Regulations
China Digital-Entry Regulations: Chronological Registry
Mainland China's digital-entry rules reach a product as a sequence of dated instruments — MIIT notices, CAC orders, a SAFE measure, WeChat platform gates — scattered across glossary entries, articles, and service pages. This page lines up every instrument cited on this site into one chronological registry, grouped by regulatory domain. Each row names the instrument, carries its date as banked on the citing page, summarizes what it does, and links to the page where the term is defined in full.
Four sections cover the domains: Filing & Licensing Regulations, Data & Privacy Regulations, Payments & Foreign Exchange Regulations, and Platform Gates. The grouping mirrors the glossary hub's pillar structure. If you need a term's definition rather than its timeline placement, start at the glossary. For the compliance path for a specific product, start at the diagnostic or the ICP compliance service page. The reading conventions — how dates, supersessions, and undated rows are handled — are listed under “How to read this timeline” below.
Filing & Licensing Regulations
The registrations, permits, and public-security obligations that attach to a mainland-hosted domain or app.
| Regulation | Date / Effective | Summary | Foreign-entrant impact | Deeper coverage |
|---|---|---|---|---|
| Internet Information Services Measures (State Council Decree 292) / Non-commercial Filing Measures (ICP filing regime legal basis) | Undated — regime basis (no date stated on-site) | Apps are a first-class filing object under the same regulations that govern websites — the Internet Information Services Measures (State Council Decree 292) and the Non-commercial Filing Measures. The regime requires mandatory registration with a typical 2–4 week window. Communications-administration (CA) review runs within 20 working days, with 12381 SMS verification at beian.miit.gov.cn. | Every mainland-hosted domain and app passes through this filing — it is the first compliance gate in any China launch. | App filing · Bei'an · MIIT · ICP compliance service |
| Telecom Business Classification Catalog (电信业务分类目录, 2015 edition) | Effective 2016-03-01 | The catalog organizes value-added services under the B2 class. B21 covers online data processing and transaction processing. It has been amended only once since 2015 (2019 A12-4 5G addition). | The B21 classification is the VATS / EDI license category for transaction-processing services — the assessment a marketplace or transaction platform runs alongside the ICP filing and ICP license. | VATS / EDI license |
| MIIT notice 工信部信管〔2023〕105号 (APP filing) | Notice dated 2023-07-21, published 2023-08-04 | This notice opened APP filing windows: preparation through August 2023; existing (存量) APP filings September 2023 through March 2024; supervisory inspection April through June 2024. The Anti-Telecom Fraud Law Art. 23 serves as co-basis. Section (九) bars access providers, distribution platforms, and terminal makers from serving unfiled apps. This is not a store-removal mandate with a dated sweep. | Any native mobile app resolving to mainland servers must hold a filing — distribution platforms and app stores face enforcement if they serve unfiled apps. | App filing · ICP compliance service · China Android app stores |
| MIIT notice 工信部通信函〔2024〕107号 (VATS pilot) | 2024-04-08 | On 2024-04-08, MIIT issued this notice removing the foreign-equity cap for listed categories including B21 transaction processing — but only in four pilot zones. Information-services exclusions apply. MIIT pilot approval (试点批复) is required. | Foreign companies in the four pilot zones can now hold majority equity in a B21 VATS entity — outside the pilot zones, the cap remains. | VATS / EDI license |
| PSB filing (公安备案) | Undated — standing rule (no single dated instrument on-site) | Public security filing formalities must be performed at the public security authority within 30 days of the website launching. The 30-day clock starts at website launch, not at ICP filing approval. An API-only exemption from the follow-on PSB network filing exists. | After ICP filing approval and go-live, the 30-day PSB clock starts — plan it as a separate post-go-live step, not as part of the ICP filing itself. | Azure China 21Vianet · ICP compliance service |
Data & Privacy Regulations
The cybersecurity, personal-information and cross-border data-transfer instruments that govern what a mainland operation can do with user data and when it must keep that data onshore.
