Top 10 Common CSRC Inquiry Questions and How to Respond

The CSRC’s filing-based oversight regime for overseas listings, effective since March 31, 2023, has fundamentally altered the timeline and disclosure burden for any PRC-incorporated company seeking a Hong Kong or US listing. As of Q1 2025, the China Securities Regulatory Commission (CSRC) has processed over 280 filing applications for overseas offerings, with an average review cycle of 90-120 calendar days — a period that issuers and their sponsors must now budget for as a hard deadline, not a soft estimate. The most material shift is the CSRC’s granular scrutiny of Variable Interest Entity (VIE) structures, data security compliance, and the legal chain of equity ownership, areas where a single inadequate response can trigger a formal supplemental inquiry, halting the filing clock. For CFOs and company secretaries of PRC-incorporated issuers, understanding the top ten recurring inquiry themes is no longer optional due diligence; it is a prerequisite for maintaining a viable listing timetable and avoiding a public withdrawal notice on the CSRC’s website. This article analyses the ten most common CSRC inquiry questions observed across completed and pending filings in 2024-2025, and provides specific, evidence-based response strategies aligned with the Administrative Provisions on the Filing of Overseas Securities Offerings and Listings by Domestic Companies (CSRC Decree No. 43, effective 2023) and its accompanying guidelines.

The VIE Structure: The CSRC’s Foremost Due Diligence Target

The CSRC’s inquiry into VIE structures is the single most frequent and detailed line of questioning, reflecting the regulator’s heightened focus on de facto control and compliance with foreign investment negative lists. Issuers must demonstrate that the VIE arrangement is a structural necessity, not a vehicle to circumvent PRC law.

Proving Necessity Under the Negative List

The CSRC will demand a detailed, article-by-article analysis of the Special Administrative Measures (Negative List) for Foreign Investment Access (2024 Edition). The issuer must identify the specific industry sub-sector in which it operates and confirm whether foreign investment is prohibited, restricted, or permitted. For example, a company operating an online game platform must cite the Negative List’s restriction on foreign investment in internet publishing services (Article 7) and explain why a direct foreign equity holding in the WFOE is legally prohibited, thus necessitating the VIE. The response must include a legal opinion from a qualified PRC law firm, specifically referencing the applicable Negative List articles and the Provisions on the Administration of Internet Publishing Services. The CSRC will reject a generic statement of “industry practice”; the analysis must be fact-specific to the issuer’s actual business license and revenue streams.

Mapping the Control and Profit Flow

Beyond structural necessity, the CSRC requires a complete, auditable map of the contractual arrangements that transmit control and economic benefit from the PRC operating entities (OPCOs) to the Cayman or BVI listed issuer. The inquiry will request copies of all exclusive option agreements, equity pledge agreements, proxy agreements, and technical services agreements. The issuer must submit a chart showing the exact percentage of economic interest flowing from each OPCO to the WFOE under the services agreements, and how that profit is then upstreamed to the listed entity. A common deficiency is a mismatch between the profit allocation percentages stated in the filing and the actual revenue recognition in the WFOE’s audited financial statements. The CSRC will cross-reference these figures; any discrepancy above 5% will trigger a formal inquiry requiring reconciliation.

Data Security and Cybersecurity Compliance

With the Data Security Law (DSL, effective September 2021) and the Personal Information Protection Law (PIPL, effective November 2021) now fully enforced, the CSRC consistently demands proof of a completed cybersecurity review or a documented exemption. This is a non-negotiable gatekeeping step.

Cybersecurity Review Certification or Exemption

The CSRC will ask: “Has the issuer completed a cybersecurity review with the Cybersecurity Administration of China (CAC)? If not, why is the issuer exempt?” The response must cite the Cybersecurity Review Measures (2022) and the Regulations on the Security Assessment of Outbound Data Transfers (2022). For an issuer that does not hold “critical information infrastructure” (CII) status and processes the personal information of fewer than 1 million individuals, the response should provide a legal opinion stating the issuer qualifies for the exemption under Article 2 of the Cybersecurity Review Measures. The legal opinion must be supported by a signed representation from the issuer’s CEO and DPO confirming the data volume and CII status. For any issuer processing data of more than 1 million individuals, a completed CAC cybersecurity review certificate is mandatory before the CSRC will accept the filing as complete.

