Investigating Employee Kickbacks in China

A whistleblower reports that a procurement manager at a Suzhou factory has been receiving payments from a vendor. Headquarters wants to image the employee's laptop, collect email and WeChat, interview the vendor, review bank transfers and dismiss the employee immediately.

The allegation may involve commercial bribery, employee misconduct, conflicts of interest and possibly criminal conduct.

But the investigation itself creates legal risk.

The issue#

The company must comply with the Personal Information Protection Law, the revised Anti-Unfair Competition Law, employment rules and evidence requirements.

The specific issue is: how should a multinational investigate suspected kickbacks so that evidence remains useful and the company does not create a second legal problem through excessive data collection or defective dismissal procedure?

1. Define the allegation#

Do not start with all employee data.

Define:

• vendor;
• employee;
• period;
• suspected payment;
• decision affected.

This supports necessity.

2. Anti-Unfair Competition Law#

The 2025 revised Anti-Unfair Competition Law addresses commercial bribery and attributes employee bribery to the business unless evidence shows the conduct was unrelated to obtaining transaction opportunity or competitive advantage.^[1]

The company should determine whether conduct:

• benefited employee only;
• benefited company;
• affected procurement.

3. Preserve evidence early#

Before interview:

• email;
• procurement approvals;
• vendor master;
• invoices;
• contracts;
• access logs.

Do not tip off subject prematurely.

4. PIPL applies to investigations#

Employee personal information remains protected.^[2]

The employer should identify legal basis and comply with:

• purpose limitation;
• necessity;
• minimization;
• security.

5. Do not search everything#

Collect only data relevant to allegation.

Avoid:

• unrelated health data;
• family communications;
• entire history.

Use keywords and custodians.

6. Sensitive personal information#

Bank data, biometric or other sensitive information can require heightened protection.^[2]

The team should document necessity.

7. Company device does not eliminate privacy law#

Ownership of laptop does not mean unlimited personal information processing.

Policies should tell employees about monitoring and investigations.

8. Messaging evidence#

If business uses WeChat:

• collect lawfully;
• preserve context;
• authenticate.

Screenshots alone can be weak.

9. Vendor evidence#

Review:

• beneficial ownership;
• bank account;
• pricing;
• bid history;
• related employees.

10. Conflict check#

Investigate whether procurement employee has:

• family ownership;
• side company;
• financial relationship.

11. Interview order#

Usually:

• neutral witnesses;
• data custodians;
• vendor;
• subject.

This reduces evidence contamination.

12. Interview protocol#

Record:

• attendees;
• questions;
• documents shown;
• answers.

Do not coerce confession.

13. Headquarters reporting#

If investigation data goes overseas, assess cross-border transfer rules.

The 2024 CAC rules provide exemptions for certain HR transfers, but an investigation should still be classified carefully.^[3]

14. Do not assume HR exemption applies to all investigative data#

The exemption for cross-border HR management is not a blank exemption for unrelated personal information.

Assess purpose and data.

15. Use China data room#

Where possible, overseas teams can review through controlled access rather than bulk export.

16. Employment rules determine dismissal#

Even if misconduct occurred, dismissal should connect to:

• valid company rule;
• evidence;
• procedure.

The employer should confirm the handbook was validly adopted.

17. Serious violation#

Labor Contract Law provides bases for termination where an employee seriously violates employer rules or commits serious dereliction causing major harm, among other grounds.^[4]

The facts must support the ground.

18. Do not dismiss on suspicion#

A whistleblower allegation alone is insufficient.

Complete fact finding.

19. Senior management cases#

If subject is GM:

• board authority;
• corporate office;
• legal representative;
• chop control.

Employment and governance actions must align.

20. Internal investigation privilege expectations#

Global companies should not assume China investigation communications receive the same privilege treatment as in other jurisdictions.

Structure carefully.

21. Criminal referral#

If facts suggest embezzlement or bribery, assess referral.

Preserve forensic evidence.

Do not threaten criminal action as leverage.

22. Vendor termination#

The company may have contractual remedies.

Review:

• anti-bribery warranties;
• audit rights;
• termination.

23. Self-reporting#

Assess whether regulator notification is required or strategically appropriate.

This depends on facts and industry.

24. Root cause analysis#

After substantiation:

• approval gap;
• vendor concentration;
• segregation of duties;
• gifts.

25. Remediation#

Implement:

• vendor due diligence;
• conflict declarations;
• approval thresholds;
• hotline.

26. Case study#

Procurement manager directs orders to vendor owned by relative.