| Regulation | Date / Effective | Summary | Foreign-entrant impact | Deeper coverage |
|---|---|---|---|---|
| Decision on Amending the Cybersecurity Law / Cybersecurity Law of the People's Republic of China (网络安全法) | Adopted 2016-11-07, effective 2017-06-01 (Art. 79); amendment adopted 2025-10-28, effective 2026-01-01 | Framework cybersecurity law: Art. 2 scopes the law to the construction, operation, maintenance, and use of networks within the mainland plus cybersecurity supervision; Art. 76 defines "network", "cybersecurity", and "network operator". The 2025 amendment decision republishes the law with adjusted article numbering and, per the Xinhua report, strengthens cybersecurity legal liability and improves coordination with related laws. | Obligations attach to network operators as defined in Art. 76(3) — the owner of a network, its manager, and network service providers — for networks built, operated, maintained, or used inside the mainland. The amendment adds an explicit cross-reference to the Civil Code and the PIPL for personal-information processing (renumbered Art. 42). Art. 2 contains no extraterritorial clause. | Cybersecurity Law (CSL) · Data Security Law (DSL) · PIPL |
| Data Security Law of the People's Republic of China (DSL) | Adopted 2021-06-10, effective 2021-09-01 (Presidential Order No. 84) | Framework law for all data processing: defines "data" and "data processing" (Art. 3) and establishes the categorized and classified grading system, including the catalog-based "important data" category and the stricter "core data" tier (Art. 21). The statute publishes no closed definition of "important data" — sectoral and regional catalogs supply it. | Grading obligations attach to data processing inside the mainland (Art. 2, with an extraterritorial clause for harmful offshore processing). Exporting "important data" triggers the CAC security assessment under Order No.16 Art. 7, and Art. 36 bars providing mainland-stored data to overseas judicial or law-enforcement bodies without approval. | Data Security Law (DSL) · Cross-border data transfer |
| Regulation on the Security Protection of Critical Information Infrastructure (关键信息基础设施安全保护条例, State Council Decree 745 / 国令第745号) | Adopted 2021-04-27, promulgated 2021-07-30, effective 2021-09-01 | Article 2 defines critical information infrastructure: important network facilities and information systems in eight named sectors — public communication and information services, energy, transportation, water conservancy, finance, public services, electronic government affairs, national defense science-and-technology industry — plus others meeting the harm test (serious endangerment of national security, the national economy and public livelihood, or the public interest). Articles 8–11 assign designation to sector protection work departments whose designation rules are filed with the State Council public-security department. | Designation is notified by regulators, never self-declared. CIIO status triggers PIPL Article 40 storage localization and the mandatory cross-border security assessment (Order No.16 Art.7) regardless of volume. | CIIO · Data residency · Cross-border data transfer |
| Personal Information Protection Law (个人信息保护法, PIPL) | Adopted 2021-08-20, effective 2021-11-01 per Article 74 | Article 3 establishes extraterritorial reach — the law can apply to offshore sites targeting mainland users. Articles 38–40 define the transfer mechanisms and localization requirements for personal information collected in mainland China. | Any foreign entity collecting personal information from mainland users — even from offshore — may fall under PIPL's reach and must plan for data residency or an Article 38 transfer mechanism. | PIPL · Data residency · PIPL compliance guide |
| CAC Order No.11 (数据出境安全评估办法) | Effective 2022-09-01 | This order establishes the security assessment procedure for cross-border data transfers, with procedure windows of 5/7/45/15 working days. The original 2-year validity under Art. 14 was superseded by Order No.16 Art. 9's 3-year validity. | Companies transferring personal information out of mainland China above the applicable thresholds must pass through this security assessment — plan for a multi-month procedure window. | Cross-border data transfer |
| CAC Order No.13 (个人信息出境标准合同办法) | Effective 2023-06-01 | This order establishes the standard contractual clause (SCC) mechanism for cross-border personal information transfers. The SCC must be effective before the transfer takes place, with a 10-working-day provincial filing requirement (Arts. 6–7). Anti-splitting rules prevent circumvention (Art. 4). | Companies below the security assessment threshold can use SCC filing as the transfer mechanism — but the contract must be in place before any data leaves mainland China. | Cross-border data transfer |
| CAC Order No.16 (促进和规范数据跨境流动规定) | Effective 2024-03-22 | Where Order No.16 is inconsistent with the earlier Orders No.11 and No.13, Order No.16 prevails (Art. 13). The threshold ladder: 10,000 sensitive or 1,000,000 non-sensitive for security assessment; 100,000–1,000,000 for SCC filing or certification; below 100,000 exempt. Validity extends to 3 years with a 60-working-day window (Art. 9). | The threshold ladder determines which mechanism applies — security assessment, SCC filing, or exemption — superseding the earlier threshold provisions of Orders No.11 and No.13 where inconsistent. | Cross-border data transfer |
Payments & Foreign Exchange Regulations
The foreign-exchange rules that govern how payment-rail funds move from a mainland merchant account to a foreign bank account.
| Regulation | Date / Effective | Summary | Foreign-entrant impact | Deeper coverage |
|---|---|---|---|---|
| SAFE Measures (汇发〔2019〕13号) | Issued 2019-04-29, effective from date of issue | SAFE issued these measures for payment institutions' foreign-exchange business on 2019-04-29, effective from date of issue. Article 15 sets a per-transaction limit not exceeding the equivalent of USD 50,000 with T+1 completion. | Cross-border settlement of WeChat Pay or Alipay funds into a foreign bank account operates within these FX rules — the USD 50,000 per-transaction cap shapes settlement batching. | Cross-border settlement |
Platform Gates
The WeChat-specific policy changes that control what a Mini Program or Official Account can publish, and when.