Outbound Data Transfer Assessment

A separate, increasingly common inquiry concerns the outbound transfer of personal information collected in China to the overseas listed entity or its auditors. The CSRC will request the issuer’s data classification report and the results of a security assessment under the Measures for the Security Assessment of Outbound Data Transfers. If the issuer transfers data to a Hong Kong or US parent, it must provide the executed standard contractual clauses (SCCs) filed with the provincial cyberspace administration, or a certificate of a completed security assessment if the data volume exceeds the thresholds (100,000 individuals’ personal information or 10,000 individuals’ sensitive personal information per year). A failure to provide this documentation is a common reason for a “supplemental materials” request, adding a minimum of 30 working days to the review timeline.

Shareholding Structure and Ultimate Beneficial Ownership

The CSRC’s inquiry into the shareholding structure is designed to identify any potential violation of PRC foreign investment restrictions, anti-money laundering regulations, or undisclosed related-party transactions. The regulator now expects a fully traced chain of ownership back to the ultimate natural person.

Tracing the 36-Month History

The CSRC will request a complete shareholding history for the 36 months preceding the filing date, covering all PRC, BVI, Cayman, and Hong Kong entities in the structure. This includes all share issuances, transfers, and cancellations. The response must provide a table listing each shareholder, their nationality, the date of acquisition, the consideration paid, and the source of funds. For any transfer where the consideration deviates from the net asset value per share of the PRC OPCO by more than 20%, the CSRC will request a detailed explanation and a valuation report. A common pitfall is failing to document the source of funds for early-stage angel investors; the CSRC expects a bank statement or a signed declaration from the investor confirming the funds were legally remitted into China.

Identifying PRC Residents and 37号文 Compliance

The CSRC will explicitly ask whether any of the listed entity’s shareholders are PRC residents (including Hong Kong and Macau residents who are PRC citizens). For any such shareholder who holds shares in an offshore entity (Cayman, BVI, or Hong Kong), the issuer must demonstrate compliance with the Circular on Issues Concerning the Administration of Foreign Exchange in respect of Overseas Financing and Round Trip Investment by Domestic Residents (SAFE Circular 37, 2014). The response must include the SAFE registration certificates for each relevant shareholder. If a PRC resident shareholder has not completed SAFE 37 registration, the issuer must provide a remediation plan and a timeline, along with a legal opinion on the potential penalties (up to 5% of the illegal amount under the Foreign Exchange Administration Regulations). The CSRC will not accept a filing as “complete” while outstanding SAFE 37 violations exist.

Business Operations and Licenses

The CSRC will scrutinize whether the issuer holds all material licenses and permits required to operate its business in China. This is a straightforward but high-stakes inquiry, as a missing license can render the entire business model illegal.

License Mapping and Validity

The CSRC will request a complete list of all PRC business licenses, including but not limited to: the Value-Added Telecommunication Services (VATS) License (ICP license), Internet Content Provider (ICP) Filing, Online Publishing License, Medical Device Registration Certificate, or Food Operation Permit. The response must include the license number, the issuing authority, the date of issuance, and the expiration date. For any license that has expired or is due to expire within 12 months, the CSRC will ask for the renewal application status. A material license that is not held — for example, an online education platform without a School License — is a fatal deficiency that will result in a rejection of the filing.

Related-Party Transactions and License Sharing

A common variation of this inquiry is whether the issuer’s OPCOs share licenses or operate under a single license held by the WFOE. The CSRC will ask for a legal opinion on whether this “license sharing” arrangement is permissible under the specific industry regulations. For example, if the WFOE holds the ICP license but the OPCOs operate the websites, the issuer must cite the Administrative Measures for Internet Information Services (2000, amended 2011) and explain that the WFOE is the legal operator and the OPCOs are its service providers under a contractual arrangement. The CSRC will test this logic against the actual revenue and cost allocation in the financial statements.

Use of Proceeds and Business Plan

The CSRC requires a clear, non-speculative statement on how the proceeds from the overseas offering will be used. This inquiry is designed to prevent capital flight and ensure that the funds are deployed in the issuer’s core business in China.

Specific Allocation and Onshore Remittance Plan

The CSRC will ask for a table showing the exact percentage of net proceeds allocated to: (i) expansion in China, (ii) R&D in China, (iii) overseas expansion, and (iv) working capital. For any portion allocated to overseas expansion, the issuer must provide a rationale and a timeline. The CSRC will also ask for a detailed plan on how the offshore funds (in HKD or USD) will be remitted onshore into China. The response must cite the SAFE rules on capital account items and confirm that the funds will be remitted under a valid business purpose (e.g., capital increase into the WFOE or shareholder loan). The CSRC has rejected filings where the use of proceeds included vague terms like “general corporate purposes” exceeding 30% of the total; a 15-20% cap is considered market standard.

Related-Party Transactions and Conflicts of Interest

The CSRC will conduct a forensic-level review of all related-party transactions (RPTs) between the listed entity, its WFOE, the OPCOs, and any shareholders or directors.

