Accounting Firms in China Required to Store Audit Data on Mainland Under New Rules

New interim measures have been introduced in China, mandating that accounting firms must store their audit working papers within the mainland. These regulations, set to be implemented from October 1, were jointly issued by the Ministry of Finance and the Cyberspace Administration of China (CAC) [para. 1][para. 2]. The measures also require firms to secure approval for exporting any audit working papers and prohibit them from sharing domestic project data with overseas regulatory authorities [para. 2][para. 3].

These rules apply specifically to accounting firms operating on the Chinese mainland that provide services to various entities including listed companies, non-listed financial state-owned enterprises, central government-administered SOEs, operators of critical information infrastructure, and internet platform operators with over a million users. Additionally, these regulations cover firms engaged in cross-border auditing [para. 5].

Under the new framework, auditors handling significant or core data must manage this information according to specific classifications—core, important, and general. Each category has distinct requirements regarding storage, logging, and transmission protocols. Furthermore, encryption equipment must be installed locally within the mainland and managed by domestic teams to ensure all encryption keys are stored within China [para. 6][para. 7][para. 8].

These measures are part of a broader effort by Chinese authorities to tighten data security following the enactment of several laws such as the Cybersecurity Law in 2017 and both the Data Security Law and Personal Information Protection Law in 2021. These laws collectively create a comprehensive legal structure for data security and personal data privacy protection across various industries including accounting [para. 4][para. 9].

Despite these stringent new rules, an analyst from a multinational accounting firm indicated that these would not hinder audits related to overseas listings since such reviews are typically conducted domestically without necessitating data exports. However, for Chinese companies listed in the U.S., any audits required by the Public Company Accounting Oversight Board (PCAOB) would still need approvals from Chinese regulatory bodies like the Ministry of Finance and China Securities Regulatory Commission before any audit working papers can be exported [para. 10][para. 11].

In 2022, a significant agreement was reached between U.S. and Chinese regulators allowing American officials access to audit documents of Chinese businesses located in Hong Kong—a move aimed at resolving longstanding disputes that threatened the delisting of approximately 200 Chinese stocks from U.S. exchanges. This deal was described as a short-term solution focusing primarily on enhancing cooperation between auditing bodies rather than imposing restrictions on listed companies themselves [para. 12][para. 13][para. 14].

The conditions under which audit working papers may be exported hinge on three main factors: adherence to reciprocity principles allowing mutual inspections; alignment with agreed scopes concerning company types; and compliance with agreed methods involving interviews with personnel from accounting firms with participation from the Chinese side [para. 15].