China's AI Token Outbound Volume Surpasses That of the U.S.: Regulatory and Compliance Analysis for Cross-Border AI Services

iconMetaEra
Share
AI summary iconSummary
China's large model token weekly usage has surpassed that of the U.S. for the first time, with token outbound becoming a new frontier in China’s digital service trade. This article analyzes the regulatory frameworks at home and abroad based on the main business models of computing power outbound, empowering enterprises in their computing power outbound initiatives.

Author and source: Chen Yi'an, Chen Lin (Jia Xinrui also contributed to this article)

Keywords: Computing power going global, Token, Digital service trade

Introduction

Amid the large-scale application of global AI models and the imbalance between computing power supply and demand, "Token outbound" is emerging as a new frontier for China's digital service trade. In February 2026, China's large model Token weekly usage peaked at 5.16 trillion, accounting for 61% of the global total and surpassing the United States for the first time.[1] In April 2026, the nation's first city-level end-to-end "Token outbound" system was successfully validated in Shantou, Guangdong, marking the transition of this business model from concept to reality.

However, the international expansion of tokens is no easy path. As a convergence point for cross-border data flows, technology transfer, and digital service trade, it spans multiple regulatory domains including data export, technology export, AI regulation, and international trade, with compliance constraints from both domestic and foreign jurisdictions layering upon each other. This article, from a legal practice perspective, systematically reviews the business models and regulatory landscape of computing power export, analyzes core compliance risks, and anticipates compliant pathways to provide legal empowerment for Chinese computing power companies seeking high-quality international expansion.[2].

I. Computing Power Going Global: Concept Definition and Industrial Value

(1) Clarification of Core Concepts

Legal and Technical Classification of Tokens: A token is the smallest unit of measurement used to quantify computational resource consumption when AI models process inputs such as natural language, images, or code. It is essentially a digital quantification of the model’s computing power, electricity consumption, and algorithmic operational costs, and is not a virtual currency issued on a blockchain with payment or securities attributes. From a service perspective, AI inference services billed in tokens constitute a typical form of technical and digital service.

The classification of computational power outbound as a service trade: Under current technological and trade conditions, computational power outbound primarily refers to a business model in which Chinese enterprises deploy AI models and computational infrastructure domestically and provide inference services to overseas entities via API interfaces, settling cross-border transactions based on Token consumption (referred to as "MaaS" — Model as a Service). This model aligns closely with the core definition of Mode 1 ("Cross-Border Supply") under the WTO General Agreement on Trade in Services (GATS), wherein a service provider in one member’s territory delivers services to consumers in another member’s territory, with the service and data transmitted cross-border via the internet, without any physical movement of the service provider or consumer across borders.

The industrial foundation of computing-power and electricity coordination: Computing-power and electricity coordination refers to an industrial model that integrates the planning and unified scheduling of computing infrastructure with power supply systems, enabling high-density, low-energy computing services through green electricity and low-cost industrial electricity. Western China’s abundant green and low-cost industrial electricity provides a core cost advantage, but also introduces additional legal issues related to energy policy, electricity pricing mechanisms, and international trade compliance.

(2) Main Business Models

Currently, the overseas expansion of computing power has formed three typical models:

Mode 1: API-based cross-border delivery. The model is deployed domestically, and overseas users access it via API calls, billed by token. Data is transmitted across borders via submarine cables. This is the most mainstream model, with representative examples including DeepSeek and Qwen, which provide API services to developers worldwide.

Mode Two: Offshore Data Processing. Leveraging the state-approved "Data Processing Inbound" pilot policy, offshore data enters domestic computing clusters through compliant channels for processing, with results returned overseas. The fully closed-loop verification model—“Offshore Data Center → Token Generation → Overseas Access → Compliant Data Transmission”—is a typical example of offshore data processing.

Mode Three: Overseas Node Deployment + Domestic Compute Resource Orchestration. Deploy edge nodes or data centers overseas to localize certain inference tasks, while core training and compute orchestration remain supported domestically. This mode reduces cross-border latency and alleviates pressure related to data outbound transfers, but involves technical flow and compliance separation between domestic and overseas environments.

