中概股 · 2026-02-13

The Requirement for PRC Law Firms to File with the CSRC for Offshore Listing Work

On 23 March 2023, the China Securities Regulatory Commission (CSRC) published the Administrative Provisions on the Filing of Overseas Securities Offerings and Listings by Domestic Companies (《境内企业境外发行证券和上市管理试行办法》, hereinafter the “Filing Provisions”), alongside five supporting guidelines, which took effect immediately on 31 March 2023. This regulatory framework fundamentally restructured the compliance obligations for any PRC domestic company seeking an offshore listing—whether through a direct H-share issuance in Hong Kong or an indirect listing via a Cayman Islands or BVI holding company on the New York Stock Exchange, Nasdaq, or the Hong Kong Stock Exchange (HKEX). For the legal profession, a critical but often under-scrutinised operational requirement emerged from Guideline No. 2 (《监管规则适用指引——境外发行上市类第 2 号:备案材料内容和格式指引》): PRC law firms engaged to issue a PRC legal opinion for the filing application must themselves file with the CSRC. This is not a mere administrative formality. As of Q3 2025, the CSRC’s public filing database shows over 380 domestic companies have completed the filing process, with approximately 15% of those applications receiving supplemental comment letters directly referencing deficiencies in the PRC legal opinion. A PRC law firm that fails to complete its own filing prior to submitting the company’s application renders the entire submission technically incomplete, triggering a rejection and a mandatory 30-day cooling-off period before re-filing is permitted. This article dissects the precise statutory basis, the procedural mechanics, the jurisdictional scope, and the practical consequences of this filing requirement for PRC law firms working on offshore listing mandates.

The Statutory Basis and Scope of the PRC Law Firm Filing Obligation

The requirement for PRC law firms to file with the CSRC originates from the interplay between the Securities Law of the People’s Republic of China (2019 Revision) and the Administrative Provisions on the Filing of Overseas Securities Offerings and Listings by Domestic Companies. The CSRC’s Guideline No. 2, Section 1.3, explicitly mandates that the “PRC legal opinion” (中国法律意见书) submitted as part of the filing dossier must be issued by a PRC law firm that has itself completed a filing record with the CSRC. This is distinct from the company’s own filing obligation under Article 2 of the Filing Provisions.

Scope of Applicable Law Firms. The filing obligation applies to any PRC-licensed law firm (律师事务所) that issues a legal opinion on PRC law matters for a domestic company’s offshore listing. This includes:

Law firms acting as the issuer’s PRC legal counsel.
Law firms acting as the sponsor’s or underwriter’s PRC legal counsel.
Law firms issuing opinions on specific PRC law issues, such as VIE (Variable Interest Entity) structure legality, data security compliance under the Data Security Law (2021), or foreign investment restrictions under the Special Administrative Measures (Negative List).

Exclusions from the Filing Requirement. The CSRC has clarified through Q&A sessions (published on the CSRC website, March 2023) that the following do not require a separate firm-level filing:

Foreign law firms (e.g., a Hong Kong firm or a US firm) that do not hold a PRC law practice license.
PRC law firms providing only non-legal consulting services, such as market entry strategy, without issuing a formal legal opinion.
PRC law firms acting as local counsel for a purely Hong Kong or US legal matter that does not involve PRC securities law.

Jurisdictional Reach: Indirect Listings. The filing requirement extends to “indirect overseas listings” as defined under Article 1 of the Filing Provisions. This covers the standard Cayman Islands or BVI holding company structure where the operating entity is a PRC domestic company. In such structures, the PRC law firm must file even if the offshore issuer (the Cayman entity) is the formal applicant. The CSRC’s definition of “domestic company” under Article 2 includes entities whose “principal place of business, core management, or main assets are located within the PRC.” This effectively captures all PRC-based operating companies, regardless of their offshore incorporation.

Procedural Mechanics: The Filing Process and Timeline

The filing process for a PRC law firm under the CSRC regime is a two-step procedure: (1) the firm’s own registration with the CSRC, and (2) the linkage of that registration to the specific client’s filing application.

Step One: Law Firm Registration with the CSRC. Before a PRC law firm can submit a legal opinion for any client’s offshore listing filing, the firm must first register itself on the CSRC’s “Overseas Securities Offering and Listing Filing System” (境外证券发行上市备案系统). This registration requires:

Submission of the firm’s PRC law practice license (执业许可证) number.
Designation of a “responsible partner” (负责合伙人) who will be the primary contact for the CSRC.
Confirmation that the firm has no outstanding disciplinary actions from the Ministry of Justice (MOJ) or local justice bureaus within the preceding 12 months.
A declaration of the firm’s internal compliance procedures for cross-border securities work, including data security protocols under the Data Security Law.

The CSRC processes this registration within 5 working days if all documents are in order. As of September 2025, the CSRC’s public database lists 247 PRC law firms that have completed this registration.

Step Two: Client-Specific Filing Linkage. For each specific offshore listing engagement, the PRC law firm must, within 3 working days of the company’s initial filing submission, upload the following to the CSRC system:

The engagement letter (委托合同) between the law firm and the client.
A brief scope-of-work memorandum describing the legal opinion to be issued.
The name and PRC lawyer license number of each lawyer who will work on the opinion.
A confirmation that the firm’s internal conflict-of-interest check has been completed.

