The information in this article is current as of 2026-09-30. The rules involved (tariffs, CRS, foreign exchange, customs, taxation, etc.) may all be adjusted, and when citing or making decisions, please rely on the latest official sources and qualified professional judgment.

On September 30, 2026, the Measures for the Administration of Online Marketing of Financial Products officially took effect. The Measures were jointly issued by the People's Bank of China, the Ministry of Industry and Information Technology, the State Administration for Market Regulation, the National Financial Regulatory Administration, the China Securities Regulatory Commission, the China National Intellectual Property Administration, the Cyberspace Administration of China and the State Administration of Foreign Exchange, and cover multiple categories of products and services, including deposits, loans, securities, asset management, insurance, foreign exchange, derivatives, payments and investment advisory services.

For Chinese enterprises expanding overseas and for cross-border financial business, what merits the most attention is not the restriction on promotional wording such as "low risk" and "high return", but rather that regulators have begun to review online marketing along a complete conversion chain: who produces the content, who provides the traffic, where the link leads, who assesses client suitability, who signs the contract, and whose account the funds ultimately enter.

This means that account-opening links, QR codes, community-based traffic diversion, live-streamed Q&A and so-called "investor education" cannot be judged as marketing or not merely on the basis of form. Even if a page does not directly collect payments, as long as it provides a channel for redirecting users to purchase financial products, it may already fall within the scope of online marketing of financial products.

I. The rules regulate not advertising, but financial traffic gateways

The Measures define online marketing of financial products as commercial promotional activities for financial products conducted via the Internet, which include both displaying products or the brands of financial institutions and providing channels for redirecting users to purchase financial products.

This definition connects traditional advertising, content marketing and transaction gateways. Enterprises can no longer treat "we merely provide links", "the account only shares knowledge" or "the platform did not participate in the transaction" as automatic grounds for exemption. The focus of assessment should return to actual functions: whether the content points to specific products or institutions, whether users are guided to open accounts, undergo assessments, sign contracts or make payments, and whether the promoter receives remuneration based on registration, deposit of funds or transactions.

The applicable entities also have clear boundaries. Financial institutions are institutions approved by the State Council or the financial management department of the State Council, established within the territory and engaged in financial business; third-party internet platforms shall accept entrustment by financial institutions in accordance with the law. Organizations or individuals other than financial institutions and entrusted platforms may not conduct, or conduct in disguised form, online marketing of financial products.

Therefore, the new rules do not issue a "financial marketing license" to all content creators; rather, they re-anchor marketing rights in licensed institutions and the platforms lawfully entrusted by them.

II. Red lines in cross-border scenarios have been expressly identified

Article 6 of the Measures provides that no institution or individual may provide online marketing services or conveniences for illegal financial activities. The official press conference further lists: issuance and trading of virtual currency, illegal foreign exchange margin trading, and overseas institutions providing financial product services to domestic residents without permission, all of which are scenarios requiring priority prevention.

This involves at least three layers of risk.

First, holding an offshore license does not mean one may acquire clients within China. The fact that an offshore securities firm, trading platform, insurance institution or investment service provider holds a license in its place of registration only demonstrates its qualification under local law; it cannot automatically substitute for the licensing assessment required to provide services to residents within China.

Second, technical accessibility does not mean one may promote. The fact that a website or application can be accessed by domestic users is a different factual structure from a platform, agent or blogger actively placing advertisements, configuring Chinese-language account-opening links, establishing customer-service communities and paying commissions based on deposits. The latter more readily forms an organized domestic marketing chain.

Third, not receiving client funds may still give rise to liability. What the new rules prohibit is providing "online marketing services or conveniences" for illegal financial activities. If an entity is responsible for producing content, distributing links, verifying leads or organizing livestreams, even if the funds go directly into an offshore institution's account, it cannot rely solely on "the funds did not pass through us" to exclude risk.

What requires a sense of boundaries is that the Measures do not resolve all cross-border jurisdictional issues with a single abstract rule. Circumstances such as Chinese-language pages on offshore websites, users' spontaneous access, and the division of labor between offshore teams and domestic affiliates still need to be assessed in light of the service recipients, the place where the promotional conduct occurs, the data and fund paths, the commission arrangements and the specialized rules for the relevant financial business; conclusions cannot be drawn solely on the basis of users' nationality or server location.

III. Platforms may direct traffic, but may not take over sales

In compliant cooperation, the basic positioning of a third-party platform is that of a marketing service provider, not a hidden sales institution.

Where a platform, having accepted a financial institution's mandate, provides users with a channel for redirecting to a purchase, it shall redirect to the financial institution's own platform and may not redirect again to another third-party marketing platform; before entering the purchase or service-use stage, it shall also prominently remind users and set a mandatory reading time.

More importantly, a platform may not intervene, or disguisedly intervene, in the conclusion of sales contracts, fund transfers, investor suitability assessments, loan limit assessments or other stages, nor may it engage in interactive consultations with consumers regarding financial products. This boundary will directly affect many common product designs: a platform page filling in risk questionnaires on a user's behalf, customer service explaining whether a product is "suitable", an aggregated checkout collecting investment funds, or settlement through the platform's own account may all cause the platform to move from traffic services to substantive sales.