(3) Industry Status and Strategic Value

By the end of 2025, China’s total intelligent computing capacity reached 1.59 million PFlops, ranking second globally, with the eight national computing hubs accounting for over 80%.[3]For example, leveraging green electricity in western regions, China’s computing costs are just half of those in the U.S. and nearly one-third of those in Europe.[4]Domestic large model APIs are priced as low as 1/16 of those in Silicon Valley.[5]Token globalization has connected the value chain loop of “green electricity—computing power—digital services,” becoming a key driver for China’s foreign trade transition from “goods export” to “digital services export.”

II. Current Regulatory Status of Domestic Hashrate Outbound

(1) Core Regulatory Legal Framework

Although China currently has no specific laws or regulations governing the cross-border provision of AI computing services, a multi-level, inter-departmental, and end-to-end regulatory framework has been established in the areas of data outbound transfers and technology exports. All relevant regulatory provisions are derived from currently effective laws, administrative regulations, and departmental rules, forming a compliance foundation for AI computing services going global, encompassing four dimensions: cross-border data, AI services, technology exports, and infrastructure.

Fundamental laws on data security: Centered on the Cybersecurity Law of the People’s Republic of China (the “Cybersecurity Law”), the Data Security Law of the People’s Republic of China (the “Data Security Law”), and the Personal Information Protection Law of the People’s Republic of China (the “Personal Information Protection Law”), these laws establish the fundamental legal principles and baseline requirements for cross-border data flows. Article 38 of the Personal Information Protection Law explicitly defines the legal prerequisites and compliant pathways for personal information processors to provide personal information overseas, while Article 31 of the Data Security Law imposes mandatory regulations on the cross-border transfer of important data, thereby defining the compliance boundaries for API data inputs and outputs in Token offshore scenarios.

Special regulatory documents on data cross-border transfer: The "Measures for Security Assessment of Data Cross-Border Transfer" (CAC Order No. 11), the "Measures for Standard Contracts for Personal Information Cross-Border Transfer" (CAC Order No. 13), and the "Regulations on Promoting and Regulating Data Cross-Border Flow" (CAC Order No. 16), issued by the Cyberspace Administration of China, collectively form the three core operational guidelines for data cross-border transfer. They clarify the applicable conditions and procedural requirements for different pathways such as security assessment, standard contracts, and certification, serving as the most direct compliance basis for enterprises providing Token cross-border services.

Generative AI-specific regulatory rules: The "Interim Measures for the Administration of Generative Artificial Intelligence Services" (No. 15 Order of the National Internet Information Office), jointly issued by seven departments including the National Internet Information Office, establishes institutional arrangements specifically for algorithm registration, content security, user protection, and cross-border services of generative AI. These measures directly apply to business models that provide large model token services via API. However, whether these measures fully apply to providing API services overseas requires further analysis based on specific business models.

Technology Export and National Security Control Regulations: The People's Republic of China Export Control Law (the "Export Control Law"), the Regulations on the Administration of Technology Import and Export of the People's Republic of China, and the Catalogue of Technologies Prohibited or Restricted for Export issued by the Ministry of Commerce and the Ministry of Science and Technology have included core artificial intelligence algorithms and model technologies within the scope of technology export controls. Companies providing AI computing power services to overseas entities via APIs may be deemed to be engaging in cross-border technology transfer under the law.

Policy basis for computing power infrastructure and coordinated power-computing policies: Documents such as the "Opinions on Deeply Implementing the 'East Data West Computing' Project and Accelerating the Construction of a National Integrated Computing Power Network" (NDRC Data [2023] No. 1779) and the "Action Plan for High-Quality Development of Computing Power Infrastructure" (MIIT & MIIT Connected Information [2023] No. 180), issued by the National Development and Reform Commission, the Ministry of Industry and Information Technology, and other departments, establish regulatory requirements for computing center operations in terms of industrial layout, green and low-carbon development, and computing resource scheduling, forming the industrial regulatory foundation for computing power outbound under the coordinated power-computing context.

