Do I Need a License to Operate Online in China? A Guide for Foreign Companies

China internet business licenses are a critical but often misunderstood requirement for foreign companies planning to operate websites, apps, or digital platforms in China. This guide explains which licenses apply to different online business models, what risks companies face if they get it wrong, and how recent policy changes are reshaping market access for foreign investors.

If you’re a foreign company planning to run a website, app, or digital platform in China, one question will come up before almost anything else: Do I need a license for this?

Find Business Support

Our IT business advisors provide leadership and outsourced IT advisory services tailored to your business needs.

The answer is almost certainly yes, and probably more than one. China operates one of the most structured internet licensing systems in the world. Before a commercial website goes live, before an app goes on a Chinese app store, before a marketplace platform accepts its first third-party seller, the right permits need to be in place. Operating without them can mean fines, website shutdowns, removal from app stores, or worse.

The good news: the framework is logical once you understand it. This guide breaks down every major internet business license in plain terms, tells you which license applies to which type of business, and covers the important policy shift that has started opening China’s internet sector to greater foreign ownership.

Start here: ICP filing vs. ICP license

This is the single most common source of confusion, so let’s clear it up first.

ICP filing

An internet content provider (ICP) filing is a mandatory registration that every website, app, or mini program hosted on mainland China servers must complete, regardless of whether it’s commercial or not. It’s the baseline. If your servers are in China, you file. No exceptions. Think of it as registering your digital address with the authorities.

ICP license

An ICP license is a commercial operating permit that is required on top of the filing, specifically for websites and apps that generate revenue. Paid subscriptions, advertising, in-app purchases, and online sales – any form of monetization triggers the need for an ICP license.

One more practical detail: once your ICP filing is approved, you have 30 days to complete a Public Security Bureau (PSB) Filing, which is a separate registration with China’s public security authorities. Your ICP filing number must appear on the footer of your website, linked to the MIIT verification database.

China’s Internet license system: The big picture

All internet business licenses in China fall under value-added telecommunications services (VATS), the broad category covering everything from e-commerce to cloud software to SMS messaging. VATS licenses come in two tiers:

• Tier 1 covers network infrastructure services like data centers and internet access. These are almost entirely off-limits to foreign investment and won’t be relevant to most businesses.
• Tier 2 covers the services most businesses actually run: websites, platforms, marketplaces, apps, messaging tools, and more. This is where foreign companies spend most of their licensing attention.

Licenses are issued by MIIT (Ministry of Industry and Information Technology) for nationwide operations, and by provincial Telecommunications Administration Bureaus for single-province operations. A cross-provincial license costs more in minimum registered capital and goes through a longer approval process but lets you serve users anywhere in China.

License types: Which business needs which?

ICP license (B25) – The core commercial license

What it covers: Any website or app that charges users or monetizes in any way, including advertising revenue, subscriptions, paid downloads, in-app purchases, or fee-based services.

Businesses that need an ICP license:

• E-commerce sites selling their own products directly to consumers
• SaaS platforms and cloud-based software services
• Subscription content platforms (news, video, music, podcasts)
• Mobile apps with in-app purchases or advertising
• Online gaming platforms and live streaming services
• Websites with any paid feature or monetized content

Businesses that need only an ICP filing (not the license):

• Corporate information or brochure sites with no revenue model
• Internal tools or intranets not accessible to the public
• Non-commercial blogs or informational portals

Requirements at a glance:

• Legally registered Chinese entity (WFOE or joint venture)
• Minimum registered capital: RMB 1 million (single province) or RMB 10 million (cross-provincial)
• At least 3 dedicated employees in technical and management roles, with 3 months of social security records
• Servers hosted in mainland China at a licensed data center
• Cybersecurity officer designated and incident response plan in place

EDI license (B21) – The marketplace and platform license

What it is: An electronic data interchange (EDI) license refers to the license for online data processing and transaction processing service, which is a category of VATs.

What it covers: Online platforms that facilitate commercial transactions between third parties, where the platform acts as an intermediary between buyers and sellers, rather than selling its own goods directly.

