China: Extra compliance burden for regulated fintechs and other financial services providers

New CBIRC Consumer Protection Rules will kick in on 1 March 2023

Following an 18-month industry and public consultation process, the China Banking and Insurance Regulatory Commission (CBIRC) released its finalised Measures on Consumer Rights Protection for Banking and Insurance Institutions on 30 December 2022 (Measures). The Measures will take effect on 1 March 2023 and offer more protections to customers in an industry that digital innovation has allowed to rapidly diversify and therefore its traditional safeguards might need refreshing.

We have been closely following the drafting process of the Measures –  see our previous notes on the initial draft rules back in July 2021 and the updated consultation draft published in May 2022. Compared with the consultation drafts, the finalised version further lifts certain detailed operational requirements, and incorporates principle-based provisions on key issues including corporate governance, information disclosure, dispute resolution.

We summarise below some of the key changes and other highlights in the final Measures:

1. Removal of the special care for “ordinary consumers”

The final Measures remove the category of “ordinary consumers” (as distinct from professional investors) and the special care afforded to this category of consumers under the consultation draft. We guess that CBIRC possibly removed the category of “ordinary consumers” because it might be hard to apply a uniform criterion of “ordinary consumers” across all banking and insurance services covered by the Measures.

It is possible that CBIRC might specifically address the categorisation of consumers in future rules, such as the Measures on Consumer Suitability of Banking and Insurance Institutions that CBIRC announced would be formulated in its legislation plan of year 2022.

2. Further loosening of operational requirements

The second consultation draft of the Measures cut out a number of detailed dos and don’ts from the initial draft. In a move that may further please smaller fintechs which have less resources, in particular, the final Measures lift other detailed operational requirements, including in particular:

• numerical thresholds, such as the minimum ratio of 5% for consumer protection work as a proportion of an institution’s performance appraisal system;
• the three-business day timeline for reporting major consumer rights infringements to CBRIC;
• the cap on fees charged for financial products and services being set at two times the interest rate of the product / service; and
• the requirement to maintain full records of debt collection activities.

However, this does not necessarily mean that these detailed operational requirements are completely gone. It is open to CBIRC to address them in rules governing specific financial services, leaving the Measures to be observed as principle-based overarching rules for consumer protection work across all relevant services. Relevant CBIRC-regulated firms should watch for developments. 

3. Corporate governance and information disclosure

The Measures incorporate general stipulations for good corporate governance of consumer protection work, including relating to the duties of institutions’ directors, board of supervisors and senior executives, and the public disclosure of consumer protection work through annual reports or other channels.

These requirements generally reiterate the relevant rules under the CBIRC Guiding Opinions on Improving the Establishment of Consumer Protection Work Mechanisms for Banking and Insurance promulgated in November 2019. Many banking and insurance institutions have already built the relevant requirements into their constitutional documents and information disclosure work, so the Measures should not present a significant compliance burden for traditional players. However, to act prudently, firms should review existing practices and protocols to ensure compliance, and new market entrants aim to get these rights from Day 1.

4. Dispute resolution

On top of the high-level requirement in the second draft of the Measures for a diversified dispute resolution mechanism to be adopted by banking and insurance firms, the final version of the Measures further underlines the that active negotiation with consumers should be a priority before entering into mediation, arbitration or litigation.

The Measures also outline the role of banking and insurance dispute mediation organisations. According to a Q&A response of CBIRC in October 2022, 600 banking and insurance dispute mediation organisations have been established in mainland China. Most of these organisations have been admitted into the country’s court mediation platform under the mediation-litigation online connection program jointly established by CBIRC and the Supreme People’s Court.

The Chinese authorities emphasise on consumers taking advantage of improved dispute resolution channels with the launch of the new Civil Code a couple of years ago, and increasing ESG-driven pressures for firms to establish comprehensive complaint handling practices, means financial service providers will need to turn resources to this aspect of business in 2023.    

5. Customer information protection

Chapter 6 of the Measures remains dedicated to the protection of consumer information internally to firms and with internet platforms and other business partners. CBIRC only made limited changes to this chapter compared with the last draft, and some of these are only editorial.

One change worth noting is the final Measures include “good faith” as a principle to protect customer information. This change adds consistency with the Personal Information Protection Law, which listed legality, legitimacy, necessity, and good faith as principles for processing personal information.

In addition, the final version of the Measures clarify that consent to use customers’ personal information cannot be assumed in an online interface, whether through a pre-checked authorisation checkbox or otherwise. Existing national standards made it clear that obtaining consent requires an affirmative action by the personal information subject, so this change does not impose new obligations.

What to do next

The clock is ticking for the market players with just one month to implement the Measures. Institutions covered by the Measures will need to complete a self-assessment and adjust their internal controls for consumer protection work, from both the perspective of broader governance frameworks and more granular daily operational protocols, before 1 March.

Furthermore, as consumer protection continues to be one of CBIRC’s top priorities, more detailed rules relating to consumer protection are expected to be rolled out in the near future, regulating activities such as consumer suitability management and distribution of insurance products.

We will continue to monitor developments in the consumer protection space for the finance and insurance sectors and keep you updated. Please contact us with specific questions or issues.