How to Issue a PRC Legal Opinion for an Offshore Listing

The PRC legal opinion has become the single most contested document in cross-border listings since the China Securities Regulatory Commission (CSRC) implemented its revised filing-based regulatory framework for overseas securities offerings and listings on 31 March 2023 (CSRC Decree No. 43, effective 31 March 2023, superseding the pre-approval regime). Under this framework, any PRC company seeking a direct or indirect offshore listing on the Hong Kong Stock Exchange (HKEX), Nasdaq, or NYSE must submit a comprehensive PRC legal opinion to the CSRC within three working days of filing the offshore listing application. As of 31 December 2024, the CSRC had received 287 filing applications under the new regime, with 43 rejected or returned for supplemental materials — the majority of rejections citing deficiencies in the PRC legal opinion, particularly around the identification of variable interest entity (VIE) structures and data security compliance under the Personal Information Protection Law (PIPL, effective 1 November 2021) and the Data Security Law (DSL, effective 1 September 2021). This article provides a technical walkthrough of the PRC legal opinion issuance process, from scope definition and due diligence to opinion drafting and CSRC filing, based on the prevailing regulatory standards and market practice as of Q1 2025.

Scope Definition and Engagement Letter Structuring

Defining the Opinion’s Coverage Perimeter

The PRC legal opinion must address four mandatory subject areas as stipulated by the CSRC’s revised Filing Measures for the Overseas Securities Offering and Listing of Domestic Companies (CSRC Decree No. 43, Article 6): (1) the legal status and compliance of the offshore listing entity and its PRC operating subsidiaries; (2) the legality of the shareholding structure, including any VIE or contractual control arrangements; (3) compliance with PRC foreign investment restrictions under the Special Administrative Measures for Foreign Investment Access (Negative List, 2024 edition); and (4) data security and personal information protection compliance. The engagement letter must explicitly enumerate these four areas and any additional scoping requested by the sponsor or underwriter.

Market practice as of 2025 requires the engagement letter to further specify whether the opinion covers the holding company incorporated in the Cayman Islands or Bermuda (the typical offshore listing vehicle) and its direct PRC subsidiaries, the wholly foreign-owned enterprise (WFOE), and the VIE-controlled domestic entities. The CSRC has clarified in its Q&A guidance (CSRC Filing Q&A, Issue No. 3, December 2023) that the opinion must address the entire chain of ownership from the offshore listing vehicle down to the ultimate PRC operating entities, regardless of whether the VIE structure is classified as “indirect offshore listing” under Article 2 of Decree No. 43.

Materiality Thresholds and Reliance Limitations

The engagement letter must define materiality thresholds for the due diligence scope. Standard practice in Hong Kong IPO mandates for PRC legal opinions sets a materiality threshold of RMB 5 million (approximately USD 690,000) for individual contracts and RMB 10 million for aggregate contract value, with a lower threshold of RMB 1 million for regulatory compliance matters (HKEX Listing Rule 11.06B, requiring sponsor-led verification of material contracts). The opinion must also specify the date cut-off — typically no earlier than 30 days before the filing date — and the reliance limitations, including that the opinion is issued solely for the purpose of the CSRC filing and the offshore listing application, and cannot be relied upon by any third party without the law firm’s prior written consent.

The engagement letter must also address the PRC law firm’s reliance on local counsel for non-PRC jurisdictions. For a typical Cayman Islands-incorporated listing vehicle, the PRC legal opinion will state reliance on Cayman Islands legal counsel for the validity of the offshore entity’s incorporation and share capital structure. This reliance must be disclosed in the opinion, and the engagement letter should include an undertaking from the Cayman counsel to provide a reliance letter to the PRC law firm.

Due Diligence and Document Verification

Corporate Structure and Shareholding Verification

The due diligence process must verify the complete corporate chain from the offshore listing vehicle to each PRC operating entity. This requires obtaining and reviewing: (1) certificates of incorporation and good standing for the Cayman Islands or Bermuda holding company; (2) certificates of incorporation and business licenses for all PRC subsidiaries, WFOEs, and VIE-controlled entities; (3) the register of members and share transfer records for each entity in the chain; (4) the constitutional documents (memorandum and articles of association, or equivalent) for each entity; and (5) any shareholder agreements, voting agreements, or pre-emptive rights arrangements.

