Anti-Money Laundering Law of the PRC (2024)
The revised law, in Chinese, on the central government portal.
Mainland KYC, checked against official sources.
Mainland institutions verify customers against official government sources, under a revised AML Law and new due diligence measures in force since 1 January 2026.
Fill Easy runs China eID and registration checks for Hong Kong firms under the Standard Contract.
A summary, not legal advice: the official text governs, and your compliance team decides what your policies require.
A revised law and new measures.
The revised Anti-Money Laundering Law took effect on 1 January 2025. Institutions identify customers and beneficial owners and take reasonable measures to verify them (Art. 29), and may verify through government departments (Art. 33).
The Customer Due Diligence Measures (PBOC, NFRA and CSRC Order [2025] No. 11, issued jointly) took effect on 1 January 2026. Existing higher-risk customers were to be brought into line within six months, all others within two years (Art. 51).
At a glance
- Law
- Anti-Money Laundering Law of the PRC, revised, in force 1 January 2025
- Measures
- PBOC, NFRA and CSRC Order [2025] No. 11, in force 1 January 2026
- Beneficial owner
- 25% or more of equity, profits or votes, or actual control (PBOC and SAMR Order [2024] No. 3)
- Records
- At least ten years after the relationship ends
- Transfer to Hong Kong
- Fill Easy's GBA Standard Contract, Filing No. 202500031
- Regulators
PBOCPeople's Bank of ChinaNFRANational Financial Regulatory AdministrationCSRCChina Securities Regulatory CommissionSAMRState Administration for Market Regulation- Digital identity
- China eIDMainland resident ID with face checkChecked against official government sources, with consent.
Choose your regulator.
The PBOC sets AML rules for every institution; NFRA and CSRC supervise their sectors; SAMR holds the company records. Pick one to see what it asks for, and what Fill Easy supplies.
PBOCPeople's Bank of ChinaOrder [2025] No. 11, Customer Due Diligence Measures (opens in a new tab)Individuals
Identify the customer
Name, sex, nationality, occupation, address or employer's address, contact details, and the type, number and expiry of the identity document (Art. 49(1)).
GovVerify · China eIDResident ID checked against official government sources with a face check and consent, returned to Hong Kong under Filing No. 202500031.Verify from reliable sources
Government department records (such as market regulation, civil affairs, tax, immigration and telecoms), information certified by foreign governments, further documents from the customer, or other reliable, independent information (Art. 22).
GovVerify · China eIDResident ID checked against official government sources with a face check and consent, returned to Hong Kong under Filing No. 202500031.Electronic credentials
A valid identity document may be written or electronic; electronic images and credential information have the same legal effect as copies (Art. 49(3)).
GovVerify · China eIDResident ID checked against official government sources with a face check and consent, returned to Hong Kong under Filing No. 202500031.
Companies
Identify the entity
Name, address, business scope, the licence under which it was set up with its number and validity, and the legal representative and authorised person with their identity documents (Art. 49(2)).
CorpVerify · registry searchThe registration record behind the business licence: name, Unified Social Credit Code, legal representative, scope and status.Beneficial owners
Understand the ownership and control structure, and identify and verify the beneficial owner from reliable information (Art. 20).
CorpVerify · UBO tracingShareholders traced through the registration records, layer by layer, to the natural persons at the top.
Non-face-to-face and records
- Institutions serving customers online must have an effective identity authentication mechanism that confirms the identity is genuine (Art. 36).
- A supervised third party may carry out identification, but the institution stays liable and must be able to obtain the information at once (Art. 37).
- Identity data kept for at least ten years after the relationship ends (Art. 44; AML Law Art. 34).
NFRANational Financial Regulatory AdministrationOrder [2025] No. 11 (PDF) (opens in a new tab)Individuals
Check the resident identity card
Banks may check a resident identity card through the online citizen identity verification system set up by the PBOC (Art. 22).
GovVerify · China eIDResident ID checked against official government sources with a face check and consent, returned to Hong Kong under Filing No. 202500031.Insurance: policyholders and beneficiaries
The Customer Due Diligence Measures set when due diligence applies to life and investment-type insurance (Art. 12) and treat the life-policy beneficiary as a risk factor (Art. 21).
GovVerify · China eIDResident ID checked against official government sources with a face check and consent, returned to Hong Kong under Filing No. 202500031.
