New regulatory trends shaping compliance management

In recent years, tighter market regulation has thrust corporate compliance into the spotlight, leading to frequent penalties for regulatory breaches. In July, CTrip was hit with a combined fine and confiscation of about RMB5.2 billion (USD765 million) by the State Administration for Market Regulation for abusing its dominant market position. Around the same time, Alibaba’s overseas-facing e-commerce platform, AliExpress, was fined EUR550 million (USD629 million) by the EU for failing to effectively curb the dissemination of illegal goods.

These cases send a clear message. Costs for non-compliance are mounting, and compliance can no longer be considered an add-on value, but a non-negotiable imperative for corporate survival and a critical shield against personal liability for business operators.

Clock is ticking

Globally, compliance oversight in Europe and the US has expanded from data protection to areas such as supply chain due diligence, affecting Chinese companies along the chain. The EU’s 2024 directive on corporate sustainability due diligence extends compliance duties across upstream and downstream operations, requiring qualifying large enterprises to manage both internal risks and due diligence for partners across their entire “chain of activities”.

ZTE, a major Chinese telecoms and tech company, previously incurred record penalties from the US for compliance system failures and sanctions breaches, underscoring the steep cross-border costs of lax oversight under long-arm jurisdiction. For outbound Chinese companies, pleading ignorance offers no defence as compliance is now a mandatory “gate pass” for global competition.

Domestically, regulatory enforcement is intensifying alongside a dense rollout of compliance guidelines across anti-monopoly, data, tax and environmental sectors. With standards tightening, regulators care less about whether a company has the right policies on paper and more about whether they are effectively enforced.

Notably, there is also a sharper focus on personal accountability. For example, in the API (active pharmaceutical ingredient) monopoly case involving Tianjin Pharmaceuticals and three other drug makers, regulators penalised both the corporate organisers and key individual executives.

Additionally, the rollout of corporate compliance management systems is accelerating nationwide, driven by the expanding adoption of GB/T 35770-2022/ISO 37301 certifications. An increasing number of companies now leverage compliance certification as a mark of market-oriented and rule-based “soft power”. Clearly, whether at home or abroad, compliance requirements are tightening relentlessly, underscoring their critical importance.

Broadening coverage

Compliance requirements are implemented in all aspects of business operations.

Regulatory scope continues to expand. From an early focus on a few sectors like finance and state-owned assets, oversight has progressively broadened into areas like anti-monopoly, environmental protection, work safety and labour employment.

Liability subjects are broadening steadily. Compliance duties now fall on the shoulders of natural persons and business partners as well. With mechanisms in place that hold primarily responsible persons, in addition to the entities, accountable – legal representative or directly responsible personnel in monopoly cases, or directors and executives in securities violations – compliance can no longer be construed as a simple corporate matter. Meanwhile, supply chain due diligence rules extend these obligations to upstream and downstream partners.

Control measures are shifting upstream. Compliance has evolved from post-event reviews into a full-lifecycle preventive framework, deeply integrated into major business processes including strategic decision making, investment and financing, procurement and sales, and human resources management.

Wider scope of application. Market entities of all descriptions, including the vast array of micro, small and medium-sized enterprises, and platform-based merchants, are likewise brought within the scope of compliance oversight.

Differentiated approach

When it comes to building corporate compliance systems, there is hardly a one-size-fits-all template. Companies should look for their own most suitable path, which varies based on their businesses, ownership and stage of development.

Tailor priorities by core business. Platform companies should focus on anti-monopoly and data compliance; export-driven firms need to closely monitor export controls and economic sanctions; and pharmaceutical companies ought to prioritise anti-commercial bribery and advertising compliance.

Apply differentiated strategies based on corporate ownership. State-owned enterprises should base their efforts on the Measures for the Compliance Management of Central Enterprises, embedding compliance reviews into major decisions and aligning them with accountability rules for non-compliant investments and operations.

Private companies facing resource constraints should target vulnerabilities first to neutralise high-risk areas. Listed companies should treat disclosure, insider trading prevention and related party transaction controls as absolute top priorities.

Compliance efforts must be pragmatic and phased. Startups should adopt a “compliance by design” approach, identifying risk points during business model conception and scaling their frameworks step by step. Established companies should focus on fortifying high-priority areas within their existing structures and regularly auditing their effectiveness.

Avoid formalism

Many companies suffer from the issue of on-paper compliance when building their management systems, possessing superficial frameworks that lack real teeth, drafting exhaustive policy manuals that sit gathering dust, and creating a severe disconnect between formal systems and day to day operations.

To build an effective compliance management system, companies should focus on three priorities:

• Hold the “critical few” and frontline teams accountable. Top executives and business heads must take direct ownership of compliance, driving awareness top-down;
• Stay ahead of regulatory changes by continually updating internal policies to reflect new external rules; and
• Integrate compliance into daily operations by tying policy execution and compliance performance directly to departmental evaluations.

Wang Xuechen is a senior partner at Kangda Law Firm. He can be contacted by phone at +86 20 3739 2666 and by email at xuechen.wang@kangdalawyers.com