On July 3, 2026, PBOC, NFRA, and CSRC jointly drafted the Measures for the Administration of Cybersecurity in the Financial Industry (Draft for Comments) (the "Measures"), which was open for public comments. The Measures consist of five chapters and 33 articles. The main contents include:

(1) Scope of application and general requirements: All types of financial institutions are brought within a unified cybersecurity management framework, with general requirements specified for cybersecurity of network operations, network data protection, and network personal information protection, including principled provisions on the cybersecurity responsibility system, cybersecurity governance, classified protection of cybersecurity, use of commercial cryptography, technology innovation and application, and information service security management. 

(2) Cybersecurity protection obligations: Financial institutions are required to strengthen classified and graded management of data, and adopt technical and management measures to prevent network data from being tampered with, destroyed, leaked or illegally obtained; institutions providing application software download services shall fulfill security testing obligations including detection of malicious programs and information in violation of laws and regulations. 

(3) Protection of critical information infrastructure: The Measures propose requirements for the identification of critical information infrastructure in the financial industry, and impose special compliance requirements on operators regarding organizational structure, performance safeguards, supply chain security, risk assessment, and cybersecurity incident contingency plans. Operators of critical information infrastructure shall conduct comprehensive cybersecurity testing and risk assessment at least once a year.

The Measures represent the cross-departmental collaborative unified cybersecurity management regulation for the financial industry. This helps fill the institutional gap where cybersecurity requirements were previously scattered across individual regulations, laying a systematic institutional foundation for cybersecurity compliance in the financial industry.

On July 10, 2026, the NFRA issued the Measures for the Administration of Cybersecurity in the Banking and Insurance Industries (Draft for Comments) (the "Banking and Insurance Cybersecurity Measures"), which was open for public comments. The Banking and Insurance Cybersecurity Measures consist of eight chapters and 72 articles, covering core areas including cybersecurity governance, cybersecurity construction and operation management, cybersecurity risk monitoring, cybersecurity incident response and disposal, critical information infrastructure management, and supervisory management. The main contents include:

(1) Governance structure and responsibility system: A four-tier governance structure of "decision-making - management - execution - supervision" is established, with the Party committee (Party group) and the board of directors bearing primary responsibility, the principal person in charge as the first responsible person, and the person in charge of division as the directly responsible person; the cybersecurity competent department is responsible for institutional formulation, technical assurance, and team building; the cybersecurity risk management department is responsible for risk identification, assessment, measurement, monitoring, and reporting mechanisms; the audit department is responsible for independent audits on cybersecurity. 

(2) Cybersecurity construction and operation management: Cybersecurity and informatization shall be "planned simultaneously, constructed simultaneously, and used simultaneously," with redundant backups for key network nodes and equipment; assets shall be classified and graded with dynamic maintenance; security domains shall be divided for isolation; internet exits shall be centrally managed with intrusion prevention and anti-DDoS protection measures deployed; vulnerability analysis shall be conducted at least quarterly; supply chain product lists shall be established with contingency plans and drills. 

(3) Cybersecurity incident response and disposal: A graded cybersecurity incident disposal mechanism is established with clear disposal standards; major incidents must be reported within two hours; third-party entities like outsourcing services providers are brought within the scope of comprehensive security supervision. 

The Banking and Insurance Cybersecurity Measures provide detailed provisions for banking and insurance financial institutions and financial holding companies under the overall framework established by the Measures, significantly enhancing the systematicity and operability of cybersecurity management in the banking and insurance industries through the establishment of a four-tier governance structure and full life-cycle management mechanism.

On July 3, 2026, the CSRC solicited public comments on the Decision on Amending the Measures for the Administration of the Registration of Securities Issuance by Listed Companies (Draft for Comments) (the "Amendment Decision") and supporting rules. The main contents include:

(1) Establishment of a shelf registration system for private placements: Listed companies with a high degree of standardized information disclosure may adopt a one-time registration, multiple-issuance approach for competitive private placements, better adapting to the characteristics of the bilateral market and facilitating listed companies in seizing market opportunities for financing.

(2) Optimization of the small and fast refinancing system: Under the premise that the proposed financing scale does not exceed RMB 600 million or 20% of net assets, the upper limit for small and fast financing of listed companies on the SSE and SZSE is raised to RMB 600 million, and for extra-large enterprises with net assets exceeding RMB 10 billion, the upper limit is raised to RMB 1 billion; the authorization for small and fast refinancing is changed from annual shareholders' meeting authorization to shareholders' meeting authorization.

(3) Unified market-based pricing mechanism: All private placements by listed companies must use the first day of the issuance period as the pricing benchmark date to determine the issuance price, promoting market-based pricing, with improved lock-up period arrangements. 

