Online Lending Risks in China: A Compliance Guide for Investors and Borrowers

China's online-lending market has moved from the largely unregulated peer-to-peer model of the 2010s into a framework centered on licensed lenders, regulated bank internet loans and supervised cooperation with loan-facilitation platforms. The failures of the earlier P2P market remain useful warnings, but the legal analysis now begins by identifying the actual lender, the platform's role, the applicable licence and the flow of funds, fees and borrower data.

Current through 19 September 2026. The National Financial Regulatory Administration's notice on commercial-bank internet-loan facilitation took effect on 1 October 2025. It supplements the existing internet-loan framework and requires banks to strengthen head-office control, partner access, pricing and cost management, independent risk control and financial-consumer protection. Its scope is commercial-bank loan facilitation; other online-credit models may be governed by different licensing and judicial rules.

Current Framework: Identify the Lender and the Facilitation Model#

The first current-law question is not whether an app calls itself a platform, marketplace or technology provider. Identify the entity extending credit, whether it is licensed, whether a commercial bank is using a loan-facilitation partner, which party performs marketing and risk-control functions, and how fees and credit-enhancement arrangements are allocated. The 2025 NFRA notice places responsibility on commercial banks for centralized management, partner admission, reasonable pricing, independent risk control and consumer protection in internet-loan facilitation.

That notice took effect on 1 October 2025 and continues, rather than replaces, the existing commercial-bank internet-loan regime. It should not be treated as a universal rule for every form of private lending, micro-lending or consumer finance. The correct framework depends on the legal identity and licence of the lender and each cooperating institution.

The Investor's Side: Unsupervised Funds and the Limits of Platform Responsibility#

The first risk facing an investor who puts money into an online lending platform is that the origin of the funds is subject to little or no supervision. In the classic P2P model, investors were effectively anonymous to one another, and the platform rarely conducted meaningful checks on where the money came from. Funds of suspicious provenance could enter the lending pool, which exposes the investor to the risk that the money becomes the subject of a fraud investigation, a freezing order, or a money-laundering inquiry long after it was committed to a loan. An investor who cannot document the lawful origin of his or her funds also faces practical difficulty in proving ownership in any subsequent legal proceeding.

The second, and far more common, risk is default: the borrower fails to repay principal and interest on time, and enforcement turns out to be very difficult. The critical legal point that many investors miss is that, in the P2P model, the platform acted only as an information intermediary — it matched borrowers and investors, provided financing information services, and assisted both sides in completing the transaction, but it was not a party to the loan contract and, absent an express guarantee, owed no repayment obligation to the investor. When the borrower defaults, the investor's remedy is a lawsuit against the borrower, not the platform. In practice this means litigating in the borrower's location, against a counterparty who may have disappeared or have no attachable assets, and waiting months or years for a judgment that may never be satisfied.

Pooled Funds: The Misappropriation Risk in the Gap#

The third investor risk is the safety of the funds that sit inside the platform before they are matched to a loan. In the unregulated era, investor money was often pooled in platform-controlled accounts, and there was a well-documented pattern of operators diverting these so-called settlement or float funds for their own purposes — to cover operating losses, to prop up other businesses, or simply to finance a lavish exit before the platform collapsed. When a platform ran off with the float, investors discovered that their money was not held in any segregated, supervised account and that the misappropriation might not even constitute embezzlement in the technical sense, because the funds had been transferred to the platform by voluntary payment.

This is precisely the gap that the regulatory framework now closes. The Interim Measures for the Administration of the Business Activities of Online Lending Information Intermediary Institutions, issued in August 2016, formally defined P2P platforms as information intermediaries and required customer funds to be deposited in segregated accounts with qualified banks. The subsequent rectification campaign of 2017 and 2018 made bank custody a condition of continued operation, and the 2017 Notice on Regulating and Rectifying the "Cash Loan" Business extended the same discipline to consumer cash-loan products, requiring licensed operation, prohibitions on absorbing public deposits, and the elimination of practices that pushed the true cost of credit beyond the legal ceiling.

The Borrower's Side: Criminal Exposure Under the Criminal Law#

Borrowers are exposed to risks of a very different order. The most serious is criminal liability. Under Article 176 of the Criminal Law of the People's Republic of China, whoever illegally absorbs or covertly absorbs public deposits is guilty of the crime of illegally absorbing public deposits, and where the amounts or the number of depositors are large, the penalty rises to up to ten years' imprisonment together with a fine. The judicial interpretation on illegal fundraising sets the threshold for prosecution at 200,000 yuan or more where the funds are absorbed by an individual, and 1 million yuan or more where they are absorbed by an entity. Borrowers can cross this line without ever intending to: an individual who raises funds from many acquaintances through an online platform, or a small company that crowdsources working capital from the public through a lending website, can easily find that the cumulative total has passed the threshold, and the courts routinely treat such conduct as an illegal absorption of public deposits even when every contributor was repaid.

