Online Lending Risks in China: A Compliance Guide for Investors and Borrowers

Between 2013 and 2018, peer-to-peer lending platforms grew from a niche experiment into a national phenomenon in China, promising retail investors double-digit returns while offering borrowers access to credit that banks would not extend. At its peak, the sector moved hundreds of billions of yuan through thousands of platforms, and then it collapsed just as quickly. Successive waves of rectification shut down the vast majority of P2P businesses, and the surviving lending activity was folded into a far more tightly regulated consumer finance industry. Yet the underlying legal risks that doomed those platforms did not disappear with them. They simply migrated into new forms — online micro-loans, cash loan products, joint lending arrangements, and app-based consumer credit — and they now sit on both sides of every lending relationship.

As a Hangzhou lawyer who advises consumer finance companies, online lending platforms, and individual borrowers alike, I regularly see the same misunderstandings on both sides of the transaction. Investors believe the platform is responsible for getting their money back; borrowers believe the platform's advertised interest rate is the whole cost of the loan; neither fully understands the criminal exposure that can attach to lending activity conducted without proper licences and controls. This article sets out the principal legal risks of online lending in China as they apply to investors and to borrowers, and explains the regulatory framework — from the Criminal Law to the four-times Loan Prime Rate interest cap and the Personal Information Protection Law — that now governs the space.

The Investor's Side: Unsupervised Funds and the Limits of Platform Responsibility#

The first risk facing an investor who puts money into an online lending platform is that the origin of the funds is subject to little or no supervision. In the classic P2P model, investors were effectively anonymous to one another, and the platform rarely conducted meaningful checks on where the money came from. Funds of suspicious provenance could enter the lending pool, which exposes the investor to the risk that the money becomes the subject of a fraud investigation, a freezing order, or a money-laundering inquiry long after it was committed to a loan. An investor who cannot document the lawful origin of his or her funds also faces practical difficulty in proving ownership in any subsequent legal proceeding.

The second, and far more common, risk is default: the borrower fails to repay principal and interest on time, and enforcement turns out to be very difficult. The critical legal point that many investors miss is that, in the P2P model, the platform acted only as an information intermediary — it matched borrowers and investors, provided financing information services, and assisted both sides in completing the transaction, but it was not a party to the loan contract and, absent an express guarantee, owed no repayment obligation to the investor. When the borrower defaults, the investor's remedy is a lawsuit against the borrower, not the platform. In practice this means litigating in the borrower's location, against a counterparty who may have disappeared or have no attachable assets, and waiting months or years for a judgment that may never be satisfied.

Pooled Funds: The Misappropriation Risk in the Gap#

The third investor risk is the safety of the funds that sit inside the platform before they are matched to a loan. In the unregulated era, investor money was often pooled in platform-controlled accounts, and there was a well-documented pattern of operators diverting these so-called settlement or float funds for their own purposes — to cover operating losses, to prop up other businesses, or simply to finance a lavish exit before the platform collapsed. When a platform ran off with the float, investors discovered that their money was not held in any segregated, supervised account and that the misappropriation might not even constitute embezzlement in the technical sense, because the funds had been transferred to the platform by voluntary payment.

This is precisely the gap that the regulatory framework now closes. The Interim Measures for the Administration of the Business Activities of Online Lending Information Intermediary Institutions, issued in August 2016, formally defined P2P platforms as information intermediaries and required customer funds to be deposited in segregated accounts with qualified banks. The subsequent rectification campaign of 2017 and 2018 made bank custody a condition of continued operation, and the 2017 Notice on Regulating and Rectifying the "Cash Loan" Business extended the same discipline to consumer cash-loan products, requiring licensed operation, prohibitions on absorbing public deposits, and the elimination of practices that pushed the true cost of credit beyond the legal ceiling.

The Borrower's Side: Criminal Exposure Under the Criminal Law#

Borrowers are exposed to risks of a very different order. The most serious is criminal liability. Under Article 176 of the Criminal Law of the People's Republic of China, whoever illegally absorbs or covertly absorbs public deposits is guilty of the crime of illegally absorbing public deposits, and where the amounts or the number of depositors are large, the penalty rises to up to ten years' imprisonment together with a fine. The judicial interpretation on illegal fundraising sets the threshold for prosecution at 200,000 yuan or more where the funds are absorbed by an individual, and 1 million yuan or more where they are absorbed by an entity. Borrowers can cross this line without ever intending to: an individual who raises funds from many acquaintances through an online platform, or a small company that crowdsources working capital from the public through a lending website, can easily find that the cumulative total has passed the threshold, and the courts routinely treat such conduct as an illegal absorption of public deposits even when every contributor was repaid.

Related exposure comes from the crime of establishing a financial institution without authorisation under Article 174 of the Criminal Law. Operating a lending business — collecting funds from the public and relending them, or providing credit services to the public on a commercial scale — is an activity reserved for licensed financial institutions, and a borrower-turned-lender who sets up any kind of lending operation without the required licence risks prosecution on this ground as well. My consistent advice to clients is that the line between aggressive fundraising and criminal fundraising is drawn by the law, not by intention, and that any scheme that collects money from the public through an unlicensed channel should be treated as presumptively unlawful.

