On 24 November 2023 the 19th executive meeting of the State Council approved the Regulations on the Supervision and Administration of Non-Bank Payment Institutions. On 9 December Premier Li Qiang signed the State Council decree promulgating the regulations, which take effect on 1 May 2024.
For most companies this is not a law requiring a licence application. It will nonetheless change how they select payment channels, structure settlement and handle user information. Payment is no longer merely a technical interface but a regulated system with market access, customer reserves and information-processing rules.
Payment business licensing
The regulations require a non-bank payment institution to be approved by the People’s Bank of China and obtain a payment business licence. Without approval, no entity may engage in, or disguise, payment business, nor use “payment” in its name or business scope.
“Disguised payment business” is the practical question. Companies handling funds through aggregated payment, collection and payment on behalf, or platform splitting may fall within the regulatory perimeter if they in substance perform payment and settlement functions. The test is not the contract label but fund flow, settlement entity and risk bearing.
Centralised custody of reserves
The regulations require payment institutions to hold customer reserves with the People’s Bank of China or qualifying commercial banks, and prohibit misappropriation. Reserves belong to users, not to the institution.
For merchants and platforms, this means assessing a provider’s reserve management as part of selection. Low fees do not offset fund-safety risk. Agreements should specify settlement cycles, reserve custody, reconciliation and exception handling.
User-information rules
The regulations require payment institutions to process user information on lawful, legitimate and necessary grounds and to protect users’ right to know and to choose. Payment scenarios naturally involve identity, account, transaction and device data, which are sensitive.
Companies working with payment institutions must distinguish two roles: as a merchant, the company is the institution’s customer; as a platform, it may also be a personal-information processor. Notification, consent, sharing and security obligations differ, and a single privacy policy cannot cover both.
Risk management and AML
The regulations impose requirements on corporate governance, internal controls, risk management and anti-money-laundering. For merchants, the most direct effect is stricter onboarding and ongoing due diligence: business licence, ultimate controller, business scenario and transaction background must be explained.
Companies should expect longer onboarding, more granular document requests and more sensitive monitoring of unusual transactions. Cross-border businesses must also meet foreign-exchange and AML requirements.
Five points when choosing a payment channel
First, licence and scope: confirm the institution holds the relevant licence and that its scope covers the actual scenario.
Second, fund safety: understand reserve custody, settlement path and exception handling.
Third, information processing: identify what data the institution collects, for what purpose and whether it shares with third parties.
Fourth, contract terms: fees, settlement cycle, refunds and chargebacks, liability allocation, termination and migration.
Fifth, contingency: backup channels and customer notification if a channel is interrupted, limits change or compliance review occurs.
For payment licensing and market access, see our business licensing service; for payment cooperation agreements and platform rules, see commercial contracts; for user information, see data compliance.
This article is based on the Regulations on the Supervision and Administration of Non-Bank Payment Institutions approved by the State Council on 24 November 2023 and promulgated on 9 December 2023. It is for reference only and does not constitute legal advice.