(2) Key Regulatory Requirements and Compliance Obligations

1. Compliance for Cross-Border Data Transfer: Requirements for the Three Statutory Pathways

In accordance with Article 38 of the Personal Information Protection Law, the Measures for Security Assessment of Data Cross-Border Transfer, the Measures for Standard Contracts for Personal Information Cross-Border Transfer, and the Regulations on Promoting and Regulating Cross-Border Data Flow, China implements a regulatory model for cross-border data transfers that classifies and categorizes data and mandates legal pathways; enterprises must select the appropriate compliance pathway based on the type and volume of data.

(1) Path for Security Assessment of Data Cross-Border Transfer

Enterprises shall, prior to providing data overseas, legally apply to the national cyberspace administration for a security assessment of cross-border data transfer through the provincial cyberspace administration department where they are located, if any of the following circumstances apply:[6]:

  • The data processor is a Critical Information Infrastructure Operator (CIIO) and provides personal information or important data overseas[7];
  • When providing important data overseas, according to Article 4 of the "Measures for Security Assessment of Data Outbound Transfer": "A data processor shall apply to the national cyberspace administration through the provincial cyberspace administration department at its location for a security assessment of outbound data transfer under any of the following circumstances: (i) when the data processor needs to transfer important data collected and generated during operations within the territory overseas, it shall undergo a security assessment for outbound data transfer organized by the national cyberspace administration."
  • Accumulated provision of personal information to overseas parties of more than 1 million individuals (excluding sensitive personal information) or more than 10,000 individuals with sensitive personal information since January 1 of that year[8].

(2) Standard Contractual Clauses (SCC) pathway for cross-border transfer of personal information

Not meeting the criteria for a security assessment for cross-border data transfer, but falling under any of the following circumstances, the personal information processor shall enter into a standard contract formulated by the state internet information department with the overseas recipient, and file with the provincial internet information department at its location within 10 working days from the effective date of the contract[9]

  • The data processor is not a CIIO;
  • The data provided overseas does not contain important data, only personal information;
  • Has provided personal information to overseas entities totaling more than 100,000 individuals but fewer than 1 million (excluding sensitive personal information), or fewer than 10,000 individuals of sensitive personal information, since January 1 of that year.[10].

(3) Personal Information Protection Certification Path

According to Article 8 of the Regulations on Promoting and Standardizing Cross-Border Data Flows, data processors other than operators of critical information infrastructure may achieve compliant cross-border data transfers by obtaining personal information protection certification if, since January 1 of the current year, they have cumulatively provided more than 100,000 but fewer than 1,000,000 individuals’ personal information (excluding sensitive personal information) or fewer than 10,000 individuals’ sensitive personal information overseas. Pursuant to Article 38 of the Personal Information Protection Law and relevant certification rules (such as the already implemented Measures for Certification of Personal Information Cross-Border Transfer), enterprises may complete personal information protection system certification through third-party certification bodies. For continuous, large-scale, and high-frequency cross-border data scenarios such as Token outbound transfers, the personal information protection certification system can effectively reduce repetitive compliance costs and align with the operational needs of常态化 API-based cross-border services.

Regardless of the outbound data pathway chosen, enterprises must implement security measures such as anonymization and de-identification of data transmitted via APIs, adhering to the principle of data minimization. If technical means can achieve irreversible anonymization, rendering the data incapable of identifying any specific individual, the data will no longer be considered personal information subject to cross-border transfer; however, if sensitive data is involved, a separate security assessment is still required. Additionally, enterprises must maintain comprehensive logging and auditing of all outbound data to comply with regulatory post-facto verification requirements.

2. Technical Export Control Compliance Obligations

Pursuant to Article 13 and Article 14 of the People's Republic of China Export Control Law (the “Export Control Law”) and the Catalogue of Technologies Prohibited or Restricted for Export from China (the “Catalogue”), AI large models, core algorithms, and similar technologies may fall within the scope of technologies restricted for export under the Catalogue; therefore, when enterprises provide related API services to overseas parties:

  • For technologies subject to export restrictions, a corresponding export license must be obtained in accordance with the law;
  • Even if the relevant technology is not listed in the controlled catalog, if a company “knows or should know” that the services will be used for activities endangering national security and interests, terrorism, or weapons of mass destruction, it still has a legal obligation to proactively declare and apply for a license, and cannot claim exemption by asserting ignorance of the final use.
  • Strictly fulfill the obligation to verify export control lists, and do not provide Token services to overseas organizations or individuals listed on controlled lists.

