fraud, including but not limited to the crimes of bribery and corruption, tax-related crimes, money laundering, cyber security and computer-related crimes, and financial fraud, etc.

There are exceptions or de minimis exceptions for white-collar offences in China. If the amount of the bribe is below the threshold for filing a criminal case, the defendant could be exempted from criminal liabilities. For example, the thresholds for corruption and bribery related crimes are as follows:

  • accepting bribes by public official(s) – usually CNY30,000, and CNY10,000 under specific circumstances;
  • accepting bribes by an entity – CNY100,000;
  • offering bribes to public official(s) – usually CNY30,000, and CNY10,000 under specific circumstances;
  • offering bribes to an entity – CNY100,000 for individual bribe offerors, and CNY200,000 for entity bribe offerors;
  • bribery peddling – CNY20,000 for bribery peddling for individuals, and CNY200,000 for bribery peddling for an entity;
  • offering bribes by an entity – CNY200,000;
  • accepting bribes by a non-public official – usually CNY60,000 and CNY20,000 under specific circumstances prior to May 2022; CNY30,000 after May 2022;
  • offering bribes to a non-public official – CNY60,000, and CNY20,000 under specific circumstances prior to May 2022; CNY30,000 for bribe by an individual bribe offeror, and CNY200,000 for a bribe by an entity bribe offeror after May 2022;
  • offering bribes to a foreign public official or officials of an international organisation – CNY30,000 for individual bribe offerors, and CNY200,000 for entity bribe offerors.

However, since the law is ever evolving, the above de minimis thresholds are subject to revisions from time to time. 

There are no exempt industries or sectors. The PRC Criminal Law is applied equally to all industries and sectors in China. In fact, large state-owned enterprises with dominant market positions have been highly regulated and closely monitored for anti-corruption purposes in recent years. There have been vigorous enforcement actions towards state-owned enterprises in critical industries such as finance, energy and real property, etc.

Under the Chinese criminal law system, there are (i) plea bargain mechanisms and (ii) the “criminal settlement agreement” mechanism, which is a mechanism similar to a deferred prosecution agreement or non-prosecution agreement. Self-disclosure and co-operating with investigators or prosecuting authorities are mitigating factors when criminal liability is assessed. In practice, lawyers often procure the defendant and the victim to reach a criminal settlement agreement, so that the defendant could plead guilty in exchange for a reduced conviction. This is a win-win situation, where the victim receives the compensation for the loss, and the defendant obtains a reduced conviction. Generally speaking, the timing for self-disclosure is before the judicial authority finds the defendant, or before detention or interrogation, if the defendant is located.

According to the Sentencing Guidance for Commonly Seen Crimes (Trial), if a defendant voluntarily self-discloses and co-operates with the investigators or prosecutors, the criminal liability could be reduced by no more than 40% of the base sentence, taking into full consideration the motive, timing, method, severity of the offence, the extent of the self-disclosure and the extent of the confession.

As discussed in 2.4 Internal Investigations, a robust compliance programme could also be an alleviating factor for leniency. According to the Measures for Establishing, Evaluating and Examining Compliance Program of Enterprises (Trial), whether a company employs a robust compliance programme is a heavily weighted factor when the effectiveness of the compliance programme is assessed. Depending on the effectiveness of the compliance programme, the procuratorate has the discretion to make a decision not to arrest or prosecute, change the mandatory measures, or propose leniency.

Chinese government authorities encourage and provide protection to whistle-blowers as a channel to supervise and monitor the conduct of government officials and state-owned enterprises. Most of the government authorities in China have set up hotlines and multiple channels and issued rules and policies to encourage, protect and reward whistle-blowers, including but not limited to, the Supreme People’s Procuratorate, the Supreme People’s Court, the Ministry of Public Security, the Ministry of Finance, the Ministry of National Security, the Administration of Market Supervision, the Administration of Taxation, the State Administration of Foreign Exchange, the National Oversight Commission, the Ministry of industry and Information Technology, the Ministry of Human Resource and Social Security.

For example, according to the Several Provisions of the Supreme People’s Procuratorate, the Ministry of Public Security and the Ministry of Finance on Protecting and Rewarding Whistle-blowers of Crimes of Public Officials, the procuratorate will reward the whistle-blowers of crimes committed by public officials in the amount of no more than CNY500,000, or more than CNY500,000 upon approval by the Supreme People’s Procuratorate. The procuratorate and the public security bureau shall protect the whistle-blowers and their relatives against any retaliation.

