Entering into the Chinese Internet Market—China Strategy for Internet-based Start-up

Chinese market has all the reasons to be one of the most attractive markets to internet-based start-ups.

China, with 721 million of online users, remains the largest internet market according to the Broadband Status Report issued by the United Nations Broadband Commission in September 2016. This number of online users is more than 2.5 times the number in the United States. According to a PwC report, the Chinese private equity/venture capital market has grown tremendously in recent years, raising $72.5 billion in 2016 and representing a 49% increase from the previous year. The same PwC report also reports 1,767 Chinese private equity and venture capital-led merger and acquisition deals in 2016 valued at a total of $223 billion, accounting for 73% of the total global PE/VC deal values. Also in 2016, 165 companies went public in China while only 105 IPOs were completed in the U.S. Not only the chance of IPO is higher, the Chinese public market tends to provide higher valuations as compared to its overseas counterparts. From policy perspective, unlike other countries, China treats high-tech startups as a national political priority and allows them access to favorable loans, subsidies and procurement opportunities. The government itself has played a key role of venture capitalist by utilizing government revenue to fund and subsidize startups, as state-owned venture capital funds operates more than $300 billion in assets in various cities and provinces throughout China.

Nevertheless, China remains remote to many startups in the western world. The entire startup ecosystem in China is primarily a self-contained playground with few foreign players participating. Different from other countries, the internet in China operates behind a “Great Firewall” that even internet giants like Google and Facebook have failed to penetrate to date. Operating in China requires numerous licenses and permits that are difficult to obtain for foreign companies with limited resources. As the enormous funds raised by the PE/VCs in China are mostly in RMB, they are also subject to stringent restrictions on outbound investments, hence remains unknown to start-ups outside of China.
Due to the high barrier to enter into the Chinese internet market, most start-ups operate without even having a China strategy in place, which could potentially lead to the loss of tremendous opportunities. The loss sometimes could only be recognized when a similar service pops up and dominates the market before long, sometimes quicker than its U.S. counterpart. It is therefore advisable for each internet-based start-up company to proactively consider and prepare its China strategy upfront.

In order to form your China strategy, it is important to understand the obstacles of entering into the Chinese market.

First, a company has to obtain certain required licenses and permits prior to entering the Chinese internet market legally and many of such licenses and permits are not available to foreign invested U.S. companies.

Although theoretically, Chinese law is inapplicable to foreign internet operators whose operations or servers are based entirely outside of China, accessing overseas websites has always been a problem for users within the Great Firewall. The Chinese government recently launched a new campaign to ban unauthorized VPN services in China, further separating Chinese internet users from accessing certain internet websites. Various procurement related rules and regulations would also diminish the ability of foreign-hosted services to attract customers in China. Companies interested in obtaining customers from the biggest internet market should therefore take these obstacles into consideration.

The first step is to identify the licenses and permits necessary for your operation in China. The primary regulator of China’s internet infrastructure, the Ministry of Industry and Information Technology (“MIIT”), periodically releases the Classification Catalogue of Telecommunications Services, listing applicable licenses and permits required for basic telecommunications businesses and value addedvalue-added telecommunications businesses. The latest Classification Catalogue of Telecommunications Services, the 2015 Catalogue, covers most internet-based services and products.

Certain MIIT registrations and licenses applicable to internet-based service providers or internet-based product providers are summarized below:

* Foreign invested companies eligible to apply for the above listed permits are subject to additional requirements and sometimes extended processing times.

** The license is generally required if the website or application offers information publication or delivery services, internet search function, community platform, instant information exchange, or information protection and processing services.

It is often times confusing as to what specific licenses are needed for certain internet-based service providers, especially with respect to emerging technologies and markets. The Chinese government has issued various rules and regulations to help clarify what is required for specific products and markets. It is recommended that you consult with your legal counsel regarding the specific compliance requirements.

In addition to the licenses issued by the MIIT, certain internet-based services and products are subject to service-specific or product-specific regulations requiring additional licenses and permits, including:

*Simplified approval process applies to certain games that meet the following criteria: (i) game’s copyright is owned by domestic individuals or entities, (ii) the game does not contain any sensitive elements that relate to politics, military, ethnicity or religion, (iii) the game either has no storyline at all or only a very simple storyline, and (iv) it is in the genre of casual games including match-three, endless runner, top down shooter, board, puzzle, sports, music and etc.

Overall, it is not an easy task for foreign companies to enter into the Chinese internet market without careful planning. The process to obtain necessary licenses and permits could be so time-consuming that it might take away from the technical advantages that the company has in China.

