Every time a consumer in China scans a QR code at a shop counter, tops up a prepaid card, or pays for an online order, a licensed payment institution is working invisibly in the background — moving the money, keeping the records, and carrying the regulatory obligations that make the transaction safe. What most users never see is the legal architecture underneath: a payment business licensing regime administered by the People's Bank of China, and a set of hard rules — above all the prohibition on touching customer reserve funds — that determine whether a payment business survives or collapses. This article explains how third-party payment works in China, how a Payment Business License is obtained, and where the compliance risks actually lie.
Every time a consumer in China scans a QR code at a shop counter, tops up a prepaid card, or pays for an online order, a licensed payment institution is working invisibly in the background — moving the money, keeping the records, and carrying the regulatory obligations that make the transaction safe. What most users never see is the legal architecture underneath: a payment business licensing regime administered by the People's Bank of China, and a set of hard rules — above all the prohibition on touching customer reserve funds — that determine whether a payment business survives or collapses. This article explains how third-party payment works in China, how a Payment Business License is obtained, and where the compliance risks actually lie.
As a lawyer in Shenzhen advising payment institutions and fintech companies, I have watched the industry mature from a lightly regulated space into one of the most tightly supervised sectors in Chinese finance. The regulatory framework rests on two pillars: entry control through licensing, and ongoing discipline through rules on customer reserve funds, anti-money laundering, and internal controls. Understanding those two pillars is the difference between building a durable payment business and building one that the regulator will eventually shut down.
Background & legal framework
What Is Third-Party Payment?
Third-party payment refers to a network payment model in which an independent institution — one with sufficient financial strength and credit standing — signs agreements with banks and connects its own systems to the banks' payment and settlement interfaces, thereby facilitating transactions between two parties who may never deal with each other directly. The institution sits between buyer and seller: it receives the buyer's payment, holds it briefly, and releases it to the seller according to the agreed settlement cycle. Because the institution is not a bank, it cannot accept deposits in the banking sense; it is a non-financial institution providing payment services under the supervision of the People's Bank of China.
The scope of licensed payment business in China is commonly divided into three categories. The first is online payment, covering the virtual accounts and payment channels that power e-commerce and mobile payments. The second is prepaid card issuance and acceptance — the stored-value cards issued by retailers and commercial institutions for use within defined merchant networks. The third is bank card acquiring, the business of signing up merchants, processing card transactions, and settling funds to them on behalf of the card schemes. Each category carries its own operating rules, and each touches customer money that the institution never owns.
The Payment Business License: Application Requirements and the Road to Entry
Under the Administrative Measures for the Payment Services of Non-Financial Institutions, promulgated by the People's Bank of China and effective from 1 September 2010, no institution may engage in payment services without first obtaining a Payment Business License issued by the central bank. Operating without a license is unlawful, exposes the operator to supervisory penalties and confiscation of illegal gains, and leaves its merchants and consumers without any of the protections the licensing regime is designed to provide.
The application conditions are demanding by design. An applicant must be a legal person domiciled in China with paid-in registered capital of at least RMB 100 million if it intends to operate nationwide, or at least RMB 30 million if it will operate within a single province or equivalent region. It must employ at least five senior managers with verifiable payment business experience, and a meaningful proportion of its staff must have relevant industry background. It must have payment business facilities and security safeguards that meet the regulatory standards, a sound organisational structure, complete internal control systems, and risk management measures, and it must have in place anti-money-laundering measures that satisfy the requirements of the central bank. A record of serious violations in the preceding years is disqualifying.
How the dispute was handled
One practical point is often misunderstood: the license, once obtained, is not the end of the regulatory relationship but the beginning. Licensees face ongoing supervision, annual reporting obligations, renewal requirements, and filing obligations for changes in shareholding, senior management, and business scope. And since around 2016, the central bank has in practice stopped approving new licenses, which means the main route into the market for new entrants is the acquisition of an existing licensed entity. That makes due diligence on the target's compliance history critical — regulatory problems attached to a license do not disappear when ownership changes; they transfer to the new controlling shareholder.