(4) Strengthened supervision of convertible bonds: SSE and SZSE convertible bonds are subject to the same refinancing interval requirements as private placements, rights issues, and open offerings, with enhanced requirements on the issuer's debt repayment capability; requirements on the use of proceeds for the issuer's core business are further emphasized. 

Through measures such as establishing the shelf registration system, optimizing the small and fast refinancing mechanism, and unifying market-based issuing pricing, it helps enhance the inclusiveness and adaptability of the capital market system, guides listed companies toward rational and orderly financing.

On July 3, 2026, the NFRA promulgated the Provisions of the NFRA on the Administration of the List of Seriously Dishonest Entities (Trial) (the "Dishonest List Provisions"), which shall take effect on October 1, 2026. The Dishonest List Provisions consist of 31 articles. The main contents include:

(1) Circumstances for listing: Parties who are subject to the below administrative penalties by the NFRA or its dispatched agencies shall be included in the list of seriously dishonest entities: (a) revocation of business licenses of legal entity institutions; (b) cancellation or revocation of lifetime qualification for appointment; (c) lifetime ban from the banking industry or lifetime ban from entering the insurance industry. Parties who have not received the above administrative penalties but have engaged in the following acts, and are subject to aggravated administrative penalties or decisions restricting market access by the NFRA or its dispatched agencies, shall also be listed:(a) Obtaining an administrative license through deceptive, bribing, or other improper means; (b) Forging, altering, or transferring a financial institution's business or operational license; (c) Procuring a loan by means of fraud; (d) Shareholders or actual controllers of a financial institution abusing shareholder rights or failing to fulfill shareholder obligations, thereby causing serious harm to the interests of the financial institution, its clients, or other shareholders; (e) A financial institution, its practitioners, its shareholders, or its actual controllers organizing or participating in illegal financial activities such as illegal fundraising; establishing a financial institution without authorization or engaging in financial business without the approval of the financial regulatory authority;(f) Other circumstances that shall be included as prescribed by laws and administrative regulations.

(2) Management measures: For parties included in the list, they may be considered as an important factor in reviewing administrative licenses, qualifications, commissioning of government procurement projects, and engineering bidding; listed as key regulatory targets with appropriately increased inspection frequency; not eligible for informed commitment and other integrity-based management measures; financial institutions may query the list information for reference in investment, financing, credit granting, loans, and insurance businesses.

(3) Credit repair mechanism: Upon the expiration of three years from the date on which the party is placed on the list, the institution that made the decision to place the party on the list shall, within ten working days from the date of expiration, automatically remove the party from the list; those who have been listed for one year and have voluntarily fulfilled the obligations under the administrative penalty, proactively eliminated harmful consequences, and have not reappeared in listing circumstances may apply for early removal.

The Dishonest List Provisions provide the systematic institutional framework for the administration of the list of seriously dishonest entities in the financial sector. By establishing a full-chain credit supervision mechanism of "listing - management - repair," it helps strengthen credit constraints in the financial sector, increase the comprehensive cost of serious dishonesty, and maintain financial market order.

On July 31, 2026, the NFRA, PBOC, CSRC and MOF jointly issued the Implementation Opinions on Improving the Governance of Financial Institutions (the "Implementation Opinions"). The Implementation Opinions put forward 22 measures in nine aspects. The main contents include:

(1) General requirements and goals: By 2029, basically form a financial institution governance mechanism with clear boundaries of rights and responsibilities, compatible incentives and constraints, strict risk management, and standardized and efficient operation, with significantly enhanced intrinsic stability and risk resistance of the financial system.

(2) Shareholder governance: Penetrate and identify major shareholders, actual controllers, and beneficial owners of financial institutions; Strictly control shareholder admission, build a "firewall" between industrial capital and financial capital, prohibit enterprises with illegal cross-industry operations, excessive leverage, or serious dishonesty or major illegal records from becoming major shareholders or actual controllers of financial institutions.

(3) Effectiveness of governance bodies: Improve the operational quality and efficiency of the board of directors, with reasonable requirements for the proportion of directors nominated by the same shareholder and its affiliated parties on the board; enhance the effectiveness of independent directors, promoting their majority in and chairmanship of the audit, nomination, compensation and assessment, and connected transaction committees; implement the reporting system of management to the board of directors, and establish and strictly enforce the management accountability system.