According to the Interim Provision for Rewarding Whistle-blowers of Severe Violations of Market Regulations, the competent administrative authorities will reward the whistle-blowers of violations against market regulation in the amount of no more than CNY1 million. The Administration of Market Regulation protects the whistle-blower’s legitimate interests and keeps strict confidentiality of the identity of the whistle-blower.

According to the general principle of the PRC Criminal Law, a criminal suspect is not guilty until proven. Therefore, the investigative authority shall bear the burden of proof during the investigation. The investigative authority shall collect all evidence relevant to the criminal case, including both evidence that could prove the defendant guilty or innocent, and evidence that could prove the severity of the criminal offence. 

According to the PRC Criminal Procedure Law, the standard of proof is beyond reasonable doubt. However, the oversight commission applies a slightly different standard for burden of proof. According to the PRC Oversight Law, the standard for burden of proof for a criminal offence is beyond reasonable doubt; while the standard for burden of proof for misconduct by public officials is clear and convincing.

No one shall be presumed guilty until proven. The investigative authority shall collect all relevant evidence, including evidence to prove the guilt or innocence of the defendant. The judicial authority shall remain neutral and unbiased, assess the evidence submitted by both the investigative authority and the defendant, and adjudicate the case independently based on laws and established facts supported by evidence.

When a defendant is deemed guilty of a white-collar offence by a criminal court, the court will follow the PRC Criminal Law and the judicial interpretations and refer to the rules and guidelines on penalty assessment, including but not limited to:

  • the Opinions on Several Issues Concerning the Regulation of Sentencing Procedures;
  • the Guiding Opinions on Sentencing Recommendations for the Handling of Cases Involving Pleading Guilty and Accepting Punishment by People’s Procuratorates; and
  • the Guiding Opinions on Sentencing for Common Crimes (Trial).

The criminal court has the discretion to decide on sentencing. However, in practice, it will usually adopt the sentencing recommendation by the procuratorate. The sentencing process shall be discussed and jointly decided by the criminal collegiate panel. The judgment shall be based on the majority opinion of the criminal collegiate panel. The dissenting opinion shall be recorded and archived.

According to the Sentencing Guidance for Commonly Seen Crimes (Trial), the rules for sentencing under plea agreement are as follows:

  • if the defendant reaches a criminal settlement agreement or a plea agreement, the criminal liability could be reduced by no more than 50% of the base sentence, taking into full consideration the nature of the crime, the compensation amount, the candidness and sincerity of the remorse and apology; and in case of minor offences, the criminal liability could be reduced by more than 50% or completely exempted; and
  • if the defendant pleads guilty and accepts the punishment, the criminal liability could be reduced by no more than 30% of the base sentence, taking into full consideration the nature of the crime, the severity of the sentence, the timing, extent, value and degree of the defendant’s remorse. If the defendant conducts self-disclosure, confesses material facts, voluntarily returns the illicit gains, or reaches a settlement with the victim and compensates the victim for losses, the criminal liability could be reduced by no more than 60% of the base sentence. Furthermore, in case of minor offences, the criminal liability could be reduced by more than 60% of the base sentence or completely exempted.

In sum, there has been continuous improvement in China’s criminal law and criminal procedure law system to achieve the goal of protection of human rights as well as implementation of appropriate criminal policies that are commensurate with criminal offences. First, the PRC criminal laws tend to be more lenient, where applicable. Strict restriction is imposed for application of the death penalty. In 2007, the Supreme People’s Court resumed the authority to review death penalty cases, which launched the reform of restricting and reducing crimes that are charged with the death penalty. In the Ninth Amendment of the PRC Criminal Law in 2015, the threshold of the death penalty was further raised during the probation period, to limit its application. The criminal laws tend to be more stringent in response to people’s demands for highly regulated sectors. For example, the Eleventh Amendment of the Criminal Law added new terms and incorporated aggravated factors in constituent elements of certain criminal offences to strengthen the protection of people’s legitimate interests. The pilot programme of plea bargain in exchange for a reduced conviction has been formally established, which is a grand milestone demonstrating judicial tolerance and protection of human rights. Since 2019, the Supreme People’s Court, the Supreme People’s Procuratorate, the Ministry of Public Security, the Ministry of National Security, and the Ministry of Justice have been issuing opinions, guidance, and interpretations to test and guide pioneering plea bargain cases. During the pilot programme, the procuratorate has adopted the principle of prudence in making arrest and prosecution decisions. Instead, the defendants are counselled to plead guilty and confess in exchange for a reduced conviction. The pilot programme has successfully reduced frivolous litigation, improved and simplified the efficiency of criminal litigation, and converted the litigation from a “controversial pattern” to “co-operative pattern”, which has helped the defendants to avoid going through burdensome criminal procedures and paying costly litigation fees. The pilot programme reflects the advanced concepts of a harmonised society, protects human rights, and has achieved litigation civilisation.