After obtaining necessary permits and licenses, the internet-based companies’ operations are subject to complex compliance requirements.

The permits and licenses issued by the regulatory agencies listed above generally have a limited term that must be renewed before expiration. Certain licenses and permits are also subject to annual inspection. For example, MIIT requires all operators to conduct an annual inspection to ensure compliance with the relevant rules and regulations. The inspection covers all aspects of the operation, including ownership of the entity, business conduct, fees charged to customers, quality of services, cyber security and data privacy measures. Holders of the Online Publishing Service Permits must also submit an annual self-inspection report to SAPPRFT with respect to its compliance and publishing activities. If noncompliance is found to have occurred, licenses and permits may be revoked by the regulating agencies.

Major compliance requirements are summarized below:

a. Cyber security requirements

In November 2016, China promulgated the new Cybersecurity Law, which will take effect in July 2017. The new Cybersecurity Law imposes enhanced security compliance requirements on all “network operators,” which is broadly defined to include all internet service providers. Under existing law, network product providers or network service providers are required to comply with certain national regulations and industrial or local rules. The new Cybersecurity Law will substantially expand the scope of these regulations, making it applicable to cross-industry network operators.

Under the new law, network operators are required to implement cybersecurity measures, including establishing an internal security management policy, designating responsible personnel, adopting technical measures to prevent viruses or cyber-attacks, monitoring network security events, retaining network logs for no less than 6 months, and backing up and encrypting important data and information. As a result, all network providers are subject to complex security classifications and compliance certification processes only previously applicable to information system security products and information technologies used in financial industries. Furthermore, the required security measures may vary based on what impact an operator’s information system will have on national security and the public welfare. For example, providing services in Critical Information Infrastructure (“CII”) areas, such as public communications and information services, energy, transportation, utilities, financial services and governmental affairs, are subject to additional security measures and certifications from the government.

b. Censorship requirements

According to Chinese law, certain information cannot be produced, reproduced, reviewed or transmitted online, including any falsified information, insults or slander, information infringing a third party’s privacy rights or intellectual property rights, information detrimental to governmental credibility, information deemed obscene, or information concerning superstition, gambling, violence, horror, among others. The list is broad and vague without clear guidelines, leaving plenty of room for the government’s interpretation. Under the censorship rules, website operators will be responsible for user postings over which they have no control (such as falsified information and information that infringes another person’s legal rights). For internet-based companies with interactive features and user-provided content, compliance with these censorship rules can be costly and time-consuming, with a high risk of noncompliance.

Additionally, Chinese government agencies may order operators to delete certain information or cease operation in the event that a violation of the censorship rules has occurred. For any violating information hosted outside of China, the censorship rules demand that the relevant government agency take technical measures to block the offending site outside the Great Firewall.

c. User verification requirements

The new Cybersecurity Law and other existing laws and regulations require that any network operators require its users to provide identifying information and verify such information before providing network access, domain registration, information publication or instant communication services to such users.

d. Data privacy requirements

Prior to the promulgation of the new Cybersecurity Law, there have already been various government policies, administrative rules, judicial interpretations, and non-binding guidelines relating to data privacy protection. The Cybersecurity Law further provides that network operators must safeguard the confidentiality of personal data collected and the collection and use of such personal data must follow the principles of legality, propriety and necessity. Data collectors must follow the legal requirements in terms of giving notice and obtaining consent. In case of a data breach incident, the data collectors shall report such incidents to the relevant authorities and should also timely notify affected users.

In general, all network operators are required to disclose its privacy policies and obtain consents from users before collecting and using their personal information. Each operator is also required to establish personal information collection and usage safety management policies and designate responsible personnel to safeguard the personal information collected. In case of a leakage or breach, the operator is required to take immediate remedial actions and report to the relevant government agencies.
All network operators are also required to cooperate and provide necessary information to the police or other government agencies to facilitate national security protection or criminal investigations.

e. Data localization requirements

Before the promulgation of the Cybersecurity Law, China has already implemented a number of data localization rules for information collected by financial institutions, medical institutions, cloud computing platforms and data centers providing services to government agencies. The Cybersecurity Law further requires that personal data and important business data generated or collected in China by the operators of CII should be stored in China. Transmission of such data abroad will only be allowed if there is an overriding business need and such transfer is approved by the Cyberspace Administration of China or other relevant government agencies after a security assessment.

f. Enforcement mechanism

In addition to monitoring internet activities through government agencies, the Chinese government has also relied heavily on incentivized reporting from online users and self-monitoring mechanisms to ensure compliance. The Cyberspace Administration of China, for example, established a website to encourage web users to report any non-compliance for financial rewards. In January 2017, the reporting center received over 4 million reports of potential violations, and confirmed 2.7 million of such reports. Other government agencies have also set up similar channels to encourage reporting from users on various matters, from the violation of the censorship rules to information leakage. In fact, the Cybersecurity Law requires network operators to set up reporting policies to encourage, collect and process reports from users with respect to any information security matters.