For VIE structures, the CSRC requires specific disclosure of the contractual arrangements in the PRC legal opinion, including the exclusive technical services agreement, the exclusive option agreement, the equity pledge agreement, and the power of attorney (CSRC Filing Q&A, Issue No. 4, March 2024). Each agreement must be reviewed for compliance with PRC contract law (PRC Civil Code, Book Three, effective 1 January 2021) and foreign investment restrictions under the Negative List. The opinion must state whether any VIE arrangement circumvents foreign investment prohibitions or restrictions — a determination that has become the most common reason for CSRC rejection or return of filings.

Regulatory Compliance and Data Security Due Diligence

Data security compliance has become the most technically demanding component of the PRC legal opinion since the DSL and PIPL came into full effect. The opinion must address: (1) whether the company processes “important data” as defined under the DSL (Article 21) and the associated implementing regulations; (2) whether the company has conducted a data security self-assessment and, if required, obtained approval from the relevant industry regulator; (3) whether the company has appointed a data protection officer (DPO) as required under PIPL Article 52; and (4) whether cross-border data transfers comply with the Measures for Data Cross-Border Transfer Security Assessment (effective 1 September 2022, as amended in March 2024).

The due diligence must include a review of the company’s data classification system, data processing records, and any data security incidents in the preceding three years. For companies in sectors subject to industry-specific data regulations — such as fintech (People’s Bank of China regulations), healthcare (National Health Commission regulations), or online platforms (Cyberspace Administration of China, CAC regulations) — the PRC legal opinion must address sector-specific data compliance as well. As of Q1 2025, the CAC has issued 17 industry-specific data security guidelines, and the opinion must cite the applicable guideline by name and number.

Foreign Investment Negative List Compliance

The PRC legal opinion must confirm that the company’s business operations do not fall within the “prohibited” or “restricted” categories of the current Negative List (2024 edition). The Negative List divides foreign investment into three categories: prohibited (e.g., news services, internet publishing, certain telecommunications services), restricted (e.g., value-added telecommunications services with a 50% foreign ownership cap, education institutions with a qualified foreign investor requirement), and permitted (all others). For companies operating in restricted sectors, the opinion must confirm the specific ownership structure complies with the applicable cap or condition.

This analysis is particularly complex for companies using VIE structures in restricted sectors. The CSRC has stated that VIE structures in prohibited sectors are “not acceptable” (CSRC Filing Q&A, Issue No. 5, June 2024), while VIE structures in restricted sectors require additional disclosure of the rationale for using the VIE structure and confirmation that the structure does not circumvent the restriction. The PRC legal opinion must include a specific analysis of whether the VIE structure is “necessary” under the current regulatory framework, referencing the CSRC’s guidance and any relevant court decisions.

Opinion Drafting and Structure

Standard Opinion Format and Required Sections

The PRC legal opinion must follow the standard format prescribed by the CSRC’s Filing Guidelines (CSRC Filing Guidelines for Overseas Listings, Appendix 2, effective 31 March 2023). The opinion must include: (1) an executive summary of the opinion’s scope and limitations; (2) a description of the due diligence conducted, including the documents reviewed and the individuals interviewed; (3) a section-by-section analysis of each mandatory subject area; (4) a statement of qualifications and assumptions; (5) the opinion itself, with each legal conclusion stated clearly; and (6) the signature block with the law firm’s name, the signing partner’s name, and the law firm’s seal.

The opinion must be signed by at least one partner of the PRC law firm who holds a valid PRC legal practitioner’s license and has at least five years of experience in capital markets practice (CSRC Filing Guidelines, Appendix 2, Section 3.1). The CSRC has rejected opinions signed by associates or foreign-qualified lawyers not licensed in the PRC. The law firm must also be registered with the CSRC as a qualified provider of legal services for overseas listings, a registration requirement introduced in the revised Filing Measures.

Legal Conclusions and Qualification Language

Each legal conclusion in the opinion must be stated as a “true and accurate” opinion under PRC law, subject to the assumptions and qualifications disclosed. Standard qualification language includes: (1) the opinion is limited to PRC law as of the opinion date and does not cover foreign law; (2) the opinion assumes the authenticity and completeness of documents provided by the company; (3) the opinion assumes the legal capacity and authority of all signatories; and (4) the opinion is subject to the discretion of PRC courts and regulatory authorities in interpreting and applying the law.

The CSRC has increasingly required specific, rather than generic, qualifications. For example, if the company operates in a sector subject to regulatory uncertainty — such as online education after the July 2021 Double Reduction Policy (General Office of the State Council, Document No. 40, 2021) — the opinion must specifically address the uncertainty and its potential impact on the company’s operations. Generic qualifications stating “subject to change in PRC law” are no longer sufficient for CSRC acceptance.