Full RPT Disclosure and Fairness Opinion

The CSRC will request a complete register of all RPTs for the past three fiscal years, including the transaction amount, the counterparty, the nature of the transaction (e.g., service fee, loan, asset purchase), and the pricing methodology. For any RPT exceeding 5% of the issuer’s total assets or revenue, the CSRC will require a fairness opinion from an independent financial advisor. The response must also confirm that all RPTs have been approved by the board of directors and, where required by the issuer’s constitutional documents or the Cayman/BVI Companies Act, by disinterested shareholders. A common deficiency is failing to disclose RPTs with the OPCO’s minority shareholders, who are often the founders’ family members.

Industry-Specific Regulatory Compliance

The CSRC will tailor its inquiries to the issuer’s specific industry, demanding evidence of compliance with the sector’s primary regulator. This is the most variable category of inquiry.

Sector-Specific Licenses and Approvals

For a fintech issuer, the CSRC will ask for a copy of the Payment Business License from the People’s Bank of China (PBOC) or the Financial License from the National Financial Regulatory Administration (NFRA). For a healthcare issuer, the CSRC will demand the Drug Manufacturing License from the National Medical Products Administration (NMPA) and proof of clinical trial approvals. For an education issuer, the CSRC will require confirmation that the business does not violate the Double Reduction Policy (2021) and holds the appropriate School License. The response must include a legal opinion from a PRC law firm specializing in the relevant sector, confirming that the issuer is in full compliance with all applicable laws and regulations.

Material Litigation and Disputes

The CSRC will ask for a complete disclosure of all material litigation, arbitration, or administrative proceedings involving the issuer, its subsidiaries, or its key shareholders.

Litigation Impact Assessment

The response must provide a table listing each case, the court or arbitration body, the parties involved, the claim amount, the current stage, and the issuer’s estimate of the probable outcome. For any case where the claim amount exceeds 10% of the issuer’s net equity, the CSRC will request a legal opinion on the potential financial impact and a contingency plan. The CSRC will also ask whether any of the litigation involves intellectual property infringement, which could directly affect the VIE structure’s validity. A failure to disclose a material case, even if the issuer believes it is without merit, is a breach of the filing duty and can lead to a public warning.

Changes in the Listing Structure

If the issuer has changed its listing structure (e.g., from a direct offshore listing to a VIE structure, or from a US listing to a Hong Kong dual-primary listing) within the 36 months prior to filing, the CSRC will demand a detailed explanation.

Rationale for Structural Change

The CSRC will ask for the specific business or regulatory reason for the change. For example, a company that previously held a direct equity stake in its PRC OPCO but switched to a VIE structure must explain which new regulation (e.g., an amendment to the Negative List) triggered the change. The response must include copies of the board resolutions and shareholder approvals for the restructuring, as well as the tax clearance certificates from the relevant PRC tax bureau for any asset transfers. The CSRC will scrutinize whether the restructuring was done to evade a specific regulatory restriction; a negative finding here can lead to a rejection.

The Role of the Sponsor and Legal Advisors

Finally, the CSRC will inquire into the qualifications and independence of the sponsor (for Hong Kong listings) or the underwriter (for US listings) and the PRC legal advisors.

Sponsor’s Due Diligence Record

The CSRC will ask the sponsor to confirm that it has conducted a thorough due diligence on the issuer’s compliance with PRC laws, including the VIE structure, data security, and foreign exchange rules. The CSRC may request the sponsor’s due diligence checklist and a summary of any “red flags” identified. The response must be signed by the sponsor’s compliance officer. The CSRC has publicly stated that it will hold sponsors liable for material omissions in the filing, referencing the Securities Law of the People’s Republic of China (2019, Article 85) on the liability of intermediaries.

Actionable Takeaways

• Prepare a VIE necessity legal opinion mapping each business line to the Negative List (2024 Edition) and the relevant industry-specific licensing law, signed by a qualified PRC law firm, before submitting the CSRC filing.
• Obtain a completed CAC cybersecurity review certificate or a documented exemption supported by a legal opinion and a signed CEO/DPO representation on data volume and CII status, as this is the single most common cause of a supplemental materials request.
• Trace the full 36-month shareholding history for every entity in the structure, with source-of-funds documentation for any transfer where consideration deviates from net asset value by more than 20%.
• Complete SAFE 37 registration for every PRC resident shareholder in the offshore structure before filing, as outstanding violations will block the filing from being accepted as complete.
• Cap the “general corporate purposes” allocation in the use of proceeds statement at 15-20% of the net offering amount, and provide a specific onshore remittance plan referencing SAFE capital account rules.