China gives details on new cybersecurity rules for offshore listings

Shanghai — China said on Tuesday it will put in force new rules to increase its oversight of plans by Chinese platform firms to list on overseas stock markets in the latest move to tighten its grip on its sprawling technology sector.

The Cyberspace Administration of China (CAC) said the new rules will come into effect on February 15 and require platform companies with data on more than 1-million users to undergo a security review before listing their shares overseas.

“With stock market listings there is a risk that key information infrastructure, core data, important data or a large amount of personal information could be affected, controlled or maliciously used by foreign governments,” said the CAC in a statement, reiterating a concern flagged in July when the changes were first proposed. 

In a separate statement, the CAC said it will also implement new rules on March 1 on the use of algorithm recommendation technology to increase oversight of news providers that use the technology to disseminate information. The rules will give users the right to switch off the service if they choose.

Both sets of rules were proposed last year and are expected to potentially affect a large swathe of companies, such as TikTok owner ByteDance, e-commerce giant Alibaba Group and many more smaller players.

ByteDance and Alibaba did not immediately respond to a request for a comment.

The CAC move comes amid a slew of regulatory changes in China over the past year that have dampened the appetite of firms to list overseas. But bankers hope the new rules will provide more clarity in 2022.

The CAC did not specify whether the rules will apply to companies seeking listings in Hong Kong.

But lawyers and bankers said that based on the wording of the rules, it appears that Chinese companies with more than 1-million users seeking to list in the city would not be required to seek the cybersecurity review.

“Hong Kong is being treated as part of China, offshore though not foreign market, and this paves the way for more deals to return to Hong Kong,” one investment banker at a Western institution told Reuters, asking not be named as he was not permitted to speak to the media.

In Hong Kong, the Hang Seng index closed up 0.06% after trading in negative territory for most of the session but the city’s tech index lost 1.04%.

Shares in Hong Kong Exchanges and Clearing, the operator of the Hong Kong stock exchange, closed down 1.1% after falling as much as 2.4% after the announcement.

“If this is not retrospective then it would only affect listing aspirants and not companies already listed. Having said that, companies in the latter camp already have a lot on their minds,” said Justin Tang, head of Asian research at investment adviser United First Partners in Singapore.

The rules published on Tuesday did not specify whether the planned changes will be retrospective.

Alex Roberts, who tracks data policy at law firm Linklaters in Shanghai, said the new rules appeared to have shrunk the scope of the companies likely to be affected by the changes compared with the proposal made in July.

“The most significant change in these cybersecurity review measures seems to be the narrowing of the review’s application to only critical information providers, data processors that may impact national security or platform operators holding over 1-million individuals’ personal data,” said Roberts.

Based on the rules, however, it is still not clear which types of companies will be affected, he added. “This ambiguity will be a real concern for successful multichannel businesses in China’s digital economy given the current uncertainty of the review process.”

The CAC changes come after a slew of recent moves by Chinese authorities to boost oversight of Chinese companies’ offshore listings.

China’s state planner said last week it would demand regulatory clearance for overseas Chinese listings in sensitive sectors such as internet news and publishing.

Separately, the China Securities Regulatory Commission said on December 24 it will require companies that wish to list overseas to submit filings to the agency first for registration, under a system that also involves close co-ordination among regulatory bodies.

Reuters