Financial services authorizations licenses
9. Does a cloud service provider need a financial services authorization or license to provide cloud services?

Yes.

The provision of public cloud services and hybrid cloud services within the territory of China is strictly regulated. While there are no unified definitions of "public cloud," "private cloud" and "hybrid cloud" under current Chinese laws and regulations, and there are no clear rules to distinguish between IaaS, PaaS and SaaS, the mainstream view in China is that providing public cloud, hybrid cloud, private cloud (to multiple customers), IaaS or PaaS would generally be considered a form of regulated value-added telecommunications services ("VATS"), and some forms of SaaS may also fall within the scope of regulated VATS. Therefore, if cloud services to be procured and used by an entity operating in China are provided in China, the entity would generally request or expect that, to the extent applicable, the cloud service provider holds the relevant VATS operating license and complies with the industry standards for providing the relevant VATS issued by the regulator of telecommunications services.

In addition, cloud service providers that offer cloud computing platforms (including private clouds and group/public clouds) to financial institutions in China would also be expected by their financial institution customers to obtain a fintech product certification pursuant to the Rules on Certification of Fintech Products and other relevant rules. So far it appears that such product certification is not a market-entry-type license, but merely a nice-to-have certification that can bring more business opportunities to the cloud service providers.

The People's Bank of China (which is the central bank of China, "PBOC") issued the draft Measures for the Administration of Recordal of Financial Clouds (for Trial Implementation) to certain market players (rather than the general public) in June 2021. Reportedly, the PBOC proposed the following under those draft measures: (a) any public cloud or financial community cloud services (which refers to a cloud service used by several financial institutions at the same time) provided to financial institutions in China would be subject to a compulsory recordal with the National Internet Finance Association of China as designated by the PBOC; (b) financial institutions in China will not be allowed to use those cloud services without the recordal; and (c) the recordal for private cloud services provided to financial institutions would be voluntary.