Financial institutions also cannot be exempted from liability by mandating a platform. The parties shall sign a written agreement specifying the scope of cooperation, operating procedures, protection of client rights and interests, data security, dispute resolution, transition upon termination and liability for breach; the financial institution must also assess in advance and continuously monitor the platform's qualification, technology, compliance and reputational risks.

Expressed in the language of transaction structure, the new rules require a clear breakpoint between "client acquisition" and "conclusion of the transaction": a platform may deliver qualified traffic to a licensed institution, but suitability determinations, formation of the contract, receipt of funds and product liability must return to the entity responsible under law.

IV. Livestreaming, short videos and "investor education" are no longer a grey area

Marketing via official accounts, livestreaming and short videos must be conducted on the financial institution's own platform or on accounts it has lawfully opened on third-party platforms; marketing personnel shall be employees of the financial institution, possess the corresponding qualifications and be authorized. Platforms must also verify the qualifications of content producers, display the names of certification materials on account homepages, and cease publishing non-compliant content and report leads.

This directly affects acquisition models built on personal IP, financial bloggers, or advisory communities. Employees of financial institutions cannot bypass institutional accounts and continuously market specific products through personal accounts; practitioners outside financial institutions likewise cannot sell financial products in disguised form through livestreams or short videos.

"Investor education" likewise cannot serve as a circumvention route. The Measures make clear that financial institutions and their employees may not entrust platforms to conduct disguised marketing in the form of investor education, course training, or similar, and pay fees for it. The key test remains substance: whether the content neutrally disseminates knowledge, or whether it directs viewers at the end of a course to open accounts, deposit funds, or trade on a specific platform.

Professional institutions and lawyers providing general research and risk warnings are not the same as soliciting clients for specific financial products. However, if the content carries exclusive account-opening links, charges fees based on completed transactions, or answers product suitability questions on behalf of others, it may cross the boundary of legal services or information services.

V. Data flows and fund flows must be reviewed together

Financial marketing is often viewed as a traffic issue, but in practice it simultaneously generates data compliance and fund control risks.

Where platforms provide customer information and data to financial institutions, they should obtain the customer's authorization and consent, and ensure the confidentiality and integrity of transmission, preventing leakage, tampering, and loss; they must not unlawfully obtain or use financial institution customer data. Cross-border business may also involve additional requirements for cross-border data transfer of personal information, management of overseas recipients, and local data retention.

Enterprises should map data fields into business processes, rather than merely writing a general authorization clause in a privacy policy. Who collects phone numbers, device identifiers, risk preferences, income and asset information, account-opening link parameters, and deposit status respectively, for what purpose they are transmitted to whom, how long they are retained, and whether they enter overseas systems—all of this needs to be verifiable.

Fund flows are used to test whether a platform truly remains at the marketing stage. If the marketer controls payment QR codes, tops up funds on customers' behalf, pools funds before payment, or ties commissions directly to customer transaction amounts, the regulatory assessment may extend from advertising compliance to payment, foreign exchange, securities and futures, and even anti-money laundering issues.

VI. Five checks enterprises should complete today

First, map the complete marketing funnel. From advertising, search, short videos, livestreams, and communities to account-opening links, assessments, contracting, and payment, mark the operating entity, system, and jurisdiction at each node.

Second, verify product and entity qualifications. Verify separately the qualifications of product providers, sellers, marketing principals and content publishers; do not substitute offshore licences for the assessment of domestic permits, and do not equate brand cooperation with lawful engagement.

Third, clean up traffic diversion and sales scripts. Check whether links lead directly back to the financial institution's own platform, whether product names, fee rates and risk disclosures are consistent with the contract, and whether there are return promises, inducement language, brand confusion or the use of investor education as a wrapper for sales.

Fourth, rewrite the cooperation agreements. Incorporate content approval, account management, qualification verification, data authorization, evidence retention, complaint handling, regulatory inspections, cessation of marketing and exit arrangements into the contract, rather than agreeing only on click-through rates and commissions.

Fifth, establish traceable evidence. Retain each version of marketing content, approval records, launch times, target customer groups, landing pages, audio and video recordings of livestreams, and rectification records. In the event of a dispute, the enterprise must prove not only that the copy was compliant, but also that the platform never exceeded its authority by intervening in contracting, suitability or fund transfers.

Conclusion

Following the entry into force of the Measures today, the core issue in online marketing of financial products has expanded from "whether advertising is exaggerated" to "who is qualified to control the customer entry point, and whether that entry point leads users into unauthorised financial transactions".

For enterprises involved in offshore brokers, foreign exchange products, stablecoins, payment services or cross-border investment arrangements, compliance review should proceed along four lines simultaneously: the licensing line to confirm who may provide the services, the transaction line to distinguish marketing from sales, the funds line to identify who controls payment, and the data line to trace the flow of customer information. If these four lines cannot be closed, the faster traffic grows, the faster risk may spread.

Main reference materials

The information in this article was verified as of September 30, 2026. This article is provided for general information sharing only and does not constitute legal, tax, foreign exchange, data or investment advice on any specific matter. The rules applicable to cross-border marketing should be determined on a case-by-case basis in light of the product type, target recipients of services, locations of promotion, participating entities, and fund and data pathways.