How to do due diligence on a Chinese company: obtaining business registration, ownership and court data, and the compliance boundaries

Before doing business with a Chinese company, credit, procurement, investment and compliance teams all need to answer the same questions: is the counterparty's registration genuine, who controls it, and does it have any litigation or dishonesty records? Public company data in China is spread across several official systems, names are registered in Simplified Chinese, beneficial owner information is not disclosed, and obtaining the data and using it across borders each have their own legal boundaries. This article covers the official sources and limitations of the four data categories, how to match names and look through ownership, and the access channels and compliance considerations.

Why checking a Chinese company differs from checking a Taiwanese company

Checking a Chinese company means cross-checking company registration, court and enforcement, and credit disclosure sources separately, and dealing with four layers of gaps.

The first layer is fragmentation. Registration, shareholder and administrative penalty data is disclosed through the market regulation system, judgments and enforcement records are published by the court system, and cross-agency credit information is compiled on yet another website. Each system has its own search method and fields, so you have to query them one by one and reconcile the results yourself.

The second layer is names. A Chinese company's legal name is the name registered in Simplified Chinese; English names are not registered in the publicity system. If all you have is the English name on a contract, you first need to find the correct registered Chinese entity, or you may end up checking a different company.

The third layer is beneficial ownership. China introduced a beneficial owner information filing regime on November 1, 2024, but that information is obtained only by the relevant state authorities in accordance with the law, or queried through the People's Bank of China by financial institutions and designated non-financial institutions fulfilling anti-money laundering obligations. It is not open to the public. Overseas buyers and investors cannot query the filed information directly; they should first check the public disclosures that are available and, where those fall short, work it out from registration data.

The fourth layer is changing availability. The scope of some public data shifts with policy, and the rules for publishing court judgments online are one example. In 2023, the China offices of several foreign due diligence and consulting firms were also investigated by the authorities, so the legal risk of conducting commercial investigations inside China needs to be part of the assessment.

Four data categories and their official public sources

The core data for Chinese company due diligence falls into four categories. The table below lists the official source for each, what it shows, and the limitations to keep in mind when using it.

Business registration and shareholders: the National Enterprise Credit Information Publicity System

The National Enterprise Credit Information Publicity System, overseen by the State Administration for Market Regulation, is the official gateway for Chinese company registration information. Depending on the company type and what is actually disclosed, it shows the Unified Social Credit Code (USCC), registration status, legal representative, registered capital, business scope, shareholders or promoters and their contributions, key personnel, change history and annual reports. Two points need care: the shareholder field lists shareholders of record, not the ultimate controller, and missing fields cannot be taken to mean the record is complete; annual reports are filled in by the company itself, so they are company statements, not conclusions reached by the regulator.

Ownership look-through and actual controller: check public disclosures first, then trace layer by layer

The Measures for the Administration of Beneficial Owner Information, issued by the People's Bank of China and the State Administration for Market Regulation, took effect on November 1, 2024. In principle they require companies, partnerships and branches of foreign companies to file beneficial owner information, while small entities meeting certain conditions may give an undertaking in lieu of filing; entities registered before the effective date that must file were required to do so by November 1, 2025. The general identification criteria cover natural persons who directly or indirectly ultimately own 25% or more of the equity, shares or partnership interests, hold 25% or more of the income or voting rights, or alone or jointly exercise actual control over the entity; separate filing rules apply to managers and certain entities. However, the Measures state that this information is obtained only by the relevant state authorities in accordance with the law, and queried through the People's Bank of China by financial institutions and designated non-financial institutions fulfilling anti-money laundering obligations, and must be kept confidential. For overseas reviewers, the approach is to first check available public disclosures such as listed company annual reports and published judgments, and where those fall short, trace ownership layer by layer from shareholder data in the publicity system and other indicators of control.

Litigation and dishonesty records: China Judgements Online and the China Enforcement Information Public Website

China Judgements Online went live on July 1, 2013 and publishes effective judgments that courts at all levels have posted online. It can be used to look up contract, labor, lending and other disputes a company has been involved in. The China Enforcement Information Public Website publishes enforcement information on judgment debtors, dishonest judgment debtors and consumption restrictions, which is particularly useful for judging whether a company has unfulfilled judgment obligations.

The scope of judgment publication has changed in recent years, so read it conservatively. In December 2023, media reported that the Supreme People's Court had built a national court judgment database searchable only on the courts' internal network, and that some courts were posting fewer judgments online; at a press conference in February 2024, the Supreme People's Court said that online publication of judgments would only be strengthened, while the rules for anonymization would be improved. The practical conclusion: finding no judgment on China Judgements Online cannot be read as meaning the counterparty has no litigation. It can only be recorded as not found in that source.

Administrative penalties and abnormal operations: the publicity system and Credit China

The publicity system also maintains two lists directly relevant to risk. The List of Enterprises with Abnormal Operations records situations such as failing to submit annual reports on time or being unreachable at the registered address. Under the new administrative measures effective July 15, 2026, the List of Seriously Illegal and Dishonest Entities covers parties that have violated laws or administrative regulations in a way that is egregious in nature, serious in circumstance and of considerable social harm, and have received heavier administrative penalties from market regulators, or that meet other statutory criteria for listing. The lists show the reason and date of listing. The Credit China website compiles cross-agency administrative licensing and penalty disclosures and can supplement penalty records from outside market regulation. Since 2025, the State Administration for Market Regulation no longer discloses listing information for companies that have been removed from the List of Enterprises with Abnormal Operations. You can keep the result as of the time of your search and note the search date, but it only reflects past status and must be re-checked at each review.

