6 godz. temu
China Rolls Out New Financial Data Classification Rules as Cybersecurity Oversight Tightens
China's top internet regulator has released new guidance on how financial-sector data must be categorized, labeled and protected, adding to Beijing's expanding cybersecurity rulebook.
The Cyberspace Administration of China (CAC) issued the guidelines on June 13, setting out a classification and grading framework for financial services data. The document gives financial institutions operating in China more explicit standards for distinguishing sensitive information from higher-risk categories, including data regulators deem "important."
A central focus is the identification and management of "important data," a designation that carries compliance implications under China's regulatory system. Once data falls into this category, requirements around storage, processing and, in particular, cross-border transfers become more stringent. The scope also covers financial information service providers, including platforms that distribute market data and research.
The guidance reiterates alignment with three core national laws: the Cybersecurity Law, the Data Security Law and the Personal Information Protection Law. Cross-border data movement receives heightened attention, reflecting regulators' stated priorities around national security and consumer protection.
The CAC move follows earlier sector measures. The National Financial Regulatory Authority (NFRA) introduced banking and insurance data rules in December 2024. The People's Bank of China (PBOC) has its own data security measures scheduled to take effect on June 30, 2025. By January 24, 2026, the CAC had circulated a draft aimed at financial information service providers, outlining risk-based data classification and foreshadowing the finalized June guidance.
Notably, the new guidelines do not reference crypto tokens or digital assets, signaling that authorities continue to treat digital assets and traditional financial services as separate regulatory tracks.
For banks, insurers, market data providers and related firms, the compliance burden is increasing. Foreign companies with China operations may face added friction, as tighter cross-border transfer rules can affect routine reporting to parent entities and internal sharing of analytics. Combined, the NFRA rules, PBOC measures and CAC guidelines create a multi-layer compliance framework for the sector.