Business Overview

In November 2020, the China Banking and Insurance
Regulatory Commission, or the CBIRC, and the PBOC,
published the draft Interim Measures for Online
Small Loan Business, or the Draft Online Small Loan
Measures, for public comment. The Draft Online Small
Loan Measures provide, among others, that:
• an online micro-lending company must obtain
the CBIRC’s approval before carrying out
online small loan business across two or more
provinces;
• an online micro-lending company shall provide
at least 30% funding for any single co-lending
loan and keep its overall debt financing amount
within five times of its net assets; and
Anti-money Laundering Regulation
The PRC Anti-money Laundering Law, which became
effective on January 1, 2007, sets forth the principal
anti-money laundering requirements applicable
to both financial and non-financial institutions
with anti-money laundering obligations, such as
Alipay, including the adoption of precautionary and
supervisory measures, establishment of various
systems for client identification, preservation of clients’
identification information and transactions records,
and reports on block transactions and suspicious
transactions. The Payment Services Measures also
require that the payment institution follow the rules
associated with anti-money laundering and comply
with their anti-money laundering obligations.

• the amount of the balance of the loan that an
online micro-lending company may provide to
an individual or entity shall not exceed, in the
case of an individual, the lower of RMB300,000
or one third of the individual’s average annual
income for the past three years, and, in the case
of a legal person or organization, RMB1 million.
Under the Draft Online Small Loan Measures, existing
online small loan companies with businesses
across provinces will have a three-year transition
period to obtain the required approval and adjust
their businesses as necessary to be in compliance
with these measures. The Draft Online Small Loan
Measures, if enacted in substantially the form
published for public comment, will change regulatory
requirements for online small loan business in various
other respects. In addition, in January 2021, the PBOC
published the draft Regulations on Non-bank Payment
Institutions and the draft Administrative Measures for
Credit Reporting Services, or the Draft Credit Reporting
Services Measures, for public comment. The draft
Regulations on Non-bank Payment Institutions set
out, among others, specific requirements for the
qualifications of shareholders, the business operations
and the legal liabilities of a non-bank payment
institution, as well as regulatory supervision focusing
on unfair competition and abuse of dominant market
position. The Draft Credit Reporting Services Measures
stipulate the collection, sorting, storage, processing,
provision, use, safety, cross-border flow, management
and supervision of credit information, which includes
various types of information used to determine the
credit status of individuals and enterprises as well
as the analysis and evaluation of the credit status of
individuals and enterprises based on such information.
In addition, the PBOC promulgated the Administrative
Measures for Payment Institutions Regarding
Anti-money Laundering and Counter Terrorism
Financing on March 5, 2012, or the Anti-money
Laundering Measures, according to which the
payment institution must establish and improve
unified anti-money laundering internal control
systems and file their systems with the local branch
of the PBOC. The Anti-money Laundering Measures
also require the payment institution to set up an
anti-money laundering department or designate an
internal department to be responsible for anti-money
laundering and counter terrorism financing work.
Alipay is in the process of expanding its business
internationally, and it may become subject to
additional laws, rules and regulations of the
jurisdictions in which it chooses to operate. These
regulatory regimes may be complex and require
extensive time and resources to ensure compliance.
Data Protection Regulation in Europe
On May 25, 2018, EU Directive 95/46/EEC was replaced
by the GDPR on the protection of natural persons
with regard to the processing and free movement
of personal data. The GDPR applies directly in all EU
member states from May 25, 2018 and applies to
companies with an establishment in the European
Economic Area, or the EEA, and to certain other
companies not in the EEA that offer or provide goods
or services to individuals located in the EEA or monitor
individuals located in the EEA. The GDPR implements
more stringent operational requirements for
controllers of personal data, including, for example,
expanded disclosures about how personal information
is to be used, limitations on retention of information

84 Alibaba Group Holding Limited