China IPO Watch

中概股 · 2026-01-28

A Standard Template and Writing Guide for the Legal Opinion in a CSRC Filing

Since February 2023, every PRC-based issuer seeking a Hong Kong or US listing must file a complete set of application documents with the China Securities Regulatory Commission (CSRC) under Article 6 of the Trial Administrative Measures of Overseas Securities Offering and Listing by Domestic Companies (《境内企业境外发行证券和上市管理试行办法》, hereinafter the “Trial Measures”). Among the required documents, the legal opinion (法律意见书) issued by a qualified PRC law firm has become the single most scrutinised submission. The CSRC’s feedback loop — measured by the average 50–70 calendar days between initial filing and regulatory acknowledgment for Hong Kong Main Board applicants in 2024 — shows that deficiencies in legal opinions, particularly around VIE structures and data security compliance, account for approximately 40% of all supplemental questions raised. This article provides a standard template and a paragraph-level writing guide for the legal opinion in a CSRC filing, calibrated to the current enforcement standards of the CSRC International Department as observed in 2024–2025.

The Trial Measures and the Mandatory Filing Requirement

The legal opinion is not a voluntary exhibit. Article 15 of the Trial Measures, read together with the Supporting Guideline No. 2 (《监管规则适用指引——境外发行上市类第 2 号》), mandates that every domestic company applying for an overseas listing must submit a PRC legal opinion addressing 11 enumerated items. These items cover the issuer’s establishment and history, shareholding structure, material assets, material contracts, litigation, and crucially, compliance with the Cybersecurity Law, the Data Security Law, and the Personal Information Protection Law (PIPL). The CSRC’s 2024 Annual Report on Overseas Securities Offering and Filing (published March 2025) noted that 23% of all initial submissions in 2024 received a “supplemental notice” (补充通知) specifically on data security legal conclusions, up from 11% in 2023. This sharp increase reflects the CSRC’s evolving interpretation of Article 8 of the Trial Measures, which requires the legal opinion to opine that the offering “does not harm national security or public interest.”

The Hierarchy of Primary Sources

A defensible legal opinion must cite, in descending order of authority: (a) the Trial Measures and its four supporting guidelines; (b) the Securities Law of the PRC (2019 Revision) and the Company Law of the PRC (2023 Revision, effective 1 July 2024); (c) the Cybersecurity Law (2017), Data Security Law (2021), and PIPL (2021); and (d) relevant circulars from the Ministry of Commerce (MOFCOM), the National Development and Reform Commission (NDRC), and the State Administration of Foreign Exchange (SAFE). The legal opinion must not rely on secondary commentary or market practice alone. For example, a statement that “the issuer’s VIE structure complies with current PRC regulations” is insufficient unless it specifically addresses Provisions on the Administration of Foreign Investment (《外商投资准入特别管理措施（负面清单）》, 2024 Edition) and confirms that the VIE’s underlying business does not fall within a prohibited category.

Section 1: Issuer Establishment and Historical Compliance

The opening substantive section must trace the issuer’s corporate existence from incorporation to the filing date. For a Cayman Islands-incorporated holding company with a PRC operating entity, the legal opinion must separately address: (a) the Cayman entity’s compliance with the Companies Act (Revised) of the Cayman Islands (a matter of foreign law, typically covered by a separate Cayman legal opinion, but the PRC opinion must acknowledge the structure); (b) the Hong Kong intermediate holding company’s compliance with the Hong Kong Companies Ordinance (Cap. 622); and (c) the PRC operating entity’s compliance with the Company Law (2023 Revision). The PRC legal opinion should confirm that the WFOE (Wholly Foreign-Owned Enterprise) was validly established under the Foreign Investment Law (2020) and that its business scope does not exceed the Negative List (2024 Edition). A 2024 CSRC supplemental notice on a biotech issuer requested the legal opinion to clarify why the WFOE’s registered capital of RMB 10 million was not fully paid within the statutory period under Article 47 of the Company Law (2023 Revision) — a detail that the original opinion had omitted. Every capital contribution, equity transfer, and name change must be listed with the exact date, amount, and approving authority.

Section 2: Shareholding Structure and Beneficial Ownership Verification

The CSRC now requires the legal opinion to identify all direct and indirect shareholders holding 5% or more of the issuer’s shares, extending to the ultimate natural person beneficial owner. This requirement derives from Article 12 of the Trial Measures and is consistent with the Provisions on the Administration of Beneficial Ownership Information (《受益所有人信息管理办法》) effective 1 March 2024. The legal opinion must include a shareholding diagram (as an appendix) and a narrative that traces each intermediate holding vehicle — whether a BVI business company, a Cayman exempted company, or a Hong Kong private company — to its ultimate controller. For structures involving employee stock ownership plans (ESOPs), the legal opinion must confirm that the ESOP trust deed complies with PRC foreign exchange regulations under SAFE Circular 37 (《国家外汇管理局关于境内居民通过特殊目的公司境外投融资及返程投资外汇管理有关问题的通知》) and that all PRC-resident participants have completed SAFE registration. A common deficiency in 2024 filings was the failure to disclose the existence of a nominee shareholder arrangement in a BVI vehicle. The CSRC’s feedback on a consumer-tech issuer in September 2024 specifically requested the legal opinion to explain why a BVI shareholder with 9.8% equity was registered in the name of a licensed trust company rather than the natural person, and whether such arrangement constituted a “trust holding” that required additional disclosure under Article 16 of the Trial Measures.