3. Legal Security and Governance Obligations

(1) Model Security and Anti-Theft Obligations

Pursuant to Article 21 of the Cybersecurity Law and Article 27 of the Data Security Law, enterprises shall establish and improve comprehensive data security management systems, organize data security training, and implement technical measures to prevent network attacks, intrusions, and other activities that endanger cybersecurity. In response to the risk that overseas entities may conduct "model distillation" or "model theft" through high-frequency access, enterprises are advised to adopt technical measures such as access frequency control, anomaly behavior monitoring, and watermark tracing, and to explicitly prohibit reverse engineering in contracts to prevent the leakage of core algorithms and model parameters.

(2) Obligation for data content security

Pursuant to Article 12 of the Cybersecurity Law and Article 8 of the Data Security Law, enterprises shall not transmit through APIs any content that endangers national security, harms public interests, or infringes upon the legitimate rights and interests of others; they shall establish mechanisms to monitor and block outbound content risks and filter illegal or non-compliant information from API outputs.

(3) Obligation to retain logs and cooperate with supervision and inspection

Pursuant to Article 23, Item (3) of the Cybersecurity Law, enterprises shall retain relevant network logs for no less than six months; pursuant to Article 35 of the Data Security Law, enterprises shall cooperate with lawful inspections and supervision by public security, national security, and other relevant departments. If an enterprise qualifies as a “processor of important data,” it shall also, in accordance with Article 30 of the Data Security Law, regularly conduct data security risk assessments and submit assessment reports.

4. Coordination of Computing and Power with Green Computing Regulatory Requirements

In accordance with relevant policies on the "East Data, West Computing" initiative and green, low-carbon requirements for data centers, data centers engaging in computational power outbound services must meet:

  • Complies with national PUE energy consumption standards;[11];
  • Prioritize the use of renewable energy and fulfill responsibilities for green power consumption;[12];
  • Standardize electricity pricing and trading mechanisms to avoid using electricity at clearly unreasonable low prices, which could be deemed as “specific financial contributions” subject to international trade investigations, thereby triggering the risk of anti-subsidy investigations.

III. Compliance Challenges of Computing Power Going Global

(1) Challenges at the domestic regulatory level

The business classification remains unclear, and regulatory frameworks are yet to be defined: Under the current regulatory system, outbound computing power lacks a clear upper-level legal classification and may be categorized as data cross-border transfer, technology export, or internet information services. Additionally, there are currently no specific regulatory guidelines or pilot directives tailored to outbound computing power, forcing companies to independently justify compliance pathways under general rules. However, this situation is improving: on one hand, the 2026 ODI sensitive industry list has explicitly included AI infrastructure (including outbound computing centers and data centers) in the category of “requiring careful filing or approval”[14]; on the other hand, the Cyberspace Administration of China is “working with relevant industry regulators to gradually refine and clarify specific data cross-border transfer scenarios by industry sector,” indicating that regulators have begun paying attention to this emerging business model.

The threshold for cross-border data transfer is easily triggered, creating a conflict between compliance costs and business models: Under the Token outbound model, user interactions abroad may themselves constitute personal information or sensitive personal information, and API calls exhibit continuous and large-scale characteristics, making it easy for companies to reach the security assessment thresholds of 1 million individuals' personal information or 10,000 individuals' sensitive personal information. Meanwhile, the lengthy security assessment cycle, high documentation requirements, and comprehensive review procedures clearly conflict with the need for rapid iteration in AI businesses, particularly forming a substantive barrier to entry for small and medium-sized AI enterprises.

