On 2 March 2026, the Ministry of Public Security closes the consultation on the Law on the Prevention and Control of Cybercrime. Article 13 requires individuals and organisations providing services such as network access, domain name registration, server hosting, space rental, and content or application distribution to register identity information, installation addresses, and the scope of use when opening network and telephone lines. Further, Article 15 requires individuals and organisations that produce, sell, or provide equipment, software, tools, or services with functions including batch control of accounts or terminals, virtual network positioning, system intrusion or control, or other tools identified as facilitating cyber violations, to file with public security, telecommunications, and other competent authorities. In addition, they must register the real identity information of purchasers and users, in accordance with filing rules to be jointly issued by the State Council’s public security authorities and relevant departments. Additionally, Article 45 requires profit-making institutions that provide services such as vulnerability detection and penetration testing to file with public security authorities at or above the municipal level, and to strengthen the training and management of relevant personnel. In terms of enforcement, violations of Article 13 may result in fines of one to ten times the unlawful gains, or up to RMB 200’000 where unlawful gains are below RMB 20’000. Where violations of Article 29 disrupt network order, potential measures include licence suspension or revocation, service shutdowns, fines of one to ten times the unlawful gains (or up to RMB 500’000 where unlawful gains are below RMB 50’000), and detention of up to 15 days. Moreover, failure to register cybersecurity testing services may lead to corrective orders, warnings, and fines ranging from RMB 50’000 to RMB 5 million.
Original source