On July 24, 2026, the MOF and the State Taxation Administration issued the Announcement on Individual Income Tax Matters Related to Offshore Trusts ( the "Announcement"), effective from the date of publication. The Announcement consists of 18 articles. The main contents include:

(1) Scope: Offshore trusts refer to trusts established under foreign laws or other legal arrangements with trust functions; individuals transferring property to offshore trusts and obtaining income through offshore trusts constitute income as specified in Article 2 of the Individual Income Tax Law of the PRC, and shall declare and pay individual income tax in accordance with the Announcement.

(2) Tax treatment of property transfers by resident individuals: When a resident individual transfers property to an offshore trust, the taxable income shall be the market value of the property at the time of transfer minus the original value and reasonable expenses, and individual income tax shall be declared and paid under the "income from property transfer" category; income generated during the existence of the offshore trust, whether actually distributed or not, shall be subject to individual income tax on an annual basis under the "income from property transfer" or "income from interest, dividends, and bonuses" category.

(3) Filing and payment: Resident individuals transferring property to offshore trusts shall file tax returns with the tax authority between March 1 and June 30 of the following year; during the existence of the offshore trust, resident individuals shall file annual tax returns between March 1 and June 30 for the previous year's taxes; those with difficulties in paying on time may, after filing with the tax authority, pay in equal installments over five years. 

On July 29, 2026, PBOC, the National Development and Reform Commission, the Ministry of Science and Technology, the Ministry of Industry and Information Technology, the General Administration of Customs, the State Administration for Market Regulation, the NFRA, the National Intellectual Property Administration, and the National Data Bureau jointly issued the Notice on Strengthening the Development and Utilization of Data in the Field of Technology Finance (the "Notice"). The main contents include:

(1) Data catalog and information infrastructure: The National Catalog for the Development and Utilization of Data in the Field of Technology Finance (Version 1.0) is released, covering 8 major categories and 26 data indicators including enterprise lists and technology innovation attributes, import and export, investment and financing, operations, R&D investment, intellectual property, innovation capability evaluation, and enterprise needs; localities are supported in forming regionally distinctive technology finance data development and utilization lists and building provincial-level supporting information infrastructure. 

(2) Data sharing and integrated utilization: Support technology information users in the standardized use of technology public data, encourage localities to provide authorized information access channels for technology-based enterprises, and promote models such as information query and joint modeling; conduct pilot programs for trusted data spaces in technology finance, and encourage qualified regions to strengthen the development and utilization of enterprise payment flow data.

(3) Data empowerment for the full technology finance chain: Focus on financing matchmaking, intelligent risk control, and product innovation, guiding financial institutions to build digital credit profiles of technology-based enterprises, develop specialized risk control and investment research models, and create technology finance products that meet the financing needs of enterprises in subdivided industries. 

On July 15, 2026, the NAFMII issued the Notice on Matters Related to OTC Derivatives Trade Reporting. The main contents include:

(1) Reporting obligations and scope: Market participants shall report OTC derivatives trade information concluded outside PBOC-approved trading platforms to the NAFMII and the Interbank Market Data Repository (Shanghai) Co., Ltd. ("Market Data Repository"); OTC derivatives trades refer to trades other than futures trades, involving swap contracts, forward contracts, and non-standardized option contracts and their combinations; market participants include commercial banks, securities companies, insurance companies, fund companies, trust companies, futures companies, and their subsidiaries, finance companies, and PE managers engaged in asset management business. 

(2) Reporting deadlines and requirements: Market participants shall report the previous month's trade information to the NAFMII and the Market Data Repository within the first five working days of each month; for the first report, all historical trade information since January 1, 2023 shall be reported; market participants shall establish a complete trade reporting mechanism to ensure the authenticity, accuracy, and completeness of trade report information. 

(3) First reporting deadline and self-regulatory management: Market participants shall complete the first trade information report via email by the end of the day on August 7, 2026; the NAFMII will inspect or investigate trade reporting, and where violations such as under-reporting, omission, or incorrect reporting are verified, self-regulatory measures or disciplinary actions will be imposed based on the severity of the circumstances.

• https://www.csrc.gov.cn/csrc/c101981/c7643145/content.shtml

• https://www.nfra.gov.cn/cn/view/pages/ItemDetail.html?docId=1264207

• https://www.csrc.gov.cn/csrc/c101981/c7643319/content.shtml

• https://www.nfra.gov.cn/cn/view/pages/rulesDetail.html?docId=1264238

• https://www.csrc.gov.cn/csrc/c100028/c7649076/content.shtml

• https://fgk.chinatax.gov.cn/zcfgk/c102416/c5251277/content.html

• https://www.pbc.gov.cn/goutongjiaoliu/113456/113469/2026072915223955058/index.html

• https://www.nafmii.org.cn/ggtz/tz/202607/t20260715_326062.html

• https://www.csrc.gov.cn/csrc/c100028/c7643223/content.shtml