Related exposure comes from the crime of establishing a financial institution without authorisation under Article 174 of the Criminal Law. Operating a lending business — collecting funds from the public and relending them, or providing credit services to the public on a commercial scale — is an activity reserved for licensed financial institutions, and a borrower-turned-lender who sets up any kind of lending operation without the required licence risks prosecution on this ground as well. My consistent advice to clients is that the line between aggressive fundraising and criminal fundraising is drawn by the law, not by intention, and that any scheme that collects money from the public through an unlicensed channel should be treated as presumptively unlawful.

Interest Rates, Priority Bidding, and the Four-Times LPR Ceiling#

The second borrower risk is the liberalisation of interest rates within the platform. In the P2P model, the final borrowing rate was not negotiated between the parties; it was determined by the platform's priority bidding rules, under which the loan was allocated to bids according to price priority and time priority — the highest rate and the earliest bid winning the allocation. A borrower in urgent need of funds could thus find the effective rate set far above anything a bank would charge, and could accept it without any real bargaining power.

Interest and fee analysis depends on the lender and the legal relationship. The Supreme People's Court's private-lending rules use four times the one-year Loan Prime Rate at contract formation as the judicial-protection ceiling for private lending, but those rules expressly exclude lending disputes involving financial institutions approved by financial regulators. Do not apply the four-times-LPR formula automatically to a bank, licensed consumer-finance company, micro-loan company or other regulated lender. For every product, identify the lender and then review the applicable regulatory pricing, disclosure, consumer-protection and judicial rules, including all platform or service fees.

Financial Privacy: When the Platform Knows Everything#

The third borrower risk concerns financial privacy. To process a loan application, the platform and its cooperating guarantee institutions require the borrower to submit a large amount of personal information: identity documents, income and property details, employment records, contact lists, and frequently location data and facial recognition information. In the early years of the sector, this information was held by platforms whose security technology was often weak, and there were repeated incidents in which borrower databases were stolen or cracked, and in which personal financial information leaked onto the market — fuelling harassment collections, targeted fraud, and identity theft.

That environment has changed decisively. The Cybersecurity Law, the Data Security Law, and above all the Personal Information Protection Law, which took effect on November 1, 2021, now impose strict obligations on every organisation that processes personal information: collection must be limited to the minimum necessary for the stated purpose, consent must be freely given and informed, and the processor must implement security measures proportionate to the risk. Lending platforms must now design their data flows around these rules, and borrowers have express rights to access, correct, and delete their information. A platform that loses borrower data faces administrative penalties, civil liability, and potentially criminal liability for the individuals responsible, and the Hangzhou Internet Court — the world's first internet court — has become one of the leading venues in the country for precisely these disputes, which is a useful reminder that online lending is now a fully supervised, data-governed industry.

Practical Takeaways for Investors, Borrowers, and Platforms#

For investors, the core discipline is to verify the licence status of the platform, to understand in writing whether the platform guarantees repayment or merely matches borrowers, to confirm that funds are held in a segregated bank custody account, and to keep complete records of every deposit, loan contract, and repayment. An investor should assume that the platform is an intermediary and nothing more, and should treat unusually high promised returns, opaque fees or unclear credit support as warning signs requiring legal and financial due diligence. For borrowers, the essentials are to read the full contract terms before signing, to calculate the all-in annualised cost and identify the pricing rules applicable to the actual lender, to refuse to provide personal information beyond what the application genuinely requires, and to avoid any arrangement in which money is collected from the public without a licence — no matter how attractive the terms appear.

For banks and loan-facilitation partners, the 2025 notice makes governance of the cooperation model central: the bank must maintain effective head-office management, use appropriate partner-entry standards, keep risk pricing and business scale reasonable, preserve independent risk control and protect financial consumers. Other lenders and platforms must separately confirm the licence, funding, geographic, data, collection, disclosure and pricing rules applicable to their own model.

Primary Sources#

• NFRA notice on strengthening the management of commercial-bank internet-loan facilitation — effective 1 October 2025.
• Supreme People's Court decision amending the private-lending judicial interpretation — including the scope exclusion for regulated financial institutions.

Conclusion#

Online lending in China is no longer one legal category. A current review distinguishes historical P2P activity, private lending, licensed micro-lending and consumer finance, commercial-bank internet loans, and third-party loan facilitation. The lender's identity, the platform's actual functions, the movement of funds and fees, and the handling of borrower data determine which rules apply.

My advice to anyone entering this market, on either side, is the same advice I give to the companies and individuals I represent in Hangzhou: treat the transaction as what it is — a regulated financial activity — and measure every platform, every contract, and every promised return against the rules described above before committing money, credit, or personal data. The framework is demanding, but it is also knowable, and the cost of ignoring it is measured not in fees but in lost capital, criminal liability, and irreparable damage to one's financial privacy.