How to Communicate Effectively with the CSRC International Cooperation Department

The CSRC International Cooperation Department (ICD) is no longer a passive filing receptacle; it has become an active, risk-based gatekeeper for all offshore listings of PRC-incorporated or PRC-controlled issuers. Since the implementation of the Administrative Provisions on Overseas Securities Offerings and Listings by Domestic Companies (hereafter the “Overseas Listing Rules”, effective 31 March 2023), the ICD has processed over 300 filings, with a rejection or deferred rate of approximately 18% in 2024 for filings that required substantive revision (CSRC 2024 Annual Work Report). For Hong Kong-listed applicants, the key shift is the ICD’s heightened scrutiny on VIE structures, data security, and the “actual controller” definition under PRC Company Law. A poorly prepared filing or a miscommunication strategy now carries a direct cost: a 3-6 month delay in the HKEX A1 filing, which can destroy a deal’s market window and increase sponsor liability. This article provides a procedural and substantive framework for CFOs, company secretaries, and legal counsel to navigate this interaction with precision.

The Filing Mechanics: Timing, Documents, and the “Complete” Standard

The ICD operates on a “completeness review” standard, not a merit-based approval system, but the practical effect is identical. A filing that is deemed “incomplete” or “requiring further explanation” will not receive the Notice of Filing Completion (备案通知书), which is a mandatory pre-condition for the HKEX to accept the listing application under HKEX Listing Rule 19.05(1A) for Main Board applicants.

The 20-Working-Day Clock and Its Triggers

The Overseas Listing Rules stipulate a 20-working-day review period, but this clock only starts upon the ICD’s acknowledgment of a “complete” filing. In practice, the average time from initial submission to formal acceptance is 35-40 working days for first-time filers (based on CSRC public disclosure data for H1 2024). The most common trigger for a clock reset is an inadequate description of the VIE structure. The ICD requires a contractual arrangement map showing the exact flow of control and economic benefits from the onshore WFOE to the offshore listed entity, with annotations on PRC regulatory approvals required (e.g., for value-added telecommunications services under the Catalogue of Industries for Guiding Foreign Investment 2024 edition). Submitting a generic VIE chart without jurisdiction-specific regulatory references guarantees a return for revision.

Document Checklist: Beyond the Standard Forms

The mandatory forms (Form 1: Filing Report, Form 2: Sponsor’s Report) are well-documented. The ICD’s informal requirements, however, are more demanding. The ICD now expects a Data Security Self-Assessment Report for any issuer handling “important data” as defined under the Data Security Law (DSL, effective 1 September 2021). For HKEX-listed biotech or fintech companies, this is non-negotiable. The report must identify the data categories, the legal basis for cross-border transfer (e.g., standard contractual clauses under the Personal Information Protection Law), and the name of the designated data protection officer. Failure to include this report, even if the issuer believes it is exempt, results in an automatic “incomplete” designation. The SFC’s Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission (Chapter 571 of the Laws of Hong Kong) also requires sponsors to verify that the issuer has made all necessary PRC regulatory filings before submitting the A1, creating a direct liability link between ICD compliance and SFC sponsor obligations.

Navigating VIE Structures and the “Actual Controller” Definition

The ICD’s scrutiny of VIE structures has shifted from a binary “is it permitted?” to a granular “how is it controlled?” analysis. The PRC Company Law (2023 revision, effective 1 July 2024) introduced a clearer definition of “actual controller” (实际控制人), which the ICD now applies retroactively to offshore listing filings.

The “Control Without Ownership” Paradox

For VIE-based issuers, the ICD requires a detailed explanation of how the offshore listed entity exercises “control” over the onshore operating companies despite holding no equity. The ICD’s review template (published in its Q&A series, March 2024) asks for: (i) the specific contractual provisions that grant the offshore entity the power to appoint and remove the onshore company’s board; (ii) the mechanism for profit repatriation; and (iii) the dispute resolution clause, which must specify PRC courts as the exclusive forum. A common error is using a BVI or Cayman holding company as the direct counterparty to the VIE agreements. The ICD has flagged this as a potential evasion of PRC court jurisdiction. The safer structure, and the one the ICD has accepted without comment in at least 12 filings in 2024, is to have a Hong Kong-incorporated WFOE (wholly foreign-owned enterprise) as the direct counterparty, with the offshore listed entity being a Cayman or BVI company that holds the HK WFOE.

Defining the “Actual Controller” in a Dual-Class Structure

The 2024 Company Law defines an actual controller as any person who, “by virtue of investment, agreement, or other arrangement, is able to control the company’s operations.” For HKEX-listed companies with weighted voting rights (WVR) structures under Chapter 8A of the HKEX Listing Rules, this creates a direct conflict. The WVR beneficiary may hold only 10% of the economic interest but 60% of the voting power. The ICD requires a declaration that the WVR beneficiary is the “actual controller” for PRC regulatory purposes, which triggers additional scrutiny on the source of their PRC assets and any history of foreign exchange violations. The HKEX’s own guidance (HKEX Guidance Letter HKEX-GL93-18) on WVR beneficiaries requires them to be directors and to have contributed “actively to the business.” The ICD now cross-references this with PRC foreign exchange records. Any discrepancy between the declared controller and the actual flow of funds (e.g., a PRC citizen holding a BVI company that then controls the HK WFOE) will result in a filing rejection. The solution is a pre-filing consultation with the ICD to obtain a “no-objection” letter on the controller designation, which takes approximately 10-15 working days.