Interest Rates, Priority Bidding, and the Four-Times LPR Ceiling#

The second borrower risk is the liberalisation of interest rates within the platform. In the P2P model, the final borrowing rate was not negotiated between the parties; it was determined by the platform's priority bidding rules, under which the loan was allocated to bids according to price priority and time priority — the highest rate and the earliest bid winning the allocation. A borrower in urgent need of funds could thus find the effective rate set far above anything a bank would charge, and could accept it without any real bargaining power.

The legal ceiling on that exposure is now firmly established. Under the Supreme People's Court's provisions on private lending, as revised with effect from January 1, 2021, the interest rate agreed between the parties is protected by the courts only up to four times the one-year Loan Prime Rate prevailing at the time the contract was made; any interest above that ceiling is not enforceable, and the borrower may refuse to pay it. The four-times LPR cap applies to the combined cost of the loan, and the 2017 cash-loan rectification notice made clear that all fees, service charges, and disguised interest collected by the platform count toward the same ceiling. Borrowers should therefore always calculate the all-in annualised cost of a loan — interest plus every fee — and compare it against four times the current one-year LPR, because that is the line the courts will actually enforce.

Financial Privacy: When the Platform Knows Everything#

The third borrower risk concerns financial privacy. To process a loan application, the platform and its cooperating guarantee institutions require the borrower to submit a large amount of personal information: identity documents, income and property details, employment records, contact lists, and frequently location data and facial recognition information. In the early years of the sector, this information was held by platforms whose security technology was often weak, and there were repeated incidents in which borrower databases were stolen or cracked, and in which personal financial information leaked onto the market — fuelling harassment collections, targeted fraud, and identity theft.

That environment has changed decisively. The Cybersecurity Law, the Data Security Law, and above all the Personal Information Protection Law, which took effect on November 1, 2021, now impose strict obligations on every organisation that processes personal information: collection must be limited to the minimum necessary for the stated purpose, consent must be freely given and informed, and the processor must implement security measures proportionate to the risk. Lending platforms must now design their data flows around these rules, and borrowers have express rights to access, correct, and delete their information. A platform that loses borrower data faces administrative penalties, civil liability, and potentially criminal liability for the individuals responsible, and the Hangzhou Internet Court — the world's first internet court — has become one of the leading venues in the country for precisely these disputes, which is a useful reminder that online lending is now a fully supervised, data-governed industry.

Practical Takeaways for Investors, Borrowers, and Platforms#

For investors, the core discipline is to verify the licence status of the platform, to understand in writing whether the platform guarantees repayment or merely matches borrowers, to confirm that funds are held in a segregated bank custody account, and to keep complete records of every deposit, loan contract, and repayment. An investor should assume that the platform is an intermediary and nothing more, and should treat any promised return above the four-times LPR ceiling as a warning sign of a scheme that the courts will not protect. For borrowers, the essentials are to read the full contract terms before signing, to calculate the all-in annualised cost against the LPR ceiling, to refuse to provide personal information beyond what the application genuinely requires, and to avoid any arrangement in which money is collected from the public without a licence — no matter how attractive the terms appear.

For platforms and licensed consumer finance companies, the compliance framework is now well defined: hold the correct licence for the activity actually carried out, keep customer funds in bank custody, disclose interest and fees in a way that cannot hide the true cost, enforce the four-times LPR ceiling in product design, and run data protection and collections practices that can survive regulatory inspection. The 2020 interim measures for the administration of online micro-loan business, issued for public comment in November of that year, point clearly in the same direction — tighter approval requirements for cross-province operations, caps on single-borrower exposure, co-funding requirements in joint lending, and restrictions on financing through asset securitisation.

Conclusion#

Online lending in China has completed its journey from a lightly regulated experiment to a supervised industry, but the legal risks that defined its turbulent decade remain fully present for those who ignore the framework. For the investor, the dangers are unsupervised fund origins, the false assumption of platform liability, and the vulnerability of pooled funds. For the borrower, they are criminal exposure under Article 176 of the Criminal Law, interest rates set by bidding rather than negotiation, and the loss of control over deeply personal financial information. Every one of these risks is now addressed by a specific rule: bank custody of customer funds, the intermediary-only definition of lending platforms, the four-times LPR ceiling, and the data protection regime of the Personal Information Protection Law.

My advice to anyone entering this market, on either side, is the same advice I give to the companies and individuals I represent in Hangzhou: treat the transaction as what it is — a regulated financial activity — and measure every platform, every contract, and every promised return against the rules described above before committing money, credit, or personal data. The framework is demanding, but it is also knowable, and the cost of ignoring it is measured not in fees but in lost capital, criminal liability, and irreparable damage to one's financial privacy.