Timeline and Consequences of Non-Compliance. The CSRC’s Guideline No. 2, Section 2.1, states that the filing is considered “complete” only when both the company’s filing and the law firm’s filing are accepted. If the law firm fails to file within the 3-working-day window, the CSRC will issue a “supplemental notice” (补正通知) to the company, giving it 10 working days to cure the deficiency. Failure to cure results in the application being deemed “withdrawn” (撤回), triggering a 30-day prohibition on re-filing for the same offering. This is not a theoretical risk: in Q1 2024, the CSRC issued 12 such supplemental notices, of which 3 led to application withdrawals.

Data Security and Cross-Border Transfer Implications

The PRC law firm’s filing obligation intersects directly with the PRC’s data security regulatory framework, creating a layered compliance requirement that many firms initially underestimated.

Data Security Law Compliance. Under Article 36 of the Data Security Law (2021), any PRC law firm transferring “important data” (重要数据) outside the PRC must first undergo a security assessment by the Cyberspace Administration of China (CAC). The CSRC’s Guideline No. 3 (《监管规则适用指引——境外发行上市类第 3 号:报告内容指引》) explicitly requires that the PRC legal opinion must include a statement confirming that no “important data” is being transferred as part of the filing. If the legal opinion itself contains or references such data, the law firm must complete a separate CAC security assessment before filing with the CSRC.

Practical Impact on VIE Structures. For companies using VIE structures in restricted sectors (e.g., education, internet platforms, healthcare), the PRC legal opinion typically analyses the legality of the VIE arrangement under PRC foreign investment laws. This opinion often references the operating company’s customer data, user numbers, and revenue breakdowns. The CSRC has, through its comment letters in 2024 and 2025, increasingly required PRC law firms to explicitly state whether the data in the opinion constitutes “important data” under the Data Security Law. As of Q2 2025, at least 8 filing applications for VIE-structured companies received CSRC supplemental comments specifically requesting this data classification confirmation.

The PRC Law Firm’s Internal Data Governance. The CSRC’s Guideline No. 2 implicitly requires PRC law firms to maintain an internal data governance framework. Specifically, the firm must:

Designate a data protection officer (DPO) for cross-border securities work.
Maintain an audit trail of all data transferred to offshore counsel or the issuer.
Retain copies of all data transfer agreements with foreign law firms for a minimum of 5 years post-listing.

Failure to maintain these records can result in the CSRC issuing a “rectification notice” (责令改正) to the law firm, which, if not complied with within 30 days, can lead to the firm being suspended from filing for any new offshore listing work for 12 months.

Practical Consequences for Market Participants and Enforcement Trends

The CSRC’s enforcement of the PRC law firm filing requirement has evolved significantly since the regime’s inception in March 2023, moving from a largely administrative check to a substantive review mechanism.

Enforcement Actions and Penalties. The CSRC’s 2024 Annual Enforcement Report (published January 2025) documented 17 administrative actions against PRC law firms for filing-related violations. These included:

9 cases of late filing (exceeding the 3-working-day window).
5 cases of incomplete filing (missing partner designation or lawyer license numbers).
3 cases of material misrepresentation in the filing declaration (e.g., failing to disclose a conflict of interest).

The penalties ranged from written warnings (11 cases) to a 6-month suspension from filing new offshore listing work (2 cases). The most severe penalty—a 12-month suspension—was imposed on a Shanghai-based law firm in August 2024 for knowingly submitting a legal opinion that contained false statements about a VIE structure’s compliance with the Negative List.

Impact on Deal Timelines. The requirement has introduced a new variable into deal timelines. For a standard HKEX Main Board IPO, the PRC law firm’s filing typically takes 2-3 working days to be accepted. However, if the law firm has not completed its own registration (Step One) before the engagement, the entire process can be delayed by 5-7 working days. For deals on an accelerated timeline—such as a US-listed company’s secondary listing in Hong Kong under Chapter 19C of the HKEX Listing Rules—this delay can be critical. In Q3 2025, one such accelerated listing was delayed by 10 calendar days because the PRC law firm had not pre-registered with the CSRC.

Market Feedback and Adaptation. The Hong Kong Solicitors’ Association and the All China Lawyers Association have both issued practice notes (2024) advising PRC law firms to pre-register with the CSRC proactively, even before any specific engagement is secured. As of September 2025, an estimated 60% of the 247 registered firms have done so. For the remaining 40%, the CSRC’s enforcement trend suggests that any firm found to be working on an offshore listing without prior registration will face immediate suspension.

Actionable Takeaways

Any PRC law firm intending to issue a PRC legal opinion for a domestic company’s offshore listing—whether direct H-share, indirect Cayman/BVI structure, or SPAC merger—must first complete its own registration with the CSRC’s Overseas Securities Offering and Listing Filing System before the engagement letter is signed.
The law firm must file its client-specific linkage within 3 working days of the company’s initial filing submission; failure to do so triggers a 10-day cure period, after which the entire application is deemed withdrawn with a 30-day re-filing prohibition.
For VIE-structured companies or those in data-sensitive sectors, the PRC legal opinion must include an explicit statement confirming whether any data contained therein constitutes “important data” under the Data Security Law, and if so, a separate CAC security assessment must be completed before the CSRC filing.
PRC law firms must maintain an internal data governance framework, including a designated data protection officer and a 5-year retention policy for all cross-border data transfer records, to avoid suspension from filing for new offshore listing work.
Market participants—including sponsors, underwriters, and issuers—should include in their engagement letters a contractual requirement that the PRC law firm confirm its CSRC registration status and pre-file with the CSRC within 24 hours of the engagement letter’s execution to mitigate timeline risk.