Online payment industry issues to be further clarified

In the past few years, the People’s Bank of China (PBOC) and government authorities have conducted investigations of illegal or irregular third-party payment businesses in China. The result of those efforts has in part taken the form of the Implementation Plan for Special Rectification of Non-banking Payment Institution Risks, published in October by the PBOC and 13 government authorities. The plan has resolved certain industry issues in the third-party payment sector, while leaving some key issues in the online payment industry unsettled.

Scope of online payment business. The Administrative Measures on Payment Services Provided by Non-financial Institutions, issued by the PBOC in 2010, require that non-financial institutional providers of monetary capital transfer services must obtain a payment business permit – among others, monetary transfer services include “network payments” – which refer to the transfer of monetary capital between payers and payees conducted by non-financial institutions acting as intermediaries through public or special networks.

Ambiguity arises, however, with a common type of payment model adopted in various sectors such as e-commerce, O2O and mobile ride hailing, in which users first top up an online account hosted by a platform, and then make payments directly out of that account to third-party sellers on the platform. Opinions differ on whether such a model constitutes monetary capital transfer services. Some hold that such a model does entail monetary capital transfer services, as simply hosting the top-up account is sufficient to constitute the “transfer of monetary capital”. Others, however, assert that hosting the account alone does not entail any “transfer of monetary capital”, and it is the user him/herself that ultimately transfers the monetary capital to the merchant.

In PBOC’s released interpretation of the implementation plan, it recognized this ambiguity by stating generally that the “large merchant settlement” model (i.e. the top up account model described above) is an online payment business conducted without a permit. But the PBOC did not resolve the ambiguity of what should be determined as a “transfer of monetary capital”, leaving open the question as to whether the “large merchant settlement” model currently adopted in various sectors is illegal.

Prohibition on illegal business co-operation. The measures expressly stipulate that a payment institution may not subcontract its business or transfer, lease or lend its payment business licence to third parties. However, neither the measures nor any other law or regulation in the third-party payment sector defines what constitutes “subcontracting” or “leasing”, or provides any other information about the scope of this prohibition. In practice, a range of activities that could plausibly constitute “subcontracting” or “transferring” of business exist among operators in the online payment sector. Some examples include: (1) transferring or licensing independently owned or developed online payment platforms to third parties to operate and manage; (2) transferring customers’ accounts to their partners for administration, and to carry out transfers; and (3) providing third-party institutions with actual control over their payment businesses under the guise of providing consulting, management and other services.

Safeguarding users’ rights and interests. Both the measures and the Guiding Opinions on Promoting the Sound Development of Internet Finance, published by the PBOC and three other government departments in 2015, expressly require payment institutions to formulate measures guaranteeing customers’ rights and interests, but no specific guidelines or requirements are provided. This is particularly important given that the PBOC and other authorities have shown a willingness in the past to safeguard user/consumer rights through enforcement activities. Previously, such activities have focused on ensuring the proper establishment and administration of a system for consolidating deposits into customers’ online accounts, as well as ensuring the security of customer accounts.

Regarding the online payment business, below are some areas that could be the focus of future enforcement actions by the PBOC and other government authorities.

Security measures for customer information management. Online payment platforms are increasingly ubiquitous, with more users signing up every day. Each platform will need to adopt security measures to safeguard customer information to avoid the risks of data breaches, leaks and skimming of account information, as well as the use of counterfeit cards or unauthorized account use.

It may be helpful for regulators to include within the definition of “personal financial information” any information collected and processed by third party payment entities, and so such information would receive the protection of existing regulations governing the activities of financial institutions (e.g., the Notice of the PBOC Urging Banking Financial Institutions to Optimize the Protection of Personal Financial Information).

Payment service agreements. The measures require payment institutions to enter into a payment service agreement with their customers. The agreement should set out each party’s rights and obligations, and provide mechanisms for determining liability upon default and resolving disputes. Signed agreements should be filed with the local PBOC branch. In practice, as many such contracts will not be negotiated, industry regulators such as the PBOC and judicial authorities will need to review them to determine whether they are balanced and reasonable.

Both ex ante and ex post regulation. The PBOC and government authorities are continuously strengthening their efforts to investigate and punish illegal or irregular conduct after it has occurred (ex post regulation). Measures include adjusting violators’ approved business scopes and even revoking the payment business permit of certain institutions. It is expected that the PBOC will take more ex ante measures, such as requesting payment institutions to comply with the measures and other legal/regulatory requirements, conducting regular examinations and audits, and curbing fraudulent advertising, unfair competition and other illegal behaviours. This could help curb illegal activities without frustrating helpful and innovative conduct in the market.

Given their rapid development, significance and complexity, the third-party payment sectors – especially the online payment – have been a regulatory focus in China. Online payment service providers should be sure to obtain a payment business permit when necessary, comply with regulations and work closely with legal counsel to monitor and comply with regulatory changes and new requirements to ensure unobstructed business operations.

Ben Chai and Cloud Li are associates at DaHui Lawyers