The combined constraints of objective criteria for cross-border data transfer and penetration-based technical regulation: China’s regulators apply objective criteria to determine cross-border data transfers—any query or retrieval of interactive content by overseas users via API interfaces constitutes a cross-border data transfer. In cloud computing services deployed overseas, data flows continuously cross borders, and session logs and interactive information frequently intersect with regulations governing personal information and important data, making it difficult for enterprises to evade compliance obligations by merely deploying infrastructure domestically. Meanwhile, the comprehensive control principle of the Export Control Law applies broadly; open API interfaces are difficult to fully verify for overseas users’ intended purposes. When combined with technical methods such as model distillation, these scenarios are easily identified by regulators as indirect technology exports, exposing domestic enterprises to dual legal risks of inadvertent violations.

Tension in cross-border enforcement of content security and data retention: Under the Cybersecurity Law and Data Security Law, enterprises have legal obligations to ensure network security, prevent the spread of illegal information, and retain log records. In cross-border scenarios, domestic enterprises have limited control over content generated by overseas users, and significant differences in legal standards across jurisdictions frequently lead to conflicts. Moreover, obligations related to cross-border data retention and cooperation in data access may directly conflict with overseas data protection laws and data localization rules, creating dual compliance pressures or even legal conflicts.

(2) Challenges at the overseas regulatory and international trade levels

Data cross-border transfer requirements in the EU and major jurisdictions are high: After the adoption of the EU-US Data Privacy Framework (DPF) in 2025, U.S. cloud service providers that complete certification can receive EU personal data without needing to separately execute Standard Contractual Clauses (SCCs). In contrast, Chinese companies neither benefit from bilateral adequacy determinations nor can easily apply Binding Corporate Rules (BCRs); when providing token services to EU users, they must individually complete a Transfer Impact Assessment (TIA), conduct due diligence on overseas recipients, sign and file SCCs, resulting in significantly higher compliance costs than their U.S. counterparts. Meanwhile, major markets such as the UK, Canada, Japan, and South Korea have established localized data cross-border rules based on GDPR, further increasing corporate compliance costs.

Global AI-specific legislation introduces new compliance obligations: The European Union’s AI Act has officially taken effect, implementing risk-based regulation for AI services. Additionally, state-level AI laws in the United States, the UK’s AI Regulatory White Paper, and South Korea’s Act on the Promotion of the AI Industry and Ethical Standards are all strengthening requirements around algorithmic transparency, compliant training data, and user rights remedies. The Token outbound model makes it difficult for foreign regulators to conduct on-site inspections, increasing the likelihood that overseas service providers will be presumed high-risk with reversed burdens of proof, significantly raising the difficulty for companies to demonstrate compliance.

Geopolitical tensions and technology controls create market access barriers: Some countries, citing national security, impose measures such as procurement restrictions and entity list screenings on AI services from China, including:

  • Include the relevant API services within the scope of government procurement restrictions;
  • Key industries are prohibited from using overseas AI model services;
  • Restrict computational power access through entity lists, end-user verification, and other methods.

These measures are clearly geographically targeted, causing companies to face de facto market exclusion even if they meet data and AI compliance requirements.

The advantage of coordinated computing and power resources faces the risk of anti-subsidy investigations: The price advantage derived from western green electricity and low-cost power constitutes China’s core competitiveness in exporting computing power, but under international trade rules, it may be converted into a actionable subsidy risk. According to the WTO Agreement on Subsidies and Countervailing Measures (SCM Agreement), if an importing member determines that the following conditions exist:

  • A government or public institution of a country provides financial support to a specific industry or enterprise;
  • The grant is "specific";
  • and causes or threatens to cause material injury to the domestic industry of the importing member;

Importing members may initiate a countervailing duty (CVD) investigation. Domestic electricity price preferences for specific computing centers, if determined to be specific financial subsidies, may trigger a countervailing duty investigation and corresponding countervailing duties.