Business issues to consider in forming your China strategy

The Chinese market offers great potential with many new opportunities, but there are also many issues to consider before a company is to enter and navigate this market. Despite of the enormous market size, the booming private equity/venture capital firms in China, and the Chinese government’s generous investment and support to start-up companies, relatively few foreign-based internet start-ups have made their ways to China during their early stages.

Part of the reason can be attributed to high structuring and compliance costs as most internet-based companies have to utilize a special structure called a “variable interest entity” (VIE) to set up contractual control of a stand-alone domestic Chinese entity to circumvent the restrictions on foreign investment. Subsequent to setting up the domestic entity, the filing of relevant IP protections and application processes to obtain the necessary permits in China will be yet another expensive and time-consuming endeavor for internet-based companies.

For example, LinkedIn was founded in December 2002 and went IPO in 2011. Yet, it was not able to enter into the Chinese market until February 2014. Meanwhile, many start-ups with similar business models such as Lietou.com and Ushi.com established themselves in China during that time. As a latecomer, LinkedIn’s has had to invest heavily in China to establish its business presence and to catch up to its industry competitors.

A number of U.S. based start-ups with Chinese founders have set up separate entities in China directly owned by these founders or their relatives to help reduce the initial compliance costs in order to conduct their businesses in China legally. Nevertheless, a legally separate Chinese start-up entity with common founders with its U.S. counterpart triggers governance concerns, and usually leads to restructuring down in the road which could end up costing more money and frustrating investors.

Even for companies starting up with the customary VIE structure in China, risks remain as the Chinese government has indicated that the structure could be challenged in the future through legislative efforts. The actual equity holders of the operating companies in China, so called nominee stockholders, could claim their equity rights in Chinese courts, and some of such stockholders have prevailed in such claims in the past.

Instead of ignoring the Chinese market entirely, it might be advisable for start-ups to consider their China strategy upfront. The key question is how to structure the Chinese operation properly. Before determining your China strategy, a start-up generally needs to consider the following:

-Whether the IP rights critical to your operation can be registered in China to preserve rights even without formally operating in China

Foreign companies are allowed to file and own patents, trademark and copyrights in China. To preserve your company’s competitive advantage, it is advisable to register your IP properties in China early on even if the company does not plan to enter into the Chinese market in the near future. Such filings will constitute the basis for future collaboration or licensing arrangement in China and protect your IP rights against local competitors.

-Regulatory restrictions on foreign investment in your business

China is in the process of opening up more industries to foreign investors although the government’s control in certain areas has been tightening. It is important to understand the regulatory barriers and the timeline for entering into the market before making the ultimate decision on your China strategy. In the case of markets with low regulatory barriers to entry for foreign companies, it is better to start early on before your competitors do so.

-Whether your company’s product can be adopted by Chinese users without significant localization efforts

Certain products are naturally more transferable than the others, for example, cloud-based storage business will be easier to transplant to China than language recognition. If localization is not a big issue for a start-up’s business, it makes more sense to enter into the Chinese market early on.

-The competitive landscape for your product in China versus other countries

As stated earlier, the Chinese market can be a self-contained ecosystem. Many of your competitors might not have been able to penetrate into the market. If your start-up is facing an uphill battle outside of China while there are not that many competitors within China, it might be a good idea to shift your battle field.

-The availability of Chinese expertise or partners that you can tap into

To set up an operation in China and establish your own local team to promote your product or business could be difficult for a start-up without Chinese expertise on board. However, many professionals in the field, including local PE/VC specialized in your industry, can provide help. Moreover, it could be a good idea to partner with a local company through a joint venture or a contractual arrangement even if it means certain dilution to your equity position in China.

-Financing or exit options

If some of your existing investors are familiar with the Chinese M&A landscape or capital market, you might consider setting up the company in a way that will make a future exit easier in China. In general, I n China, it is much easier to raise funds or exit through strategic acquisitions or IPOs as a Chinese company with foreign subsidiaries than the other way around.