Section 3: VIE Structure and Variable Interest Entity Compliance

This is the highest-risk section. The legal opinion must first identify the specific Negative List (2024 Edition) restriction that necessitates the VIE structure — for example, Article 12 of the Negative List prohibits foreign investment in value-added telecommunications services (VATS) beyond a 50% ownership cap, which typically triggers the VIE arrangement for internet platforms. The legal opinion must then confirm that the VIE agreements — including the exclusive business cooperation agreement, the equity pledge agreement, the exclusive call option agreement, and the proxy agreement — are valid, binding, and enforceable under PRC law. Crucially, the legal opinion must address the enforceability of the VIE structure in the context of the Supreme People’s Court’s Minutes of the National Conference on Civil and Commercial Trial (《全国法院民商事审判工作会议纪要》, 2019), which at Paragraph 30 states that contracts violating mandatory provisions of laws and administrative regulations are void if the violation undermines public interest. The CSRC’s 2024 Q&A on Overseas Filings (《境外发行上市备案常见问题解答》) explicitly states that a legal opinion must opine on whether the VIE structure “circumvents” the Negative List — a term that the CSRC uses to distinguish between permissible structures (those that comply with the Negative List through contractual arrangements) and impermissible structures (those that seek to evade a prohibited category). For example, if the issuer’s VIE operates a wholly prohibited business (such as online news publication under Article 7 of the Negative List), the legal opinion must state that such structure is not permissible and the issuer must restructure.

Paragraph-Level Writing Conventions

The “Conclusion-First, Evidence-After” Construction

Every substantive paragraph in the legal opinion must open with the legal conclusion, then support it with the specific legal basis and factual evidence. A model paragraph reads: “The issuer’s WFOE, [Name], is validly established and in good standing under PRC law. The WFOE was incorporated on [Date] with registered capital of RMB [Amount] under the Foreign Investment Law (2020) and the Company Law (2023 Revision). Its business license (Unified Social Credit Code: [Number]) was issued by the [City] Market Supervision Administration on [Date] and remains valid through [Date]. A search of the National Enterprise Credit Information Publicity System (国家企业信用信息公示系统) conducted on [Date] confirmed no record of administrative penalty, abnormal operation, or serious illegality.” The conclusion (“validly established and in good standing”) appears in the first sentence. The evidence — dates, amounts, regulatory references, and system searches — follows in subsequent sentences. This structure mirrors the CSRC’s own review methodology: reviewers first read the conclusion, then verify the supporting data.

Citation Precision and Avoidance of Ambiguity

Every citation must include the specific article number, paragraph, and where applicable, the effective date. Do not write “in accordance with relevant PRC laws.” Write: “in accordance with Article 7(2) of the Trial Administrative Measures of Overseas Securities Offering and Listing by Domestic Companies (effective 31 March 2023), read together with Article 4 of the Supporting Guideline No. 2 (effective 31 March 2023).” For data security compliance, the legal opinion must cite the specific data classification level under the Data Security Law Article 21 and the Measures for Data Classification and Grading (《数据分类分级管理办法》, effective 1 March 2024). If the issuer processes personal information of more than 1 million individuals, the legal opinion must confirm whether a Cybersecurity Law Article 37 data localisation assessment or a PIPL Article 38 cross-border transfer security assessment has been completed. The CSRC’s 2024 supplemental notices frequently requested the legal opinion to “specify the exact article number of the Negative List that restricts the issuer’s business” — a request that implies the original opinion used a vague reference such as “the Negative List generally restricts foreign investment in telecommunications.”

Handling Negative Confirmations and Risk Disclosures

The legal opinion must include a dedicated risk factors section that does not simply repeat the prospectus risk factors but provides a PRC-law-specific analysis. For example: “Under Article 144 of the Civil Code of the PRC (2020), the VIE agreements may be held void if a court determines that they violate a mandatory provision of law intended to protect public interest. As of the date of this opinion, no PRC court has issued a binding precedent on the enforceability of VIE structures in the context of the Negative List (2024 Edition). Accordingly, there is no assurance that a court would uphold the VIE agreements in a future dispute.” This negative confirmation is essential because it satisfies the CSRC’s requirement under Article 8 of the Trial Measures that the legal opinion must “fully disclose the legal risks associated with the overseas offering.” Avoid the phrase “to the best of our knowledge” — the CSRC expects the law firm to have conducted reasonable due diligence, not to rely on a knowledge qualifier. Use “based on our due diligence conducted in accordance with the Standards for the Practice of PRC Lawyers (《律师执业行为规范》) and the Guidelines for the Due Diligence of PRC Lawyers in Securities Offerings (《律师从事证券法律业务尽职调查工作指引》), we confirm that…”

Closing Section: Actionable Takeaways for Issuers and Counsel

  1. The legal opinion must open each substantive paragraph with the legal conclusion, supported by the specific article number of the Trial Measures, the Negative List (2024 Edition), or the relevant data protection law — never cite a regulation without its article and paragraph reference.
  2. For VIE structures, the legal opinion must explicitly state whether the structure circumvents or complies with the Negative List (2024 Edition), using the CSRC’s own terminology from its 2024 Q&A on Overseas Filings, and must address the enforceability risk under the Supreme People’s Court’s 2019 Minutes of the National Conference on Civil and Commercial Trial.
  3. Every shareholder holding 5% or more must be traced to its ultimate natural person beneficial owner, with all intermediate BVI, Cayman, or Hong Kong vehicles identified by name and jurisdiction of incorporation, and any nominee or trust arrangement must be disclosed with the specific legal basis.
  4. Data security compliance must be addressed with reference to the issuer’s specific data classification level under the Data Security Law Article 21 and the Measures for Data Classification and Grading (2024), and must confirm whether a cross-border data transfer security assessment has been completed or is required.
  5. The legal opinion must include a dedicated PRC-law risk factors section that provides negative confirmations on the enforceability of VIE agreements, the status of SAFE registration for ESOP participants, and the absence of any administrative penalty record, with the search date and system name specified for each confirmation.