DiDi Global Inc (fka DIDIY)

[DMOST]

China's foreign listing regulations that mandate cybersecurity reviews apply to Hong Kong, experts say

In this article:

DIDI
-4.48%

Chinese companies handling data from more than 1 million users are required to go through a cybersecurity review if they want to list overseas, and that includes Hong Kong, according to an assessment endorsed by China's cyberspace watchdog.

The conclusion, included in the "expert views" that the Cyberspace Administration of China (CAC) published on its website, shows how the regulator is empowering itself to be a key gatekeeper of overseas listings even though the new law, which came into effect this week, does not specifically mention Hong Kong.

According to the Cybersecurity Review Measures, a regulation jointly signed off by 13 Chinese ministerial bodies, Chinese internet companies seeking to go public in a "foreign" market must go through a cybersecurity review by the cybersecurity Review Office, a unit inside the CAC.

review

The regulation, however, left open the question of whether it covers Hong Kong, which is not a "foreign" market, but is run as a separate legal system under the "one country, two systems" framework.

The CAC has not officially clarified whether a company seeking to list in Hong Kong must file for a cybersecurity review.

In the first expert interpretation, Qi Yue, an engineer from the China Cybersecurity Review Technology and Certification Centre (CCRC), wrote that Chinese internet operators cannot ignore cyberspace, data and national security risks in the process of listing in Hong Kong, even though the regulation does not specifically mention the city.

Qi added that only those already listed abroad would be exempt from such reviews.

All other cases, including initial public offering (IPO), direct public offering, acquiring a special-purpose acquisition company (SPAC), and reverse takeovers (RTO), need to undergo the review procedures, Qi said.

The CCRC is the agency designated to accept documents from companies for their cybersecurity review. Created in 2006 by China's market regulator, the agency's website says it provides "technical support for cybersecurity reviews".

Another internet company source, who has worked with CCRC on multiple projects, said it has been largely toothless in the past and often tried to sell certification services to tech firms.

A second expert view from Hu Ying, who heads the data security department at the China Electronics Standardisation Institute, said companies seeking a listing in Hong Kong "shall still be assessed in accordance with the relevant provisions of the security review of cross-border data transmission", regardless of the fact that Hong Kong is not mentioned directly.

China's cybersecurity review system came under the spotlight last summer after Chinese ride-hailing giant Didi Chuxing defied the wishes of Chinese regulators by going ahead with a US$4.4 billion IPO in New York, later described as a "deliberate act of deceit".

The IPO prompted the CAC to tighten regulations and initiate an on-site data security investigation of Didi's offices. It also ordered Didi to remove 25 apps from app stores and barred the company from accepting new customers. The investigation has not yet issued any official conclusions.

In December, Didi said it would delist from the New York Stock Exchange and explore a listing in Hong Kong. Didi's bankers have held preliminary discussions with Hong Kong Exchanges and Clearing Limited for a listing that may take place in the second quarter, the Post reported last month.

This article originally appeared in the South China Morning Post (SCMP), the most authoritative voice reporting on China and Asia for more than a century. For more SCMP stories, please explore the SCMP app or visit the SCMP's Facebook and Twitter pages. Copyright © 2022 South China Morning Post Publishers Ltd. All rights reserved.
https://finance.yahoo.com/news/chinas-foreign-listing-regulations-mandate-093000575.html

GO DIDI

"PEACE"