Companies
Identify and verify the entity
The business licence particulars and legal representative, verified with market regulation records among other sources (Arts. 22 and 49(2)).
CorpVerify · registry searchThe registration record behind the business licence, returned to Hong Kong with an English summary.Beneficial owners
Know-your-customer duties include the beneficial owners of non-individual customers (CBIRC Order 2019 No. 1, Art. 12).
CorpVerify · UBO tracingOwnership traced through each registry to the natural persons at the top, with each layer's jurisdiction and holding.
CSRCChina Securities Regulatory CommissionCSRC Order No. 68, AML in securities and futures (opens in a new tab)Individuals
When due diligence applies
Brokerage, asset management, product sales of RMB 50,000 or more (or USD 10,000), and margin, pledge and other credit business (Art. 11).
GovVerify · China eIDResident ID checked against official government sources with a face check and consent, returned to Hong Kong under Filing No. 202500031.
Companies
Corporate investors
The licence particulars, legal representative and beneficial owners, as for any institution (Arts. 20 and 49(2)).
CorpVerify · UBO tracingOwnership traced through each registry to the natural persons at the top, with each layer's jurisdiction and holding.
SAMRState Administration for Market RegulationPBOC and SAMR Order [2024] No. 3, Beneficial Owner Measures (opens in a new tab)Companies
The business licence
SAMR registers companies and issues the business licence, electronic or paper with equal effect, carrying the 18-digit Unified Social Credit Code (Regulations on the Registration of Market Entities, Arts. 21 and 22).
CorpVerify · registry searchThe registration record behind the licence, with the Unified Social Credit Code, legal representative, shareholders and status.
Beneficial owners
Who is filed
Natural persons with 25% or more of equity, profits or votes, or actual control; failing that, the person running the business day to day (Art. 6). Small companies owned only by individuals may be exempt (Art. 3).
CorpVerify · UBO tracingShareholders traced through the registration records to the natural persons at the top.Who can see the filing
Financial institutions query filed beneficial owner information through the PBOC when carrying out AML duties (Art. 12). Changes are filed within 30 days (Art. 10).
Mainland institutions query the filed register through the PBOC; firms outside the Mainland rely on the registration records.
Read the source
The official text.
Order [2025] No. 11
The Customer Due Diligence Measures, in Chinese, on the PBOC site.
Order [2024] No. 3
The Beneficial Owner Information Management Measures, in Chinese.
Questions about Mainland China KYC and AML
Not covered here? Ask our team
Can we rely on the data Fill Easy returns?
Yes, as verification evidence. Mainland institutions themselves verify customers with information from government departments, including market regulation, civil affairs, tax and immigration records (Customer Due Diligence Measures, Art. 22). China eID checks the resident ID against official government sources, and company data comes from the registration records behind the business licence. For a firm in Hong Kong, that is data from a reliable and independent source under AMLO. Fill Easy passes it on unaltered, with its source and retrieval time, under its Standard Contract. The due diligence decision stays with your firm.
Does Fill Easy make us compliant with Mainland China AML rules?
No. The due diligence duty sits with your firm under Mainland China AML rules, and your policies decide what is enough. Fill Easy supplies the evidence those policies rely on: records from the government or registry source, each showing where and when it was retrieved.
Can results about Mainland customers reach a firm in Hong Kong?
Yes. Fill Easy transfers them under its own GBA Standard Contract (Filing No. 202500031), with the individual's consent, so your firm files nothing.
What changed on 1 January 2026?
The Customer Due Diligence Measures, issued by the PBOC, NFRA and CSRC as Order [2025] No. 11, took effect and replaced the 2007 rules. Existing higher-risk customers were to be brought into line within six months and all others within two years.
What identifies a Mainland company?
Its business licence: the name, address, business scope, the licence number (the 18-digit Unified Social Credit Code) and validity, and the legal representative. Fill Easy returns the registration record behind the licence, with an English summary.
Who counts as a beneficial owner?
A natural person with 25% or more of the equity, profits or votes, or actual control; failing that, the person running the business day to day. Small companies owned only by individuals, with registered capital of RMB 10 million or less, may be exempt from filing.
Can we see the beneficial owner filing?
Mainland financial institutions query it through the PBOC. Firms outside the Mainland rely on the registration records, and Fill Easy traces shareholders through them, layer by layer, to the natural persons at the top.
How long do Mainland institutions keep the records?
At least ten years after the relationship ends, for both identity data and transaction records.