Evidence:

• corporate registry;
• messages;
• pricing premium;
• payments.

Investigation should connect: relationship -> decision -> benefit.

27. Data retention#

Preserve only as long as necessary, subject to legal needs.

Maintain investigation file securely.

28. Cross-border counsel#

If overseas headquarters is involved, define roles.

Avoid uncontrolled forwarding.

29. Audit committee reporting#

Significant matters may require board/audit reporting.

Use factual, privileged where applicable, concise reporting.

30. Investigation charter#

Before collection:

• scope;
• team;
• data;
• authority;
• reporting.

31. Employee representation#

Decide whether employee may have counsel or representative in interview based on policy and context.

32. Consistency#

Apply discipline consistently across comparable misconduct.

33. Whistleblower protection#

Prevent retaliation.

Limit identity disclosure.

34. Evidence matrix#

For each allegation list:

• source;
• corroboration;

35. Decision standard#

Separate:

• substantiated;
• unsubstantiated;
• inconclusive.

Do not overstate.

36. Termination memo#

Explain:

• rule violated;
• evidence;
• seriousness;

37. Communications#

Do not publicly accuse employee.

Internal messaging should protect confidentiality.

38. Final rule#

The company should be able to answer:

why was each piece of personal information collected and how did it relate to the allegation?

If not, the investigation was too broad.

Additional implementation detail: investigation data matrix#

Before collection, create a matrix listing each data source, custodian, allegation connection, legal basis, sensitivity and retention period. This forces the team to justify why it needs each source. If headquarters asks for entire mailboxes, the China team can explain which targeted collection is sufficient.

For messaging data, preserve metadata and context where available. A screenshot of one sentence may be misleading. Investigators should seek the surrounding conversation and corroborating procurement records.

Additional implementation detail: vendor-corruption analysis#

A suspected kickback investigation should compare commercial outcomes before and after the employee's influence. Review pricing, bid competition, quality, payment terms, vendor concentration and exception approvals. This helps distinguish a private personal relationship from conduct that affected business decisions.

If the vendor is owned by a relative or nominee, beneficial ownership evidence should be preserved from authoritative sources and internal onboarding records.

Additional implementation detail: disciplinary consistency#

Before dismissal, HR should compare prior disciplinary cases. If similar conduct previously resulted in warnings rather than termination, explain why the present case is more serious. Consistency helps defend the decision.

The termination memo should separate substantiated facts from suspicions. It should cite the specific internal rule and evidence. Investigation conclusions should not use criminal labels unless supported by proper process.

Additional implementation detail: remediation report#

The final report should include both individual responsibility and control failures. A useful report answers what happened, why existing controls failed, financial impact, employment response, vendor response, data/privacy issues and remediation owners.

This turns the investigation into a compliance improvement rather than a one-time disciplinary event.

Conclusion#

An internal bribery investigation must comply with both substantive anti-bribery rules and data/employment law.

The 2025 Anti-Unfair Competition Law, PIPL and Labor Contract Law should be treated as one investigation framework.

The key principle is:

collect narrowly, preserve rigorously, decide discipline only after evidence is tested.

Operational appendix: implementation controls#

This issue should be managed through a written project tracker rather than informal email. For each legal requirement, assign an owner, evidence file, deadline, decision status and escalation trigger. Management should distinguish legal requirements, commercial preferences and unresolved factual assumptions. That distinction reduces the risk that a business assumption is later treated as a legal conclusion.

The legal file should preserve the facts supporting each decision. If the company relies on an exemption, transfer mechanism, termination basis, ownership position or contractual remedy, retain the documents and analysis showing why. A later dispute or regulatory review often turns on evidence of what the company knew and how it reached the decision.

Before implementation, counsel should conduct a final consistency review across corporate documents, employment records, contracts, data systems and external communications. Many failures occur because separate workstreams use inconsistent dates, entities or descriptions. One master chronology and one controlled document set should be used.

After implementation, schedule a post-completion audit. Confirm that registrations, payments, system access, notices, records and contractual actions were actually completed. Legal projects fail when signed documents do not become operational reality.

Legal sources#

^[1] Anti-Unfair Competition Law (2025 Revision): https://www.npc.gov.cn/npc/c2/c30834/202506/t20250627_446247.html ^[2] Personal Information Protection Law: https://www.npc.gov.cn/npc/c2/c30834/202108/t20210820_313088.html ^[3] CAC Cross-Border Data Provisions: https://www.cac.gov.cn/2024-03/22/c_1712776611775634.htm ^[4] Labor Contract Law: https://flk.npc.gov.cn/