Topcom China Law Offices

Unit 4703 Tower I Plaza 66
1266 West Nanjing Road
Jing’an District Shanghai
200040
People’s Republic of China

+86 136 0165 7800

jamesjiang@topcomlaw.com
Author Business Card

Trends and Developments


Authors



FTI Consulting Inc. is a global business advisory firm dedicated to helping organisations manage change, mitigate risk and resolve disputes: financial, legal, operational, political and regulatory, reputational and transactional. With more than 7,800 employees located in 31 countries, FTI Consulting professionals work closely with clients to anticipate, illuminate and overcome complex business challenges and make the most of opportunities. The company generated USD3.03 billion in revenues during fiscal year 2022. In certain jurisdictions, FTI Consulting’s services are provided through distinct legal entities that are separately capitalised and independently managed. For more information, visit www.fticonsulting.com and connect with us on Twitter (@FTIConsulting), WeChat, Facebook and LinkedIn.

Introduction

In China, similar to other jurisdictions, companies and their advisers face a number of challenges when dealing with white-collar crime. These can range from a regulatory environment that changes often, a language barrier when seeking to uncover evidence, investigations complexities and the legal costs of pursuing action against alleged perpetrators.

To effectively navigate these challenges, it is crucial for organisations to stay well-informed about trends and emerging challenges. This not only enables them to be better prepared for potential incidents, but also acts as a deterrent against any attempts to harm their interests. 

There are three key areas – forensic technology, emerging data and cybersecurity – that are currently impacting white-collar crime prevention and investigation. Companies should prioritise staying updated with risks, threats, and opportunities related to these areas, to enhance systems and procedures to mitigate potential risks and seize potential benefits.

Forensic Technology Trends

One area where forensic technology trends are impacting white-collar crime is in the realm of data breach investigations, a field where there has been increasing interest by companies based in China.

A data breach “exposes confidential, sensitive, or protected information to an unauthorised person” (see “How data breaches happen”) and can take the form of, for example, the theft of equipment or devices such as laptop computers or phones, hacking or phishing.

An important reason why companies are carrying out data breach probes is to establish whether bad actors have stolen personally identifiable information (PII) – “any representation of information that permits the identity of an individual to whom the information applies to be reasonably inferred by either direct or indirect means.” (See “Guidance on the Protection of Personal Identifiable Information”.)

China and Information Protection

The Personal Information Protection Law (PIPL), one of the three legal pillars of China’s data protection regime along with the Cybersecurity Law and Data Security Law, took effect in November 2021, and focuses on the privacy and protection of personal information.

As companies in China may have limited experience of data breaches, it is important to seek guidance from experts on how to reduce the threat of a breach occurring and how to respond to these incidents when they do arise. 

The authorities have shown that they are willing to step into a number of different industries and enforce the law against any company that fails to implement a robust data privacy regime. 

Finding Out

Compliance monitoring programmes are another important tool designed to ensure that a company or organisation adheres to all relevant laws, regulations, and internal policies and controls. Compliance monitoring programmes should typically include guidelines and procedures to ensure adherence with laws, regulations and industry standards, identification and assessment of the compliance risks facing the organisation and the design of internal controls to mitigate such risks. In addition, compliance monitoring programmes should include the provision and frequency of compliance monitoring and reporting.

With increasing regulation over the active monitoring of employee communications and actions to prevent fraud and abuse, there is more focus on compliance monitoring across communication and collaboration tools. In the case of China, employees’ use of platforms such as WeChat and DingTalk is a prime example of something that may require additional monitoring.