Digital services taxes and cross-border tax rules introduce additional costs: Globally, an increasing number of countries—including the UK, India, Italy[15], the EU, South Korea[16], and Canada[17]—have implemented or are planning to implement digital services taxes (DST), typically imposing unilateral taxes of 1.5%–5% on revenues from cross-border digital services, advertising, and data monetization[18]. Compute API services may fall within the scope of DST in multiple jurisdictions, and enterprises earning cross-border service income without a permanent establishment abroad may face risks of double taxation. Additionally, starting January 1, 2026, China will reclassify telecommunications services from value-added telecommunications to basic telecommunications, increasing the VAT rate from 6% to 9%, which may raise domestic tax burdens for compute-exporting enterprises[19].

Four: Compliance Recommendations for Hashpower Export

(1) Domestic compliance recommendations

The business classification remains unclear: Prior to the issuance of specific regulations, enterprises should simultaneously fulfill obligations related to data cross-border transfer, technology export, and algorithm registration. It is recommended to proactively communicate with local cyberspace and commerce authorities to obtain administrative guidance.

Regarding data cross-border thresholds: Implement a mechanism of “categorized and graded data outbound control + dynamic monitoring” to real-time anonymize and de-identify user interactions with overseas parties, aiming to keep the volume of personal information transferred abroad below the threshold. For enterprises that have reached the threshold, it is recommended to prepare security assessment materials in advance and evaluate the applicability of certification pathways.

To address technology export risks: Explicitly prohibit model distillation, reverse engineering, and similar activities in the API service agreement; implement technical measures such as access frequency controls and anomaly behavior monitoring; and establish a final user risk screening mechanism.

Addressing the conflict between content security and data retention: Establish a layered content moderation system to filter user-generated content from overseas users; meanwhile, assess data localization requirements in foreign jurisdictions and consider establishing independent nodes overseas if necessary.

(2) Overseas Compliance Recommendations

Regarding the EU’s cross-border data transfer thresholds: Consider partnering with cloud service providers that have passed DPF certification as part of your technical data processing solution, but this does not replace your obligations as a data controller or processor under compliance requirements. For the EU market, it is recommended to engage a local data protection officer or external legal counsel to assist with completing the TIA and SCC filings to reduce enforcement risks.

For geopolitical market access: Establish a market access risk assessment mechanism, prioritizing countries or regions with a relatively open attitude toward Chinese AI services, and closely monitor updates to the target country’s export control and sanctions lists. For example, the China-ASEAN Free Trade Area 3.0 Upgrade Agreement has incorporated artificial intelligence into its cooperation framework, with specific projects already implemented in countries such as Vietnam, Thailand, Malaysia, and Indonesia[20]; South Korea signed multiple AI cooperation agreements during the China-South Korea Science and Technology Innovation Forum in March 2026[21].

Regarding the risk of countervailing duty investigations: When benefiting from local preferential policies, require the policy issuer to provide written justification and assess whether the policy is specific. At the same time, maintain a reasonable cost-plus margin in export pricing and avoid complete reliance on subsidies.

Regarding digital services tax and double taxation: Plan your tax structure in advance, consider the necessity of establishing subsidiaries overseas or operating through other forms of business presence, fully leverage bilateral tax treaties to reduce tax burdens, and closely monitor the impact of the OECD’s “Two-Pillar” international tax reform on the determination of permanent establishments for digital services and profit allocation rules.

V. Conclusion

The export of computing power serves as a new vehicle for Chinese AI computing and digital services to participate in global competition, fundamentally constituting cross-border delivery of services under the WTO General Agreement on Trade in Services. It is both a critical pathway for the market-oriented implementation of the integrated computing-power-and-electricity strategy and a core lever for China’s foreign trade transition from “goods export” to “digital services export,” combining economic, industrial, and strategic national value. Currently, this business faces multiple compliance constraints both domestically and internationally. Domestic regulation is characterized by a security-first,穿透式 (penetrating) control approach, with rules on data cross-border transfer and technology export controls forming the core compliance baseline. Internationally, companies must navigate diverse jurisdictions’ data protection laws, AI regulations, geopolitical restrictions, and international trade barriers, while also confronting practical shortcomings such as inadequate compliance systems and insufficient technical safeguards. To address these challenges, enterprises must build a dual-driven compliance framework powered by “technical risk control + legal structuring,” achieving efficient global allocation of computing resources while ensuring algorithmic security and data compliance through differentiated deployment and penetrating management.