| Regulation | Date / Effective | Summary | Foreign-entrant impact | Deeper coverage |
|---|---|---|---|---|
| WeChat Mini Program filing gate (微信小程序备案) | 2023-09-04 (legacy version-review deadline 2024-03-31, WeChat-platform-scoped) | On 2023-09-04, WeChat opened the platform filing entry for Mini Programs. Publishing an unfiled Mini Program fails with error 86369. Legacy programs could submit version reviews unfiled only until 2024-03-31 — a WeChat-platform-scoped deadline, not an MIIT or store-removal date. | Any Mini Program targeting mainland users must hold a filing before publishing — the platform enforces this at the version-review stage, not at submission. | Mini Program ICP filing · WeChat Mini Program · WeChat ecosystem service |
| WeChat Official Account freepublish API clawback | Since July 2025 | Since July 2025, individual-subject accounts, unverified enterprise accounts, and accounts that cannot support verification have lost the freepublish API permission set. | Enterprise content strategies relying on the freepublish API must hold a verified account — unverified or individual accounts can no longer push content programmatically. | WeChat Official Account |
How to read this timeline
- Dates are stated as cited on this site. Each row's date column uses the formulation banked on the citing glossary or article page. Where the source registry gives a different precision (e.g. “dated” vs. “published”), the row uses the registry's formulation verbatim.
- Supersession notes survive. Where an instrument supersedes another, the row carries the supersession. Order No.11's original 2-year validity (Art. 14) never appears without the supersession to Order No.16 Art. 9's 3 years, and the Order No.16 row carries the Art. 13 prevails clause over Orders No.11 and No.13.
- Undated rows are marked. Where the site names a legal basis or standing rule but banks no promulgation date (Decree 292, PSB filing), the row states “Undated” rather than supply one.
- Platform-scoped dates stay platform-scoped. The 2024-03-31 deadline for legacy Mini Program version reviews is a WeChat-platform deadline — it is never rendered as an MIIT or store-removal date.
- Scope is closed. This page does not state dates, thresholds, or notice numbers for instruments the site has not banked. If a regulation you expect to see here is absent, the site has not yet cited it with a source-backed date.
Frequently asked questions
What triggers the ICP license versus the ICP filing?
The ICP filing (Bei'an) is the baseline registration for most websites hosted on mainland servers. The ICP license (ICP证) applies to commercial online services such as marketplaces, paid platforms, or certain regulated categories — the trigger is what your product does, not where it is hosted. A brochure site usually needs the filing only; your own catalog with checkout depends on the business model and should be classified early. The full comparison is in ICP filing vs ICP license.
Which cross-border data transfer tier applies to our operation?
Under CAC Order No.16 (effective 2024-03-22), the threshold ladder runs: 10,000 sensitive or 1,000,000 non-sensitive triggers the security assessment under Order No.11; 100,000–1,000,000 non-sensitive qualifies for SCC filing or certification; below 100,000 non-sensitive is exempt. Where Order No.16 is inconsistent with the earlier Orders No.11 and No.13, Order No.16 prevails.
What changed for Mini Programs on 2023-09-04?
On 2023-09-04, WeChat opened the platform filing entry for Mini Programs — filing has been required since that date. Publishing an unfiled Mini Program fails with error 86369. Legacy programs could submit version reviews unfiled only until 2024-03-31 — a WeChat-platform-scoped deadline, not an MIIT or store-removal date.
When does the PSB 30-day clock start?
The 30-day clock starts at website launch, not at ICP filing approval. The public security filing is a separate step that follows the ICP filing — plan it as a post-go-live obligation, not as part of the filing itself.
If we host outside mainland China, do we still need an ICP filing?
For a website, no. The ICP filing obligation follows mainland hosting, not audience location. The Bei'an glossary states the rule directly: “The obligation attaches to mainland hosting, not to where your visitors are.” Its misconception list is blunter still: “The obligation follows hosting, not audience. If your server is in mainland China, the filing applies.” Hosting offshore removes the website-filing trigger; it does not remove regulation. Three edges stay on: outside-mainland-only CDN acceleration (Hong Kong, Macau, Taiwan) requires a PSB filing instead of an ICP filing; any Mini Program targeting mainland users must hold the WeChat Mini Program filing before publishing — the platform enforces this at the version-review stage, not at submission; and PIPL Article 3's extraterritorial reach can still apply to an offshore site targeting mainland users.
What is the USD 50,000 per-transaction cap under the SAFE Measures?
Article 15 of the SAFE Measures (issued 2019-04-29, effective from date of issue) sets a per-transaction limit not exceeding the equivalent of USD 50,000 with T+1 completion. For cross-border settlement of WeChat Pay or Alipay funds into a foreign bank account, this cap shapes settlement batching — each individual settlement transaction must not exceed the USD 50,000 equivalent.
Next steps
Planning a mainland China launch? The regulations above are the compliance layer. The ICP filing & compliance service covers the sequence behind them: filing-versus-license classification, entity readiness, document preparation and submission, and post-filing maintenance.
Run the 10-point China readiness diagnostic first to see which of these regulations apply to your specific product. Then reach out at hello@chinagateway.pro with your product description — we will map the applicable instruments to your launch calendar.
Planning a mainland China launch?
The regulations above are the compliance layer — the ICP filing & compliance service covers the sequence behind them, and the 10-point China readiness diagnostic shows which apply to your product.
hello@chinagateway.pro