Businesses that need an EDI license:

• Third-party marketplace platforms (any model where external vendors list products on your platform)
• Food delivery platforms connecting restaurants and consumers
• Ride-hailing or on-demand platforms with third-party service providers
• Cross-border e-commerce platforms with third-party merchant accounts
• Online ticketing platforms acting as intermediaries for events, travel, or accommodation
• B2B procurement platforms with external supplier participation
• Any platform that earns commission, transaction fees, or intermediary income

For example, if your model resembles Amazon Marketplace or Airbnb, connecting buyers and sellers who then transact, you need an EDI License. If your model resembles Nike’s own website selling Nike products, you don’t.

SP license (B23) – Mobile messaging

What it is: A service provider (SP) license refers to the license for information services via mobile communication networks, which is another category of VATS.

What it covers: Information services delivered over mobile carrier networks, primarily SMS.

Businesses that need an SP License:

• Companies sending bulk SMS to Chinese users (marketing, alerts, notifications)
• OTP / verification code services delivered via SMS
• WAP-based mobile information services
• Any business offering carrier-billed mobile content subscriptions

Capital requirements are significantly higher here: RMB 10 million (single province) and RMB 100 million (cross-provincial), reflecting the regulatory sensitivity of direct carrier-network access.

B22 licenses – Real-time multi-party communication

What it covers: Platforms that enable real-time communication between multiple parties simultaneously.

Businesses that need a B22 license:

• Video conferencing platforms
• Interactive live streaming platforms with audience participation
• Online education platforms with live interactive classes
• Remote collaboration and virtual workspace tools
• Virtual event and webinar platforms

B24 license – Call center services

What it covers: Commercial call center operations, particularly where calls are made or handled on behalf of other businesses.

Businesses that need a B24 license:

• Call center outsourcing providers handling customer service for other companies
• Outbound telemarketing service providers
• Customer consultation centers operating as third-party services

To be noted, for the B24 license, there is a minimum staffing requirement. At least 5 dedicated customer service and technical staff with social security records are required to apply for this license.

Quick reference: Which license does my business need?

What foreign companies need to know about ownership rules

The traditional rule: 50% cap

For most of China’s internet licensing history, foreign ownership of VATS-licensed businesses was legally capped at 50 percent. In practice, this meant foreign companies typically needed to form a joint venture with a Chinese partner to obtain most internet licenses. Operating as a WFOE and getting an ICP or EDI license in the same entity simply wasn’t possible outside narrow exceptions.

The 2024 pilot program: A genuine opening

On April 8, 2024, MIIT issued Circular No. 107, launching a pilot program that removes foreign ownership restrictions for most VATS categories in four designated regions:

• Beijing (the entire municipality)
• Shanghai (including the Free Trade Zone and Pudong New Area / Lingang Special Area)
• Shenzhen
• Hainan

WFOEs registered in these pilot regions, with their service infrastructure (servers and data centers) also located within the region, can now apply for ICP, EDI, CDN, ISP, multi-party communications (B22), and call center (B24) licenses with no foreign ownership cap, and can serve users nationally. By February 2025, MIIT confirmed that 13 foreign-invested companies had successfully obtained VATS licenses under the pilot program.

What remains restricted (even in pilot regions)

• Domestic IP-VPN (B13): Foreign investment still prohibited (except for up to 50 percent in FTZs or under CEPA).
• Encoding and protocol conversion (B26): Still capped at 50 percent foreign ownership.
• Certain ICP (B25) subcategories: Information search, community platforms, and instant messaging remain capped at 50 percent.
• Generative AI services: Currently showing no sign of opening to foreign businesses.