As the lines are increasingly blurred between business and personal communications, people who use these real-time messaging tools, such as WeChat and Dingtalk, risk revealing sensitive information or running afoul of regulatory requirements. These platforms are now ubiquitous in China. For example, WeChat has more than 1.2 billion users and DingTalk more than 500 million, as well as more than 19 million institutional users.

Compliance monitoring and conducting investigations into the content of these platforms is not straightforward. Various issues may arise regarding the collection, extraction and review of messaging data and information from cloud-based systems. For instance, few domestic software platforms in China can support DingTalk collection. Additionally, there are complexities involved in data extraction and analysis, as well as the need for compatible workflow tools required to store and review.   

Emerging Data Risks

The increased use of collaborative technology has also led to a significant surge in the volume of emerging data sources, and subsequently the volume of information that must be monitored and/or collected, analysed and reviewed during an investigation. Some figures show that more than 30% of data collected could be classified as from emerging data sources. This pertains to newly available data or data that is becoming more and more important in a particular field, particularly data exchanged using modern communications tools, collaboration platforms, personal devices and chat applications.

The sources of these data are expanding all the time. An emerging data source is defined as “any cloud-based platform or collaboration application used for business purposes”, such as Microsoft 365, Google Workspace and chat tools such as Slack and WhatsApp. The number of data formats now in play in e-discovery has increased tenfold compared to five years ago. (See White Paper: The State of Emerging Data 2023: An Overlapping Arrival and Departure.)

Securities regulators in the US, for example, have made clear that if emerging data systems contain relevant business communications, documents or other records, the onus is on organisations to make sure they govern, monitor, collect, review and produce them just as they would have to do for such material from traditional sources.

E-discovery Caution

The increasing volume of data being generated in new platforms in China adds complexity to digital forensic investigations and e-discovery processes. This is particularly challenging when these cases arise due to regulatory or legal actions in the US, as there may be incompatibility issues between the data sources and the tools needed to conduct discovery. In such situations, the utilisation of tools capable of local language review becomes even more critical, as it enables investigators to navigate any potential incompatibility issues between data sources and necessary discovery tools. Consequently, organisations often find themselves developing customised solutions to fulfil information requests and ensure seamless and effective e-discovery procedures.   

Cybersecurity Risk Trends

The increase in digitalisation and automation, accompanied by the constant emergence of new data sources, is contributing to the growth in cybersecurity vulnerabilities. As data rapidly flows between individuals, companies, suppliers and various other parties, organisations may overlook gaps in their information or security measures until it is too late to prevent a breach from happening.

The move to hybrid and remote work has led to companies increasingly relying on once-temporary cybersecurity solutions. Combining this with a rise in the use of personal devices for work has also permitted staff to introduce significant cybersecurity risks, through the creation of additional access points for threat actors to exploit.

While new data services and storage methods such as the cloud can provide benefits, they also introduce substantial vulnerabilities. Despite potential cost savings and improved productivity for business, insufficient security protocols implemented by cloud service providers can significantly compromise the safety of sensitive information and data.

Ransomware – malware that threatens to publish or block access to data or a computer system, usually by encrypting it, until the victim pays a ransom fee to the attacker – has rapidly emerged as the most visible cybersecurity risk playing out across China’s networks, impacting private sector organisations, critical infrastructure and government agencies.  

The latest ransomware trends include targeted and sophisticated attacks and more complex cyber extortion techniques, leading to a potential record high in ransomware payments this year.

Recent ransomware attacks have shifted from encrypting data to stealing data, in hope of streamlining the ransom payment process. Threat actors vow to release sensitive information if they are not paid. In fact, many specialists maintain that ransomware and data theft should be considered as separate offences

Global Cybersecurity

Overseas companies have to consider beyond local cybersecurity rules in China. For example, the US Securities and Exchange Commission (SEC) has adopted new rules that require companies, including foreign private issuers, to “disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance”.

Companies must disclose any cybersecurity incident deemed to be material, as well as its “nature, scope and timing”, within four days of its occurrence. Further, on an annual basis, companies must inform the SEC about what procedures are in place to ensure its board of directors is overseeing risk from cybersecurity threats, and what management’s “role and expertise” is in assessing and managing material risks from cybersecurity threats.

