China’s first anti-cross-border corruption law: what MNCs must know and do now

On November 6, 2026, China’s top legislature adopted the Anti-Cross-Border Corruption Law (the ACBC), China’s first dedicated international anti-corruption statute. It took effect the same day.

For multinational companies (MNCs), the headline is straightforward: Anti-corruption compliance in China is no longer just good practice. It is now the law. China branches and subsidiaries must investigate policy violations, conduct due diligence on the third parties they engage, and maintain a full compliance program. At the same time, the ACBC restricts cooperation with foreign enforcement authorities without Chinese approval. These duties sit at the China-entity level, but the decisions they drive belong to headquarters: global program design, investigation protocols, and how to respond when a foreign regulator calls.

 I. Legislative objectives and scope

Three objectives. The ACBC is designed to do three things:

• Bring back fugitives and assets. It places China’s long-running Operation Sky Net campaign on a statutory footing, including exit restrictions, repatriation, and asset recovery.
• Police outbound bribery. It targets bribery abroad by Chinese companies and their overseas operations.
• Combat inbound bribery. It reaches bribes paid by foreign persons to Chinese officials and state-owned enterprises.¹

Who enforces it. The ACBC establishes a whole-of-government enforcement network under a single lead:

• The lead: The National Supervisory Commission (NSC) coordinates more than 10 agencies, from foreign affairs and public security to the State-owned Assets Supervision and Administration Commission of the State Council (SASAC), financial and securities regulators, and the cyberspace authority.
• The case handlers: The NSC, public security organs, procuratorates, and courts handle enforcement cases.
• The early-warning system: Commerce, SASAC, market, and financial regulators monitor high-risk sectors, while anti-money laundering, audit, and tax authorities must refer suspicious leads. For instance, a red flag spotted by an anti-money laundering regulator, an auditor, or a tax officer can now travel directly to anti-corruption investigators.

 II. Continuity and change within the existing framework

What is new. The most significant change is that anti-corruption compliance, until now a matter of policy guidance, is a statutory obligation for companies engaged in cross-border business. Violations are also entered into credit records, which can affect licensing and market access.

What is consistent. Much of the ACBC builds on familiar ground:

• It creates no new offenses. Criminal liability continues to arise under the PRC Criminal Law, which has criminalized bribery of foreign officials and officials of international public organizations since 2011.
• Domestic commercial bribery remains governed by the Criminal Law and the Anti-Unfair Competition Law. The ACBC supplements these laws rather than displacing them.
• The ACBC anchors China’s approach in the United Nations Convention against Corruption, which it calls the “main channel” for international anti-corruption cooperation.
• Whistleblower rewards and protection, aggravating factors, and mitigation for self-reporting, cooperation, and remediation all reflect established enforcement practice.
• The restriction on providing evidence abroad builds on earlier judicial assistance and data laws (see section IV).

III. The statutory compliance mandates

The ACBC sets out a mandatory compliance program for enterprises engaged in cross-border business, a term that expressly includes foreign companies’ China branches and subsidiaries. The six statutory mandates are:

• Governance and resources. Establish integrity compliance systems and embed them in decision-making, execution, and oversight. “Domestic enterprises”² must also staff compliance functions in proportion to their size, business scope, and risk profile.
• Investigations. Investigate and address violations promptly.
• Risk assessment and internal reporting. Identify and assess integrity risks, strengthen internal reporting channels, and respond to risks through monitoring and remediation.
• Books and records. Keep accounting records accurate and complete, and never use accounting to commit or conceal corruption. Unlike the accounting provisions of the Foreign Corrupt Practices Act (FCPA), which reach only issuers, this duty applies to every covered enterprise.
• Third parties. Conduct due diligence on third parties, monitor their conduct, and bind them to the company’s integrity code of conduct. Using intermediaries to commit corruption is expressly prohibited.
• Training. Provide integrity education and compliance training to employees.

Why it matters. These elements broadly track the Evaluation of Corporate Compliance Programs issued by the U.S. Department of Justice (DOJ) and the six principles set out in the UK Ministry of Justice’s “adequate procedures” guidance under the Bribery Act 2010. The critical distinction is legal status. Under the FCPA, apart from issuers’ internal accounting controls obligation, a compliance program is not legally required, though it weighs heavily in charging and resolution decisions. Under the UK Bribery Act 2010, “adequate procedures” constitute a complete defense to the section 7 offense of failure to prevent bribery. The ACBC takes a different approach: the absence of an adequate program is itself a breach of statutory duty. Competent authorities may order rectification within a set period and, if the company fails to comply, suspend its business, order it to suspend operations for rectification, or revoke its business permits, even where no bribe is ever proven.

 IV. Geopolitical context and cross-border investigations

A sword and a shield. The ACBC is both an enforcement tool and a response to what Beijing views as foreign long-arm jurisdiction. The law authorizes countermeasures and blocking measures under the Anti-Foreign Sanctions Law where a foreign state uses anti-corruption “as a pretext” or applies its laws extraterritorially in an improper way. It arrives amid continuing U.S.-China trade tension.

Nothing new on blocking, but now explicit. Article 25 bars foreign institutions, organizations, and individuals from conducting anti-corruption investigations or other enforcement activities in China, directly or through others, and bars persons in China from providing evidence, data, or other assistance to foreign institutions, organizations, or individuals to support enforcement activities, without the consent of the relevant PRC authorities. Article 4 of the International Criminal Judicial Assistance Law (2018) already prohibits providing evidentiary materials or assistance to foreign countries without the consent of the competent PRC authorities. Article 36 of the Data Security Law (2021) likewise provides that, “without the approval of the competent authorities of the People’s Republic of China, organizations or individuals in the People’s Republic of China shall not provide data stored within the territory of the People’s Republic of China to any overseas judicial or law enforcement body.” Article 41 of the Personal Information Protection Law (2021) is to the same effect.

