Navigating cross-border financial data compliance and overseas regulatory conflicts

The parallel advance of digital finance and globalisation has elevated financial data to a core strategic resource for commercial banks. Within China, draft amendments to the Banking Supervision Law and other domestic instruments are imposing stricter data governance obligations.

Externally, US and EU long-arm jurisdiction and cross-border data regulation are growing ever more assertive.

Drawing on legal developments and case studies from all three jurisdictions, this article analyses the compliance challenges facing banks and sets out recommendations for strengthening cross-border data governance.

Trends

China’s evolving financial legal framework is raising the compliance bar for banks in data governance and information confidentiality. The draft amendments to the Banking Supervision Law, expanded from 52 to 80 provisions, are now being reviewed by the National People’s Congress Standing Committee and due to be finalised this year.

Article 46 of the draft extends regulatory authority to information technology service providers and prohibits them from intercepting, storing or relaying banking data without permission. Article 8 forbids domestic banks from disclosing business files or records to foreign regulators unless the competent authorities have given their consent. Article 44 introduces a countermeasure regime specifically for the financial sector.

Article 50 of the Anti-Money Laundering Law, along with data security regulations issued by the People’s Bank of China and blocking order No. 21 of the Ministry of Commerce, places financial institutions under an explicit obligation to block direct requests from foreign judicial, law enforcement or supervisory bodies for client identification and transaction data.

Financial institutions must explicitly disclaim recognition, enforcement or compliance with any US measures imposed under its executive orders, including designations on the Specially Designated Nationals and Blocked Persons List, asset freezes and transaction restrictions.

These legal instruments provide a statutory shield for Chinese mainland banks against extraterritorial overreach. But they also place banks in a compliance dilemma, caught between conflicting obligations across multiple jurisdictions.

Conflicts

Extraterritorial judicial requests for evidence versus data sovereignty protection. Foreign authorities may seek client identity and transaction data from banks during cross-border litigation, anti-money laundering probes and sanctions enforcement.

This dilemma was tested in the case of Gucci America Inc v Bank of China Ltd (2014), in which the bank had to balance Chinese statutory confidentiality duties against the risk of being held in contempt by a US court, facing heavy fines for non-compliance. The case demonstrates the dual pressures weighing on financial institutions involved in cross-border judicial processes.

Cross-border data flows versus national security regulation. The US Executive Order No. 14117 of 2024 further restricts the bulk acquisition of US citizens’ sensitive personal data by countries of concern and tightens regulation of related transactions.

For banks with cross-border operations, this raises compliance concerns around data storage, access rights, internal group sharing and third-party information technology services.

US courts, applying the data controller standard under the Clarifying Lawful Overseas Use of Data Act, may require parent companies or branches subject to US jurisdiction to retrieve data stored within Chinese territory.

Therefore, banks face a difficult balancing act between meeting foreign disclosure obligations and observing domestic data export requirements.

Personal data protection versus financial globalisation. The EU General Data Protection Regulation enshrines individual rights and requires the uninterrupted protection of personal data.

In the case of Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems, commonly referred to as Schrems II, the Court of Justice of the EU ruled that the US law failed to guarantee adequate protection for EU personal data, and annulled the Privacy Shield decision.

The judgment established that cross-border data transfers cannot rest on private contractual arrangements alone, but
must account for the overall legal protection afforded by the destination country.

For banks, client financial information qualifies as both personal data and financial data, making its cross-border processing subject to heightened compliance obligations.

Governance

In response to this complex regulatory landscape, commercial banks should embed data governance into their corporate governance and strategic management. They need to build a global compliance framework that spans the entire lifecycle of their business operations.

Reinforcing domestic data security foundations. Banks should build a data classification and tiered management system based on the Cybersecurity Law, Data Security Law, Personal Information Protection Law and financial regulatory rules.

Differentiated measures should be applied based on data sensitivity, business use and regulatory requirements. Data compliance reviews should be brought forward to the business design stage.

Enhancing the response framework for conflicts with overseas legal requirements. Banks should uphold international co-operation while resisting foreign requests for data that breach binding domestic rules. The following three steps can be taken.

1. Judicial assistance channels. Foreign agencies should be clearly informed that data should be obtained through mutual legal assistance treaties or regulatory co-ordination, and that domestic institutions should avoid providing it directly.
2. Joint evaluation and approval. On receiving a foreign request, banks should immediately assemble their legal, compliance and data security teams alongside external lawyers to evaluate the grounds for the request, the categories of data involved, and any legal conflicts. Approval must then be sought from the financial regulator and the cyberspace administration as required by law.
3. A country-specific strategy matrix. For the US, the emphasis should be on countering long-arm jurisdiction, pursuing judicial dialogue and managing sanctions exposure. For Europe, the emphasis should be on standard contractual clauses, binding corporate rules and transfer impact assessments.

Combining legal and technological measures. Banks should embed privacy-enhancing technologies – such as federated learning, privacy-preserving computation, and homomorphic encryption – into their data governance frameworks to limit the transfer of raw data across borders. This dual approach supports the expansion of financial services while maintaining robust data security.

Wang Chufan is a partner at Tahota Law Firm. She can be contacted by phone at +86 28 8662 5656 and by email at chufan.wang@tahota.com