The application process in brief

• Set up your Chinese entity. You’ll need a WFOE or JV. For those providing valued-added telecommunication services, they need to have “value-added telecommunications services” in its registered business scope.
• Set up mainland China hosting. Open an account with Alibaba Cloud China, Tencent Cloud, AWS China, or Azure China and host your domain on their servers.
• Apply for your ICP filing. Submit through your cloud provider’s portal. It takes approximately 20 business days. Display your ICP filing number in your website footer.
• Complete the PSB Filing within 30 days of receiving your ICP filing number.
• Apply for your commercial VATS license(s) where applicable. Single-province applications go to the provincial Telecommunications Administration Bureau; cross-provincial goes to MIIT directly.
• Display your license information on your website once approved.

Timeline: ICP filings take 3-4 weeks. Commercial VATS license applications typically take 2–6 months, depending on the license type.

Staying compliant after you launch

Getting licensed is the start, not the finish. Key ongoing obligations include:

• Stay within your licensed scope. Expanding into new business activities requires a license amendment or a new application.
• Renew on schedule. VATS licenses are valid for five years; missing the renewal deadline can get your company listed on telecom blacklists.
• Keep your MLPS certification current. Most commercial platforms must complete a Multi-Level Protection Scheme security assessment.
• Report structural changes promptly. Changes in shareholders, registered capital, legal representative, or business scope must be reported to MIIT.
• Comply with data rules. China’s PIPL and Data Security Law impose significant requirements on data collection, storage, and cross-border transfers.

Frequently asked questions

Can I operate a website in China without hosting it there?

Yes. If your servers are outside mainland China, you don’t technically need an ICP filing or License. But your site will load slowly and may be intermittently blocked for mainland Chinese users due to the Great Firewall. For any business seriously targeting Chinese consumers, mainland hosting with proper compliance is the practical choice.

Do WeChat mini programs need an ICP filing?

Yes. Since September 2023, all mini programs (and mobile apps) must complete ICP filings before being published. WeChat has been actively removing non-compliant mini programs.

Do I need a separate ICP filing for every domain I use?

Yes. Filings are per-domain. Multiple domains under one company each need their own filing, but can all be linked to the same company’s ICP license.

Is MLPS required when applying for internet‑related licenses?

MLPS is not explicitly listed as a mandatory document in most internet license applications. However, in practice, companies that have not completed their MLPS filing often see their applications returned or delayed. Regulators expect MLPS compliance as a baseline cybersecurity requirement, so completing it in advance helps avoid setbacks.

What happens if we operate without a required license?

Penalties range from warnings and fines to mandatory website shutdown and app store removal. Enforcement has intensified since 2022. Operating without a license is increasingly difficult to sustain.

We’re a small foreign company – do we really need all of this?

Size doesn’t change the legal requirements. If your service is commercial, hosted in China, and available to Chinese users, the rules apply regardless of company size. Getting properly licensed protects you long-term.

Key takeaway

China’s internet licensing framework can look overwhelming at first, but the logic is consistent: any commercial digital service available to users in mainland China needs the right permits in place before it goes live. For most businesses, that starts with an ICP filing, adds an ICP license for any commercial activity, and branches into EDI, SP, B22, or B24 licenses depending on the specific business model.

The 2024 pilot program has opened a real (if narrow) door to full foreign ownership of licensed internet businesses in Beijing, Shanghai, Shenzhen, and Hainan. It’s the most significant market-access shift in China’s VATS sector in years.

The most important step is identifying the right license types for your specific business model early, before you’ve signed hosting agreements, built your tech stack in China, or committed to a go-live date. Compliance is far easier (and cheaper) to do proactively than to fix under enforcement pressure.

Asia’s data protection environment is rapidly evolving, with businesses facing rising pressure to maintain secure IT systems while complying with national regulations like China’s CSL, DSL, and PIPL, alongside global frameworks such as GDPR. Dezan Shira & Associates provides cybersecurity and compliance advisory tailored for Asia’s regulatory landscape. Our services include IT infrastructure audits, Zero Trust implementation, security training, and multi-jurisdictional data privacy compliance.

Tony Tang

Manager, IT Service

Talk to an expert at China@dezshira.com

Or request a consultation at +86 21 6358 8686

• Previous Article Hiring in Hong Kong: Compliance Tips for Foreign Companies
• Next Article