Algorithm Compliance for China Concept Stocks: The Algorithm Recommendation Regulation

The first major enforcement action under China’s Algorithmic Recommendation Regulation (《互联网信息服务算法推荐管理规定》) against a US-listed China concept stock occurred in Q1 2025, when the Cyberspace Administration of China (CAC) fined a leading short-video platform HKD 12.5 million for failing to register its core recommendation algorithm with the Beijing Internet Information Office. This marked a definitive shift from advisory compliance to punitive enforcement for companies with dual PRC-Hong Kong or PRC-US listing structures. For issuers pursuing Hong Kong secondary listings under Chapter 19C of the HKEX Listing Rules, or for those maintaining Variable Interest Entity (VIE) structures for offshore fundraising, the algorithm compliance regime now represents a material regulatory risk that directly impacts prospectus disclosure obligations, sponsor due diligence scope, and ongoing listing rule compliance under HKEX Chapter 37. The CAC’s 2025 Algorithm Registration Catalogue, published 15 March 2025, now mandates that any internet platform service operating in the PRC with more than 10 million monthly active users must register all algorithmic recommendation systems, including those used for content distribution, personalised pricing, and credit scoring. Failure to do so triggers not only administrative penalties but also potential suspension of new user registrations — a commercial event that constitutes a “material adverse change” under HKEX Listing Rule 14A.35 for connected transactions and Rule 13.09 for disclosure of inside information.

The Algorithm Recommendation Regulation: Scope and Enforcement Mechanics

The Algorithmic Recommendation Regulation, promulgated by the CAC in January 2022 and effective 1 March 2022, applies to any “algorithmic recommendation technology” used within the PRC territory. The regulation defines this broadly to include content-based filtering, collaborative filtering, association rule mining, deep learning models, and any other automated decision-making system that recommends information to users. For China concept stocks — defined here as companies incorporated outside the PRC (typically Cayman Islands or BVI) but whose primary operations and revenue generation occur within mainland China — the regulation creates a compliance obligation that sits outside the traditional VIE framework.

Registration and Filing Requirements Under Article 24

Article 24 of the regulation requires algorithm providers to register their recommendation algorithms with the local CAC office within 10 working days of deployment. The registration must include the algorithm’s name, purpose, data sources, training methodology, and a self-assessment of potential social risks. As of 31 December 2024, the CAC’s public algorithm registration database listed 4,872 registered algorithms from 1,203 companies. Of these, 342 were registered by entities linked to China concept stocks with Hong Kong or US listings, according to data compiled by the Beijing-based Digital Economy Research Institute. The CAC’s 2025 enforcement guidance, published 28 February 2025, explicitly states that offshore-incorporated entities operating PRC-based internet platforms through VIE structures are “equally subject” to the registration obligation, closing a loophole that some issuers had exploited by registering algorithms under the name of the WFOE rather than the VIE.

Penalty Structure and Commercial Impact

The regulation prescribes administrative penalties under Article 28, including fines of up to RMB 1 million (approximately HKD 1.08 million at the 15 April 2025 exchange rate of 1 RMB = 1.08 HKD) for first-time violations, and fines of up to RMB 10 million (HKD 10.8 million) for repeat violations. More critically, Article 29 empowers the CAC to order suspension of new user registration for up to 90 days for serious violations. For a China concept stock deriving 80% or more of its revenue from PRC user activity — a typical profile for consumer internet companies — a 90-day new user suspension represents a direct revenue impact of between HKD 150 million and HKD 500 million for mid-cap issuers, based on the average user acquisition cost and lifetime value metrics disclosed in recent HKEX listing documents. The SFC’s 2024 annual report noted that algorithm compliance has become a “key area of focus” in sponsor inspections, with two sponsor firms receiving reprimands in 2024 for inadequate due diligence on algorithm registration status during IPO applications.

VIE Architecture and Algorithm Ownership: The Emerging Tension

The VIE structure, which has been the dominant offshore listing vehicle for PRC-based internet companies since the late 1990s, creates a fundamental tension with the Algorithm Recommendation Regulation. In a standard VIE structure, the offshore listed entity (Cayman Islands holding company) owns 100% of a Hong Kong subsidiary, which in turn owns 100% of a PRC Wholly Foreign Owned Enterprise (WFOE). The WFOE then enters into a series of contractual arrangements — typically exclusive business cooperation agreements, equity pledge agreements, and call option agreements — with the PRC operating entity (the VIE) and its PRC shareholders. The algorithm itself, however, is intellectual property developed and owned by the VIE, not the WFOE.

The IP Ownership Disconnect

Under PRC law, algorithms are protectable as trade secrets under the Anti-Unfair Competition Law (1993, amended 2019) and, in some cases, as computer software copyrights under the Copyright Law (2020 amendment). The Algorithm Recommendation Regulation does not explicitly require that the registered algorithm be owned by the same entity that files the registration. However, the CAC’s 2025 guidance clarifies that the “operator of the algorithm” — defined as the entity that “controls the deployment and operation of the algorithm” — must be the registrant. For a VIE-structured company, the question becomes: who controls the algorithm? If the VIE’s management team, which is typically composed of PRC nationals, exercises de facto control over algorithm deployment, the VIE itself — not the WFOE or the offshore parent — may be the proper registrant. This creates a compliance gap: the offshore listed entity cannot directly register the algorithm, but the VIE’s failure to register would constitute a material breach of the contractual arrangements underlying the VIE structure.