Data Security, National Security Reviews, and the “Red Line” Issues

The ICD’s most significant operational change in 2025 is the integration of the National Security Review (NSR) process under the Measures for Security Review of Foreign Investment (effective 18 January 2021). Any offshore listing of a company operating in a “sensitive sector” (defined broadly to include internet platforms, data processing, and critical information infrastructure) now triggers an automatic referral to the National Security Review mechanism.

The Automatic Referral Threshold

The ICD’s internal policy (disclosed in part through a 2024 training session for sponsor banks) sets a de facto threshold: any issuer with over 1 million user records in the PRC, or any issuer whose business involves cross-border data flow exceeding 100GB per month, is automatically referred for NSR. This is not a public rule but has been confirmed by sponsor feedback from at least 8 completed filings in 2024. The NSR adds a minimum of 60 working days to the filing timeline, and the ICD will not issue the Notice of Filing Completion until the NSR process is concluded. For HKEX applicants, this means the A1 filing must be timed to account for this 3-month delay. The HKEX’s Guidance on Filing of Overseas Listing Applications (2023) explicitly states that the Exchange will not process an application until the CSRC filing is complete, making the NSR a de facto listing bottleneck.

The Data Security Self-Assessment: A Practical Template

The ICD expects a data security self-assessment that follows the structure of the Data Security Assessment Measures (effective 15 September 2022). The report must include: (i) a data classification table (personal information, important data, core data); (ii) a cross-border data transfer impact assessment; and (iii) a risk mitigation plan. For a typical HKEX-listed fintech company, the critical section is the “important data” classification. The Regulations on the Security Protection of Critical Information Infrastructure (CII Regulations, effective 1 August 2021) define CII operators as those in finance, energy, and telecommunications. A fintech company providing payment services to a PRC bank may itself be classified as a CII operator, even if it is not a licensed bank. The ICD requires a written confirmation from the issuer’s legal counsel that the issuer is not a CII operator, or if it is, that the NSR has been completed. The SFC’s Guidelines on the Use of External Electronic Data Storage Providers (2023) also require licensed corporations to ensure that their data storage arrangements comply with PRC law, creating a parallel compliance obligation for the Hong Kong sponsor.

The Post-Filing Relationship: Amendments, Variations, and Material Changes

The ICD’s oversight does not end with the issuance of the Notice of Filing Completion. The Overseas Listing Rules require the issuer to report any “material change” to the filing within 3 working days. The definition of “material change” is broad and has been clarified through enforcement actions.

What Constitutes a “Material Change” in Practice

The ICD’s 2024 enforcement record (CSRC Administrative Penalty Decisions, 2024) shows that a change in the VIE structure, a change in the actual controller, or a change in the business scope that touches a restricted sector all constitute material changes. In one case (CSRC Penalty Decision No. 12/2024), a HKEX-listed company that changed its VIE agreement to remove a dispute resolution clause was fined RMB 5 million for failing to file an amendment. The ICD’s position is that any change that alters the “control relationship” between the offshore listed entity and the onshore operating company is material. For HKEX-listed companies, this creates a compliance trap: a routine amendment to a VIE agreement to comply with a new PRC regulation (e.g., the 2024 Foreign Investment Law implementation rules) must be pre-filed with the ICD, which takes 20 working days, before the amendment can take effect.

The Annual Reporting Obligation

The Overseas Listing Rules also require an annual report to the ICD within 4 months of the fiscal year end, covering any changes to the VIE structure, the data security status, and the actual controller. The HKEX’s own annual reporting requirements under Listing Rule 13.48(1) are similar but not identical. The ICD requires a separate report in Chinese, signed by the legal representative of the onshore operating company, and submitted through the online portal. A common error is submitting the HKEX annual report in English without a Chinese translation. The ICD has rejected at least 3 annual filings in 2024 for this reason, triggering a formal inquiry and a potential penalty of up to RMB 1 million under Article 24 of the Overseas Listing Rules.

Actionable Takeaways

1. Pre-file a “completeness check” request with the ICD via your sponsor at least 40 working days before the planned HKEX A1 submission, using the ICD’s informal Q&A mechanism, to identify any data security or VIE structure issues before the formal clock starts.
2. Ensure the VIE agreement’s dispute resolution clause explicitly names PRC courts as the exclusive forum, with the Hong Kong WFOE as the direct counterparty, to avoid the ICD’s “control evasion” scrutiny.
3. Prepare a Data Security Self-Assessment Report in the format of the Data Security Assessment Measures for any issuer handling over 1 million user records, and obtain a written legal opinion confirming the issuer is not a CII operator, to prevent an automatic NSR referral.
4. Define the “actual controller” in the filing to match the PRC Company Law 2024 definition, and cross-reference this with the HKEX WVR beneficiary declaration to avoid a discrepancy that triggers a filing rejection.
5. Establish an internal compliance calendar that tracks the 3-working-day material change reporting window and the 4-month annual report deadline, with a Chinese-language version of the annual report prepared in parallel with the HKEX English version.