Customer Reserve Funds: The Red Line That Cannot Be Crossed
The single most important rule in the entire payments framework concerns customer reserve funds. Reserve funds are the money a payment institution receives from customers but has not yet settled to merchants or refunded — the gap between payment and settlement in which the institution temporarily holds other people's money. The Administrative Measures are explicit: reserve funds accepted by a payment institution are not the institution's own property. The institution may transfer such funds only on the basis of payment instructions initiated by customers, and it is prohibited from misappropriating customer reserve funds in any form whatsoever.
This is a red line in the truest sense. A payment institution may not use reserve funds for its own working capital, lend them out, invest them, or apply them against its own debts — even if the institution fully intends to repay, even if no customer ultimately loses money. The prohibition is structural, not outcome-based. The supporting custody rules, set out in the Measures for the Custody of Customer Reserve Funds of Payment Institutions, require reserve funds to be deposited with custodian banks and kept strictly separate from the institution's own funds, with the custodian supervising movements in and out of the accounts. In recent years the regime has tightened further, with reserve funds moved toward centralised deposit under the central bank's own control, so that even the custody structure itself is no longer left to the discretion of individual institutions.
When the Red Line Is Crossed: A Cautionary Case
The reason the reserve fund rule is enforced with such severity is that its breach has historically produced real damage, not hypothetical risk. Consider a case that is instructive across the industry: a payment institution engaged in serious operational violations that triggered a funding crisis. Because the institution had compromised its handling of customer funds and other aspects of its operations, it ran into cash-flow problems and could no longer settle funds to its contracted merchants on time. Ordinary cardholders and prepaid card users found their normal consumption disrupted, merchants found their receivables frozen, and the institution's business ground to a halt. The People's Bank of China confirmed that the institution's serious operational violations had caused the funding difficulties and intervened.
Practical implications
What followed illustrates the full cost of crossing the line. The institution faced regulatory investigation, orders to rectify, and penalties; its ability to restore settlement was fatally undermined by the loss of trust; and ultimately its payment license was revoked, ending the business altogether. The consequences also reach individuals: the legal representatives and directly responsible personnel of a violating institution can face fines and personal supervisory penalties, and where misappropriation of customer funds crosses into criminal conduct, the persons involved may face criminal liability under the Criminal Law of the People's Republic of China, which treats the unlawful use of other people's funds with particular gravity.
Building a Compliance Posture That Survives Supervision
For licensed institutions, compliance is not a department; it is a discipline that runs through every part of the operation. The first layer is anti-money laundering. Under the Anti-Money Laundering Law of the People's Republic of China and the implementing rules of the central bank, payment institutions must carry out customer due diligence, identify the true parties behind accounts and merchants, monitor transactions for unusual patterns, keep complete records for the prescribed periods, and report large-value and suspicious transactions to the authorities. Payment systems, because they move money quickly and in high volumes, are among the channels most exposed to money laundering, and the regulator expects institutions to treat this exposure seriously.
The second layer is internal control over customer funds. A compliant institution maintains a strict separation between its own funds and customer reserve funds, reconciles reserve fund balances on a rigorous schedule, restricts the personnel who can initiate settlement, and subjects fund movements to independent review. The third layer is merchant management: special merchants must be vetted before they are signed, their transaction patterns monitored after they are onboarded, and merchants whose businesses change character — or whose transactions show signs of fraud, money laundering, or regulatory arbitrage — must be reviewed and, where necessary, exited. The fourth layer is supervisory engagement: respond to inspections, file on time, and treat a query from the People's Bank of China's local branch as an invitation to demonstrate compliance rather than an inconvenience to be managed.
For applicants and acquirers, the same discipline applies in advance. Prepare the application documentation as if it will be read by the most sceptical examiner in the country — because it will be. Verify the compliance history of any licensed entity you propose to acquire, and audit its reserve fund handling before signing, not after. A license acquired cheaply because of compliance defects is not an asset; it is a liability with a supervisory clock attached.
Conclusion
China's payment industry is one of the most dynamic in the world, but its dynamism exists inside a regulatory framework that has become stricter with every passing year. The two rules that matter most have not changed in substance: you need a Payment Business License to do the business, and you must never treat customer reserve funds as your own money. The central bank has consistently shown that it will enforce these rules seriously, punish violations strictly, maintain orderly market conduct — including in the prepaid card market — and protect the legitimate rights and interests of consumers. Institutions that internalise this reality, build genuine compliance programmes, and operate with self-discipline are the ones that endure; those that treat the rules as optional discover that in payments, the regulator always settles the account.