References

[1] https://www.nbd.com.cn/articles/2026-02-26/4270613.html.

[2] https://finance.sina.com.cn/tech/digi/2026-04-23/doc-inhvmvzq3837563.shtml.

[3] http://theory.people.com.cn/n1/2026/0324/c40531-40687623.html.

[4] https://caifuhao.eastmoney.com/news/20260412072847012215160.

[5] https://openrouter.ai/minimax/minimax-m2.7;

[6] https://www.silicondata.com/use-cases/anthropic-claude-api-pricing-2026/.

[7] See Article 4 of the Measures for Security Assessment of Data Cross-Border Transfer (effective September 1, 2022); Article 7 of the Regulations on Promoting and Standardizing Cross-Border Data Flow (effective March 22, 2024).

[8] In accordance with Article 39 of the Cybersecurity Law and Article 7 of the Regulations on Promoting and Regulating Cross-Border Data Flows, CIIOs shall store personal information and important data collected and generated within China within China’s territory; if it is indeed necessary to provide such data overseas, a security assessment must be conducted.

[9] See Article 7 of the Regulations on Promoting and Standardizing Cross-Border Data Flows. Note: The threshold originally set in Article 4, Paragraph 2 of the Measures for Security Assessment of Data Outbound Transfers, which was “100,000/10,000,” has been raised by the Regulations on Promoting and Standardizing Cross-Border Data Flows to “1,000,000/10,000.”

See Article 4 and Article 7 of the Measures for the Standard Contract for Cross-Border Transfer of Personal Information (effective June 1, 2023).

[10] See Article 8 of the Regulations on Promoting and Standardizing Cross-Border Data Flows.

[11] https://www.ndrc.gov.cn/xxgk/zcfb/tz/202407/P020240723625582947550.pdf?f_link_type=f_linkinlinenote&flow_extra=eyJpbmxpbmVfZGlzcGxheV9wb3NpdGlvbiI6MCwiZG9jX3Bvc2l0aW9uIjowLCJkb2NfaWQiOiJlOGIwNGRiZGY1OTIzMjIxLTdiODk3ZDU0MzEzYTRiYmYifQ%3D%3D.

[12] https://www.gov.cn/lianbo/bumen/202407/content_6964334.htm?f_link_type=f_linkinlinenote&flow_extra=eyJpbmxpbmVfZGlzcGxheV9wb3NpdGlvbiI6MCwiZG9jX3Bvc2l0aW9uIjowLCJkb2NfaWQiOiI4ZTQzZDE5OGNjYjhhNDUzLWY2NGQwNmNmNDkyNmNkMjQifQ%3D%3D.

[13] https://www.gov.cn/gongbao/2026/issue_12586/202602/content_7059937.html?f_link_type=f_linkinlinenote&flow_extra=eyJpbmxpbmVfZGlzcGxheV9wb3NpdGlvbiI6MCwiZG9jX3Bvc2l0aW9uIjowLCJkb2NfaWQiOiJkZmRjYTljNDM1ZDU4NWUyLTA4NWVmOWJjNDE2ZTYxMGIifQ%3D%3D.

[14] https://www.zfwx.com/wxqt/package/target/lisrea/37215.html.

[15] https://www.163.com/dy/article/F9I6M19L05502ZGU.html

[16] https://news.qq.com/rain/a/STO2018103000051500?web_channel=wap&openApp=false&suid=&media_id=

[17] https://www.163.com/dy/article/EVMS659C0514R9OJ.html

[18] https://www.sohu.com/a/1006711778_120635327?scm=10001.325_13-325_13.0.0-0-0-0-0.5_1334&spm=smpc.channel_248.block3_308_NDdFbm_1_fd.1.1775621473208d337yoW_324

[19] https://www.financialnews.com.cn/2026-02/02/content_442739.html

[20] https://dzswgf.mofcom.gov.cn/news/phone/183/2026/3/m-1773207277788.html

[21] https://www.globaltimes.cn/page/202603/1357655.shtml

Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information. Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.