The location where the incident took place is irrelevant if the company is listed in the US. This means global companies will need to develop comprehensive cybersecurity programmes that have oversight across the entire enterprise and are not siloed by country.

This is a major step-up from the previous version of the rules, which date from 2018. The previous rules only required a company to reveal material cybersecurity incidents. Now, in addition to the required governance disclosures, the bar is “a reasonably likely” material impact, greatly extending the potential number of incidents that may have to be revealed.

Data Protection Strength

Alongside the PIPL, the Cybersecurity Law, dated 1 June 2017, which established a regulatory regime for cybersecurity and data protection in China, and the Data Security Law (DSL), of 1 September 2021, which applies to data processing activities within China and without China that could harm its national security and public interests; form the legal basis of China’s data protection regime.

The PIPL has extraterritorial effect in that it applies to any offshore entity that processes the personal data of individuals, not just Chinese citizens, located in China. If they do provide services or products or “analyse or assess their behaviour”, PIPL applies.

To manage its compliance with PIPL, an entity must establish a special agency or designate a representative within China and give the contact information of the designated agency or the representative to the government.

Hong Kong’s View

As a comparison, Hong Kong’s Office of the Privacy Commissioner for Personal Data (PCPD) issued new Guidance on Breach Handling and Data Breach Notifications in June 2023. The guidance outlines the common causes of data breaches in Hong Kong; what should be included in a data breach response plan, such as risk assessment workflow, communication plan and staff training; who must be notified of the breach, including affected individuals and the authorities; how to minimise damage; and how to prevent a recurrence. 

While this document is guidance and is not required, in the case of an incident, the PCPD can use it to determine if the impacted organisation followed a compliance plan. 

Deterring and detecting white collar crime requires constant vigilance irrespective of where an individual, company or organisation is based. The battle to maintain robust personal and corporate cybersecurity is a continuous challenge. China is no exception, but it has a strong legal basis to its data protection regime, as well as other standards and regulations that give it sound foundations for defending against potential breaches, and penalising wrongdoers. 

The views expressed herein are those of the author(s) and not necessarily the views of FTI Consulting, Inc., its management, its subsidiaries, its affiliates, or its other professionals.

FTI Consulting, Inc., including its subsidiaries and affiliates, is a consulting firm and is not a certified public accounting firm or a law firm.

FTI Consulting

Unit 2101-04, Central Plaza
227 Huangpi (N) Road
Shanghai 200003
China

+86 21 2315 1000

+86 21 6352 3616

www.fticonsulting.com/locations/china
Author Business Card

Law and Practice

Authors



Topcom China Law Offices is a professional and efficient legal service provider, which consists of a team of professionals with rich experience in legal practice. With a high sense of responsibility and professional dedication, the team commits itself to providing clients with the highest quality legal services. Practice areas mainly involve compliance and investigation, dispute resolution, intellectual property, data protection, investment and M&A. All of the firm’s lawyers are equipped with international perspectives in servicing many Fortune Global 500 companies as well as leading domestic and international enterprises, covering key industries including chip manufacturing, food and agricultural products, health care, automobiles and e-commerce. The team consists of a group of like-minded young and senior lawyers with enthusiasm for law. The firm has handled China’s first case of illegally providing trade secrets to overseas entities and the top ten most important legal cases of 2016 that pushed forward China’s legal system.

Trends and Developments

Authors



FTI Consulting Inc. is a global business advisory firm dedicated to helping organisations manage change, mitigate risk and resolve disputes: financial, legal, operational, political and regulatory, reputational and transactional. With more than 7,800 employees located in 31 countries, FTI Consulting professionals work closely with clients to anticipate, illuminate and overcome complex business challenges and make the most of opportunities. The company generated USD3.03 billion in revenues during fiscal year 2022. In certain jurisdictions, FTI Consulting’s services are provided through distinct legal entities that are separately capitalised and independently managed. For more information, visit www.fticonsulting.com and connect with us on Twitter (@FTIConsulting), WeChat, Facebook and LinkedIn.

Compare law and practice by selecting locations and topic(s)

{{searchBoxHeader}}

Select Topic(s)

loading ...
{{topic.title}}

Please select at least one chapter and one topic to use the compare functionality.