China Cloud Computing Laws
China Cloud Computing Laws

Internet software business is rapidly moving to the cloud. So far, however, the Chinese government seems to be taking the lead from the Rolling Stones: the message is “Hey! You! Get off of my cloud.” The PRC wants to run its own private cloud, and no foreigners need apply.

The primary issue for Internet business in China is that all commercial Internet businesses require the website owner acquire a commercial ICP (Internet Content Provider) license. This means that in addition to traditional e-commerce websites, cloud computing, software as a service (SaaS) and software as a platform (SaaP) sites all require a commercial ICP license.

This ICP licensing requirement makes it very difficult for foreign software developers to get into the PRC cloud computing market. Foreign entities fully controlled by Chinese individuals have found a way around this restriction by using VIE structures. But for foreign controlled software developers, the door has been and remains closed.

One solution to this barrier is too license the software to a Chinese company formed specifically to obtain the ICP license required to host the cloud based software. What we have found, however, is that it is very difficult for small to medium software developers to find an entity in China willing to act as such a host. The primary reason is that obtaining an ICP license is costly and time consuming. Often, we find that Chinese companies will casually agree to act as a host. However, when they learn what is actually involved, these entities often back out of the deal.

If you are a such a SME software developer, it is therefore important to be sure that your potential licensee for China fully understands what it is agreeing to do before you waste time on negotiations that will go nowhere. In this post I will explain the basic issues. If you have these issues firmly in mind as you work on developing your China program, you will save much wasted time. Given that time is critical in this business, this is a critical issue.

I. Legal background.

Every entity in China that operates a commercial website within China is required to obtain a commercial ICP license 互联网信息服务增值电信业务许可证. The rules for obtaining a China ICP license are based on two regulations: 1) Information Technology Regulations电信条例 (Technology Regulations) 2) Method for Management of Internet Network Information Services 互联网信息服务管理办法 (Internet Regulations).

A commercial website is a website that charges Chinese citizens for access to the site or for information obtained from the site. Internet Regulations, Article 3. Failure to obtain the required ICP license is a violation of law. The penalty for operating a commercial site without a license is 1) cancellation of the entity’s business license, 2) confiscation of illegal income, 3) a fine of three to five times the amount of illegal income earned from the site, 4) termination of website access, and 5) criminal penalties for responsible individuals. Internet Regulations, Article 7; Technology Regulations, Articles 70, 71.

Until recently, many Internet regulators in China assumed that the only form of commercial website was the standard e-commerce site for sale of product. They tended to ignore e-commerce sites for sale of services and they simply had never heard of SaaS or SaaP type websites. To encourage businesses to locate in their district, some of the local regulators suggested that these types of sites were not subject to the commercial ICP license requirement. This is no longer true. The word has come down from Beijing and now every regulator is quite clear on the rule. If a site earns money on the web, an ICP license is required. There are no exceptions.

II. ICP license rules.

The rules for obtaining a commercial ICP license are set out in the Technology Regulations and the Internet Regulations. These rules are quite general. For this reason, each regulatory district in China is required to determine the specific requirements. As is common in China, each regulatory district has a different interpretation of the requirements and the required documentation for application. This post is based on the rules as interpreted by the Beijing Communications Administration (“BCA”). The BCA is the agency that issues all ICP licenses for businesses operating in the city of Beijing.

Pursuant to the BCA rules, the requirements for obtaining an ICP license are as follows:

1. The applicant must be a 100% Chinese owned and managed PRC entity. No foreign capital is permitted. No foreign officers or directors are permitted. This is more strict than the Technology and Internet regulations which in principle allow for sino-foreign joint ventures.

2. The applicant entity must have a minimum registered capital of RMB 1,000,000. Registered capital must be fully funded at the time of application. Funding must be proved by a standard confirmation of capital contribution issued by a PRC certified public accountant. This registered capital requirement is enough to eliminate casual players from the application pool.

3. The applicant must submit a copy of its lease. The lease must be for office space suitable for the type of business and for the number of employees and equipment. A “virtual office” is not permitted.

4. The applicant must employ at least eight full time employees. Proof of employment in the form of proof of payment of at least one month of employee taxes and social benefits must be submitted with the application. Unlike many other jurisdictions, Beijing does not require proof of any special technical expertise on the part of the employees.

5. Only one license is permitted for a specific Internet business. That is, it is not permitted for an ICP license holder to act as the licensee/host for more than one foreign Internet business. This means that the license holding entity must be dedicated to a single foreign software provider. This restriction makes it difficult for SME software developers to find a suitable PRC host. If the potential income is not substantial, it simply is not worth it for the Chinese entity to go the expense and effort required to obtain an ICP license.

The regulations provide that a decision on the license application shall be made within 60 days. BCA staff cautioned us that they are overwhelmed with work and that the process has lately taken from 60 to 80 working days.

Note that the application requirements must be met at the time you submit your application. That is, the applicant company must be formed, the lease must be signed and registered, capital must be deposited and the employees be hired and paid before submitting the application. This involves a certain amount of risk: the company is formed and the basic expenses are incurred before issuance of the ICP license.

Note that there are other licensing issues that may apply for any cloud computing project. Article 5 of the Internet Regulations provides that where the web content involves news, publishing, education, medicine or medical devices, separate licensing from the applicable regulator is also required. Proof of such licensing must be provided in the application for the ICP license. Most of the projects that I see fall into one of these categories.

The general practice in China is that the foreign company will find “China internet consultants” and local Chinese companies who claim that none of the above applies. And when we tell our clients that what these people are proposing cannot work, these people will insist that we do not “understand China” and that there are numerous ways to evade the rules. In my experience, this is never true. Searching for a way around the rules just results in wasted time and money and exposes the foreign party to excessive risk. When the door is shut, sometimes there is just no way to pry it open. That is what you discover when you actually “understand China”.

  • Crashman2

    STAY AWAY FROM CHINA IF YOU RELY ON THE INTERNET.

  • Bill

    Steve – interesting piece, but not sure why you didn’t address what may be the most common practice of foreign SAAS providers working with PRC enterprise customers, which is simply to keep all servers and operations (and employees) outside of China. MIIT doesn’t have extra-territorial jurisdiction. Granted, the foreign SAAS provider could eventually be locked onto the other side of the great firewall, but given the prevalence of this approach why not mention it in the post?

  • David Garzotto

    @ Steve Dickson The article is a bit unclear. Are you talking about foreign companies that want to set up cloud computing and/or SaaS companies, specifically? Or, does this cover any company wanting to host content locally under a domain name?