Name matching: use the Unified Social Credit Code as the primary key

The Unified Social Credit Code is assigned under national standard GB 32100-2015 and consists of 18 digits or uppercase letters: the 1st is the registration authority code, the 2nd is the entity type code, the 3rd to 8th are the administrative division code of the registration authority, the 9th to 17th are the entity identifier, and the 18th is a check digit. Every record in a due diligence file should be keyed to this code, not to the name.

Name matching has to handle four situations: identical or similar names, since companies in different regions may share the same trade name; short names, which may correspond to several companies within a group; English names, since the same company may be translated in several ways; and former names, where names on old contracts and old judgments need to be linked back to the same code through the change history.

We recommend first asking the counterparty for a copy of its business license or its Unified Social Credit Code, then verifying the name, legal representative and registered address in the publicity system. If the counterparty can only provide an English name, cross-check candidate entities against fields such as address, legal representative and business scope, and record the basis for the match in the review file. Do not conclude a match on name similarity alone.

Where ownership tracing gets stuck

Ownership tracing starts from the target company's registered shareholders. Whenever a shareholder is itself a legal entity, you look up that entity's shareholders, and keep going up until you reach a natural person, a listed company, a state-owned investor, or a node that cannot be traced any further. The actual controller derived this way is a judgment based on the registered capital contributions and known control relationships at each layer; capital contribution ratios are not the same as voting rights or control. The review record should mark it as derived from registry data, and list the derivation path and the data date for each layer.

The following three situations will stop the derivation partway.

Offshore holding companies: when an upstream shareholder is a company incorporated in Hong Kong, the Cayman Islands, the British Virgin Islands or similar jurisdictions, China's publicity system cannot show the next layer up. Registry disclosure varies by jurisdiction, and some do not disclose shareholder information at all. In that case, record the data as unavailable and fill the gap by asking the counterparty for an ownership structure declaration or its offshore registration documents.

VIE structures: under a variable interest entity structure, the offshore listed or holding entity does not hold equity in the onshore operating company, but obtains control and economic benefits through contracts. The publicity system does not show contractual control relationships, so the structure has to be reconstructed from the disclosures in the listed company's prospectus or annual report.

Nominee shareholding: the registered shareholder is only a nominal holder, and the real investor is someone else. The registered shareholder field alone cannot confirm whether a nominee arrangement exists. Where something like a public court judgment clearly discloses it, that can be checked separately; otherwise, only record it as a lead to follow up. For example, the same natural person appearing as a shareholder in a large number of unrelated companies is not, on its own, grounds to conclude that a nominee arrangement exists.

Comparing sourcing channels

In practice there are four ways to obtain Chinese company data, each suited to a different query volume and delivery format.

When choosing, start with two questions: how many companies you need to check each year, and whether the results go to a person to read or to a system to decide on. If volumes are small and the data you need is obtainable, searching the official websites yourself and organizing the results manually may be enough; if you need to periodically re-review a large number of suppliers or customers, consider feeding an API or bulk data into your existing review process. Whichever you choose, require the data provider to explain its sources, how the data was obtained and the data dates, and keep query logs for audit.

Legal Boundaries: What You Can and Cannot Do

The legal risk lies not only in whether the data can be used, but in how it is obtained. How the boundaries below apply in a given case is for the buyer's legal team or outside counsel to decide.

First, use only public sources and lawfully licensed data. Keep the scope to official public registry data, published court and enforcement information, and commercial data the provider is lawfully licensed to supply. Do not carry out on-site investigations, interview insiders, obtain non-public information by any means, or try to get around a website's verification checks or access restrictions.

Second, be aware of the Counter-Espionage Law as revised in 2023. The revision was adopted on April 26, 2023 and took effect on July 1, 2023. In the same year, the China offices of several foreign due diligence and consulting firms were searched or visited by the authorities (see the Radio Free Asia report). How and how far company information is gathered therefore needs careful assessment, and should be limited to public data.

Third, transferring the data out of China may engage China's cross-border data rules. The Measures for Security Assessment of Outbound Data Transfers took effect on September 1, 2022, and the Cyberspace Administration of China published the Provisions on Promoting and Regulating Cross-Border Data Flows on March 22, 2024, effective the same day, which adjusted when those rules apply. If due diligence data is processed by an entity in China and then provided abroad, these rules may apply; the buyer's legal team should assess this.

Fourth, information about individuals is personal information. Names and positions of legal representatives, shareholders, directors, supervisors and senior managers remain personal information even when shown in the public registry. China's Personal Information Protection Law, in force since November 1, 2021, limits the processing of already-public personal information to a reasonable scope, and the buyer's legal team should also confirm whether data protection laws in its own or other jurisdictions apply. The purpose, retention period and access rights all need a clear basis, and personal data no longer needed should be deleted under your policy once the review ends.

When dealing with Chinese companies, we also recommend screening the counterparty, its known shareholders and its related entities against the U.S. Treasury OFAC SDN List, the U.S. Commerce Department Entity List and the UFLPA Entity List, and assessing the result under the export control and sanctions rules of your own jurisdiction. This article only describes which lists can be screened and is not legal advice; how to handle a match is a question for your legal team or outside counsel.