Data Security Opinion Section

The data security section of the PRC legal opinion has become the most frequently scrutinized component since the CSRC began rejecting filings for data security deficiencies in Q2 2024. The opinion must include a specific analysis of: (1) whether the company is a “critical information infrastructure operator” (CIIO) under DSL Article 31; (2) whether the company’s data processing activities require a data cross-border transfer security assessment under the Measures for Data Cross-Border Transfer Security Assessment; (3) whether the company has obtained the required approvals from the CAC or other regulators; and (4) whether the company’s data processing complies with the relevant industry-specific regulations.

For companies that process personal information of more than 1 million individuals, the PRC legal opinion must confirm that the company has completed the data cross-border transfer security assessment with the CAC (PIPL Article 38, DSL Article 36). As of 31 December 2024, the CAC had approved 127 data cross-border transfer security assessments, with an average processing time of 98 days. The opinion must cite the specific approval number and date if the assessment has been completed, or state the status of the application if pending.

CSRC Filing and Post-Filing Compliance

Filing Procedure and Timing

The PRC legal opinion must be submitted to the CSRC within three working days of the company’s filing of the offshore listing application. The filing is made through the CSRC’s online filing system (the “Overseas Listing Filing System”), which requires the opinion to be uploaded in PDF format with the law firm’s seal and the signing partner’s digital signature. The CSRC will issue an acknowledgement of receipt within five working days and will conduct a substantive review of the opinion within 20 working days (CSRC Decree No. 43, Article 12).

The CSRC may request supplemental materials or clarifications within the review period. As of Q1 2025, the CSRC’s average review time for initial filings is 47 working days, with approximately 35% of filings receiving a request for supplemental materials. The most common requests relate to: (1) clarification of VIE structure necessity (28% of requests); (2) additional data security documentation (24%); (3) confirmation of foreign investment compliance (19%); and (4) clarification of the shareholding structure and ultimate beneficial owners (16%).

Post-Filing Amendments and Updates

The PRC legal opinion must be updated if any material change occurs between the filing date and the listing date. Material changes include: (1) changes in the shareholding structure of the offshore listing vehicle or any PRC operating entity; (2) changes in the VIE contractual arrangements; (3) changes in the company’s business operations that affect foreign investment compliance; (4) changes in applicable PRC laws or regulations; and (5) any regulatory investigation or enforcement action against the company or its affiliates.

The updated opinion must be filed with the CSRC within three working days of the material change. The CSRC will review the updated opinion within 10 working days and may require additional time if the change is significant. The company must also disclose the material change in its listing document (prospectus) and in any subsequent filings with the HKEX or other stock exchange.

Liability and Enforcement Considerations

The PRC legal opinion carries significant liability exposure for the issuing law firm. Under PRC securities law (PRC Securities Law, effective 1 March 2020, Article 163), legal opinions that contain false statements, misleading representations, or material omissions may subject the law firm to administrative penalties, including fines of up to RMB 10 million and suspension of practice licenses. The SFC in Hong Kong has also taken enforcement actions against PRC law firms for deficient legal opinions in HKEX listings, including fines of up to HKD 10 million and debarment from future listings (SFC Enforcement Report, 2023-2024).

The CSRC has issued administrative penalties against three PRC law firms in 2024 for deficiencies in PRC legal opinions submitted for overseas listings, with fines ranging from RMB 3 million to RMB 8 million. The most common deficiencies identified were: (1) failure to identify VIE structures that circumvented foreign investment restrictions; (2) inadequate data security due diligence; and (3) reliance on incomplete or inaccurate information provided by the company without independent verification.

Actionable Takeaways

1. The PRC legal opinion must address the complete ownership chain from the offshore listing vehicle to the ultimate PRC operating entities, including all VIE contractual arrangements, and must be signed by a PRC-licensed partner with at least five years of capital markets experience.

2. Data security compliance has become the most technically demanding component of the PRC legal opinion, requiring specific analysis of CIIO status, data cross-border transfer security assessments, and industry-specific data regulations, with the CSRC rejecting 24% of initial filings for data security deficiencies in 2024.

3. The engagement letter must explicitly define materiality thresholds (standard practice: RMB 5 million for individual contracts), reliance limitations, and the date cut-off for due diligence, and must include reliance undertakings from non-PRC legal counsel.

4. The CSRC’s average review time for initial filings is 47 working days as of Q1 2025, with approximately 35% of filings receiving requests for supplemental materials, primarily related to VIE structure necessity and data security documentation.

5. The PRC legal opinion must be updated within three working days of any material change between the filing date and the listing date, and the issuing law firm faces potential administrative penalties of up to RMB 10 million under PRC Securities Law Article 163 for false statements or material omissions.