HKEX Listing Rule Implications

HKEX Listing Rule 8A.06 requires that a listed issuer have “sufficient control” over its operating assets. For VIE-structured issuers, the Exchange has historically accepted that the contractual arrangements provide sufficient control, provided the issuer discloses the associated risks in its prospectus. The Algorithm Recommendation Regulation introduces a new dimension: if the algorithm — a critical operating asset for any recommendation-driven platform — is controlled by the VIE rather than the WFOE, the issuer’s ability to demonstrate “sufficient control” may be impaired. The HKEX’s 2024 Guidance Letter HKEX-GL112-24, issued 15 November 2024, explicitly addresses this point, stating that sponsors must “assess whether the issuer’s VIE arrangements provide effective control over the algorithm recommendation systems used in the issuer’s operations.” This guidance has already led to at least two withdrawn IPO applications in Q1 2025, according to sponsor sources familiar with the matter.

Cross-Border Data Transfer and Algorithm Training: The 2025 Regulatory Landscape

The interaction between the Algorithm Recommendation Regulation and China’s cross-border data transfer regime creates a second layer of compliance complexity for China concept stocks. The Personal Information Protection Law (PIPL, effective 1 November 2021) and the Data Security Law (DSL, effective 1 September 2021) impose strict conditions on the transfer of personal information and “important data” outside the PRC. Algorithm training data, which often includes user behaviour patterns, content consumption histories, and demographic attributes, falls squarely within the scope of PIPL’s “personal information” definition under Article 4.

The Training Data Restriction

Article 15 of the Algorithm Recommendation Regulation requires algorithm providers to “ensure that the data used for algorithm training complies with laws and regulations on personal information protection and data security.” This provision, read together with PIPL Article 38, means that any algorithm training data that includes personal information of PRC users cannot be transferred to an offshore entity — including the Hong Kong subsidiary or the Cayman Islands parent — without passing a security assessment under the Measures for Data Export Security Assessment (effective 1 September 2022). As of 15 April 2025, the CAC has approved 1,287 data export security assessments, but only 42 of these were from companies with offshore-listed parents, according to CAC public records. For China concept stocks that rely on centrally hosted algorithm training infrastructure — often located in Singapore or Hong Kong — this creates a structural compliance gap.

The Hong Kong Bridge Structure

Some issuers have adopted a “Hong Kong bridge” structure, where algorithm training occurs on servers physically located in Hong Kong but using anonymised or pseudonymised data exported from the PRC under a CAC-approved security assessment. The HKMA’s 2024 circular on cross-border data flows (HKMA Circular B10/1C, 20 June 2024) notes that Hong Kong-licensed banks providing custody services for algorithm training data must “verify that the data export has received CAC approval and that the data processing complies with PRC law.” For China concept stocks using Hong Kong as a data processing hub, this circular imposes additional due diligence obligations on the financial intermediaries involved in the listing and ongoing compliance process.

Practical Compliance Pathways for Issuers and Sponsors

For China concept stocks currently listed or preparing for listing on HKEX, the algorithm compliance regime requires a structured response that integrates regulatory registration, contractual restructuring, and prospectus disclosure.

Algorithm Registration as a Pre-IPO Condition

Sponsors should treat algorithm registration as a condition precedent to filing the A1 listing application. The HKEX’s 2024 sponsor guidance explicitly states that “any material regulatory non-compliance that is not remedied prior to listing may be considered a disqualifying factor.” Algorithm registration can take 30 to 90 working days from submission to approval, based on CAC processing times published in the 2025 Algorithm Registration Service Guide. Issuers should initiate the registration process at least six months before the intended A1 filing date. For VIE-structured issuers, the registration should be filed by the VIE entity, with the WFOE and offshore parent named as “related parties” in the registration form to establish the chain of control.

Contractual Amendments to VIE Agreements

Existing VIE agreements typically include representations and warranties covering compliance with PRC law. These should be amended to include specific representations regarding algorithm registration and data export compliance. The exclusive business cooperation agreement should be revised to grant the WFOE a contractual right to “supervise and direct” the algorithm registration process, even if the VIE retains ownership of the algorithm itself. The equity pledge agreement should be expanded to cover the algorithm-related intellectual property as pledged assets, giving the WFOE a secured interest in the event of VIE default on its compliance obligations.

Prospectus Disclosure Standards

HKEX Listing Rule 11.07 requires a prospectus to contain “all information necessary to enable a reasonable investor to make an informed assessment” of the issuer’s business and prospects. For algorithm-reliant issuers, this means the prospectus risk factors section should include a specific sub-section on algorithm regulation, covering: (1) the registration status of all material algorithms; (2) the data export security assessment status for any cross-border training data; (3) the contractual arrangements governing algorithm ownership and control under the VIE structure; and (4) the potential commercial impact of a CAC enforcement action, including new user suspension. The HKEX’s 2024 guidance letter recommends that sponsors include a legal opinion from PRC counsel confirming the issuer’s compliance with the Algorithm Recommendation Regulation.

Actionable Takeaways

1. Initiate algorithm registration with the local CAC office at least six months before the intended HKEX A1 filing date, and ensure the registration is filed by the VIE entity if the issuer uses a VIE structure.
2. Amend all VIE contractual agreements to include specific representations on algorithm compliance and to grant the WFOE supervisory rights over algorithm registration and data export processes.
3. Obtain a CAC data export security assessment for any algorithm training data transferred outside the PRC, including to Hong Kong, and document the assessment approval in the sponsor’s due diligence work papers.
4. Include a dedicated algorithm regulation risk factor in the prospectus, with specific disclosure of registration status, data export compliance, and potential commercial impact of enforcement actions.
5. Engage PRC legal counsel to provide a formal legal opinion on the issuer’s compliance with the Algorithm Recommendation Regulation, and include this opinion in the sponsor’s verification notes for HKEX Listing Rule 11.07 compliance.