The practical consequences depend on who is asking:

• Foreign government enforcement. Producing China-located documents, data, or witnesses to the U.S. DOJ, the Securities and Exchange Commission or other foreign authorities, including through a parent company, requires approval through treaty or competent-authority channels.
• Internal investigations and third-party diligence. A reasonable reading, though untested, is that article 25 targets foreign enforcement activity, not bona fide corporate internal investigations. After all, the ACBC itself requires companies to investigate and to vet third parties. The sensitive point is any transfer of evidence outside China, whether to a foreign authority or to a foreign parent in a foreign enforcement context. China’s data-export rules also continue to govern transfers of personal information and important data to headquarters. This is why, since 2018, many MNCs have moved to an in-country investigation and remediation model designed to satisfy both Chinese and home-country law.
• Requests from PRC authorities. Chinese authorities may use evidence obtained abroad through judicial assistance, and may request cooperation from foreign companies and individuals in major cases on a reciprocal basis. The ACBC penalizes refusing to provide evidence or obstructing an investigation, so China-based companies and their senior executives should be ready to respond.

Bottom line: Assess whether each inquiry is, in substance, internal or government-directed, and keep the workstreams distinct.

 V. Self-disclosure: restatement or new mandate?

Article 31 provides that enterprises that discover suspected cross-border corruption must report it “in accordance with law” to the supervisory organs or public security authorities. Some commentators read this as a new mandatory self-disclosure regime. We see it differently, for three reasons:

• The reporting sentence is framed by reference to existing law (“依法”) rather than as a freestanding duty.
• Article 110 of the Criminal Procedure Law (2018 Amended) already gives any entity or individual that discovers facts of a crime both the right and the duty to report them to the public security organs, the procuratorate, or the courts. In our view, lawmakers intended to restate that existing obligation, not to create a new self-disclosure regime.
• Article 31 is silent on the evidentiary threshold, the timing, and the interaction with the ACBC’s mitigation provisions.

The more consequential shift is practical. Before 2018, MNCs commonly made parallel self-disclosures under PRC anti-bribery laws and the FCPA. Because cooperation with foreign enforcement now runs through the judicial assistance and approval channels described in section IV, self-disclosure strategy demands much closer coordination between headquarters and China. Pending further guidance, companies should adopt a documented, case-by-case escalation process for assessing PRC reporting.

VI. The ACBC and the FCPA: differences in scope and reach

Beyond the compliance mandate discussed in section III, the two statutes differ chiefly in scope and reach:

Issue	ACBC	FCPA
Covered conduct	Five categories (see footnote 1)	Bribery of foreign officials, and accounting provisions for issuers
Commercial bribery	The ACBC refers broadly to bribery and other duty-related misconduct, which commentators read as reaching private-sector bribery abroad	Not covered; U.S. authorities rely on the Travel Act and fraud and money laundering statutes
Demand side	Covers acceptance of bribes by Chinese officials	Supply side only; the Foreign Extortion Prevention Act criminalizes demands for bribes by foreign officials
Jurisdictional reach	Nationality-based, territorial (foreign persons who bribe while in China), and effects-based	Issuers, domestic concerns, and persons acting in U.S. territory (the last often established through a U.S. dollar or email nexus)
Defenses	None stated	Facilitating-payments exception; affirmative defenses
Penalties	No new criminal penalties; administrative measures (rectification, suspension, license revocation, credit records) for compliance failures; otherwise, existing criminal, administrative, and civil law applies	Criminal and civil fines, imprisonment, disgorgement, monitorships

Two takeaways stand out. Conduct outside the FCPA, such as purely commercial bribery involving Chinese counterparties, may still fall within the ACBC. And a single set of facts may now engage both regimes, which can pull in opposite directions on disclosure and evidence sharing.

VII. Action items for headquarters

Pending the implementing guidance the ACBC contemplates, headquarters should consider the following steps:

1. Map the footprint. Identify which group entities are covered, including China branches and subsidiaries, and assign clear ownership of compliance obligations at the local and regional levels, with defined headquarters oversight.
2. Benchmark the program. Assess the China program against the six statutory mandates, with documentation maintained at the China-entity level.
3. Tighten third-party management. Verify beneficial ownership, confirm that services were actually delivered, and strengthen contractual compliance protections.
4. Build a request protocol. Route any foreign authority request involving China-located evidence or data to the legal team for review before anything is produced.
5. Plan disclosure strategy. Develop an escalation framework that weighs PRC reporting and cooperation credit alongside home-country self-disclosure regimes, and brief boards and senior management on potential conflicts of law.

1. The ACBC defines “cross-border corruption” to cover five categories of conduct: (1) bribery of foreign public officials or officials of international public organizations by Chinese persons and entities, including their branches and subsidiaries, or by foreign persons and entities within China; (2) bribery of Chinese public officials, their specified related persons, or public bodies by foreign persons and entities, together with the related acceptance of bribes; (3) other duty-related misconduct committed abroad by Chinese persons and entities, such as embezzlement, abuse of power, and improper transfer of benefits; (4) similar corrupt conduct carried out wholly or partly abroad with results wholly or partly in China; and (5) flight abroad by corruption suspects and the cross-border transfer of corrupt assets.

2. Article 30(2)’s staffing requirement is addressed to “domestic enterprises” engaged in cross-border business, while article 29 lists foreign enterprises’ China branches and subsidiaries separately. Until regulators clarify the point, we recommend that foreign-invested China subsidiaries assume the staffing requirement applies to them.

Client Alert 2026-209