Buying a Chinese Company: What Must a Foreign Investor Check Before Signing and Closing?

1. Direct answer: resolve four questions before signing

A foreign buyer should identify what it is buying, whether it may buy it, what legal and operational control it will actually receive, and how closing can occur safely. A share purchase generally leaves historic liabilities in the target. An asset deal can select assets and liabilities, but licences, employees, contracts, land rights and data may not transfer automatically. A capital increase adds funding, dilution and existing-shareholder issues. The structure drives approvals, tax, documentation and risk allocation.

Before signing binding documents, prepare a regulatory pathway, a diligence exceptions schedule and a closing-condition matrix. If access restrictions, control, a core licence or a potential filing obligation remains unresolved, avoid a non-refundable payment or operational integration based only on a seller assurance.

2. Test foreign-investment access, licensing and security review

China's Foreign Investment Law treats the acquisition of equity in a domestic enterprise by a foreign investor as foreign investment and applies pre-establishment national treatment plus the Negative List. Activities outside the list are generally administered on the same basis as domestic investment, but sector licensing, project approvals or filings, foreign exchange, tax and local operating conditions still require review. The 2024 national Negative List took effect on 1 November 2024. A registered business scope is not a complete description of the target's products, customers, technology or regulated activities.

Assess the foreign-investment security review where the transaction concerns national defence or may confer actual control over an enterprise in an important field identified by the measures, including critical technology, information technology and internet products and services, infrastructure, transport, energy and financial services. Offshore layers, staged purchases or a different deal label do not eliminate a substance-based review of the investment chain, actual control and national-security impact.

• All actual products, services, revenue streams and licences
• Nationality, ownership and control chain of the investor and ultimate controller
• Negative List restrictions, sector licences and project approvals or filings
• Important sectors, critical technology, data or infrastructure and actual control
• Filing responsibility, timetable and allocation of failure and transaction costs

3. Merger control: do not implement before clearance

An acquisition of control or the ability to exercise decisive influence may be a concentration of undertakings. If the State Council turnover thresholds are met, the concentration must be notified to the State Administration for Market Regulation and must not be implemented before clearance. A transaction below the thresholds may still warrant assessment where it may eliminate or restrict competition. Calculate turnover for the relevant participating undertakings and groups, including China turnover.

The transaction agreement should address notification cooperation, information, the acceptable scope of remedies and a long-stop date. The parties may plan integration after signing, but should not prematurely align prices, customers, procurement, staffing or commercial decisions. Use clean teams and information controls for competitively sensitive material where appropriate.

4. Verify corporate history, capital and the control chain

Review formation and equity-change documents, articles, shareholder registers, registration files, contribution evidence, valuation materials, equity pledges, judicial freezes, nominee arrangements and beneficial ownership. China's Company Law, effective from 1 July 2024, materially changed contribution periods and responsibility connected with transferred equity. Do not treat registered capital as cash received: verify each shareholder's subscribed amount, due date, payment evidence and any risk of accelerated contribution.

Identify who controls company chops, licences, online banking, finance and tax systems, e-signatures, servers and key accounts. Completion of an equity registration change does not itself transfer operational control. These items should appear in the closing deliverables and be verified through handover records, password resets and bank mandates.

• Consistency among articles, shareholder register, resolutions and registry filings
• Contribution deadlines, bank evidence and title and valuation of non-cash contributions
• Pledges, freezes, nominees, repurchase rights and third-party interests
• Chops, licences, banking, finance, tax, domain and administrator credentials
• Funding, guarantees and assets moving between the target, seller and affiliates

5. A balance sheet does not reveal every legacy liability

After a share acquisition, the target generally continues to bear contractual, tax, employment, regulatory, tort and litigation liabilities. Coordinate legal work with financial, tax, commercial, technical and environmental diligence. Cross-check material contracts, bank records, invoices and filings, employees and social insurance, litigation and enforcement, penalties, land and premises, environmental records and counterparty confirmations. Off-balance-sheet guarantees, related-party transactions and receipts through personal accounts deserve particular scrutiny.

For each issue, record the trigger, responsible entity, credible exposure, ability and time to cure, and supporting evidence. Do not bury every exception in one general indemnity. Allocate it to pre-closing remediation, a price adjustment, escrow or holdback, a specific indemnity, insurance or a termination right.

6. Verify data, intellectual property and key contracts

Software, trade marks, patents, domains, know-how and data may drive valuation, but operational use does not prove ownership. Verify registrations, assignments from employees and contractors, open-source software, licence restrictions, employee inventions, disputes and continued access to core technology. Customer lists, transaction data and employee information should not be described simply as 'owned by the company'.

The data room itself may contain personal information and sensitive commercial records. Apply need-to-know access, redaction, download controls and logs. China's Personal Information Protection Law addresses transfers of personal information resulting from a merger, division, dissolution or bankruptcy: individuals must be informed of the recipient, which continues the handler's obligations, and a change of purpose or method may require renewed consent. The deal structure and intended use still require specific analysis.

• Registered owner, actual user, licence scope and renewal status of core rights
• Assignments and confidentiality from employees, vendors and development partners
• Open-source software, third-party data, APIs, cloud services and export restrictions
• Data categories, purposes, locations, disclosures and cross-border flows
• Data-room permissions, redaction, access logs, downloads and post-closing treatment

7. Convert diligence findings into closing conditions and remedies

A closing condition should be objective, evidenced and linked to the relevant risk: receipt of merger-control or security-review clearance, amendment or continuity of a sector licence, release of an equity pledge or affiliate guarantee, execution of an IP assignment, consent from a material customer, capital remediation, and a bring-down of warranties at closing. Avoid conditions that provide no objective test of completion.

Define the standard of effort for approvals, the acceptable boundary of remedies, extension and termination rights, treatment of deposits and expenses, and dispute resolution. For material exposure, consider escrow or a purchase-price holdback and separate survival periods and caps for tax, environment, IP and data claims.

8. A 30-day pre-signing action plan

This sequence suits an overseas buyer that has identified a target and is preparing binding documents. A regulatory deadline or risk of asset dissipation requires an accelerated, matter-specific response.

• Days 1–3: confirm the investor, ultimate controller, structure and funding path
• Days 4–7: screen the Negative List, licences, security review and merger control
• Days 8–14: verify corporate history, capital, security, contracts, tax, employment, disputes and assets
• Days 15–19: run focused data, IP, land, environmental and critical-technology review
• Days 20–23: issue a red-flag report with quantified and unverified matters
• Days 24–27: allocate each risk to cure, price, escrow, indemnity, insurance or termination
• Days 28–30: complete the conditions matrix, deliverables, signing authority and closing-day verification plan