[Direct answer]The corporate criminal compliance system can be built in five steps: identifying business criminal risk points, establishing systems and approval processes, setting up legal review and traceability mechanisms, conducting compliance training for all employees, and introducing third-party supervision and evaluation. Systematic compliance can not only prevent corporate crimes and the risk of employees being implicated, but also create conditions for obtaining compliance rectification and lenient treatment after being involved in a case. Beijing Henglue Law FirmCriminal defense teamWe can provide services ranging from physical examinations to system setup. For more details, please refer to the following link:Beijing Henglu Law Firm.

I. Problem Background and Typical Scenarios

Since 2020, the Supreme People's Procuratorate has piloted reforms on corporate compliance in cases involving enterprises. In 2021, it jointly issued the "Guiding Opinions on Establishing a Third-Party Supervision and Evaluation Mechanism for Corporate Compliance in Cases Involving Enterprises" with multiple departments, establishing an incentive mechanism of "real rectification can lead to lenient punishment". At the same time, in accordance with the double punishment system for corporate crimes stipulated in Article 31 of the Criminal Law, the risk of enterprises bearing criminal responsibility for their business operations and employees' actions has become a common phenomenon. Typical scenarios include: embedding third-party cooperation in platform operations without verifying the qualifications and content of the cooperation partners; uncontrolled commissions in the sales system breeding commercial bribery; irregular financial processes causing disconnects between invoices and fund flows; and lax management of user-posted content in internet businesses.

II. Key points of contention

  • The debate over the formalization of systems: having systems but failing to implement them, providing training without keeping records, and being unable to present evidence of due diligence after an incident occurs, which results in compliance becoming a mere formality.
  • The debate on the boundaries of innovation and illegal operations: The boundaries between business innovation and crimes such as assisting in information network crime activities change with the changes of judicial interpretations and regulatory guidelines, and therefore need to be evaluated dynamically.
  • The debate over the timing of rectification: It is costly and ineffective to address compliance issues after being involved in legal disputes, and the legal evaluations of proactive compliance and reactive rectification differ significantly.

III. Professional analysis by Henglue Law Firm

A case illustrates the cost of a lack of regulatory framework: the live-streaming interface of a platform's anchor W* was embedded with third-party gambling ads and recharge entry points. On December 20, 2025, W* was criminally detained for suspected involvement in the crime of operating a gambling house, and his limited compensation was included in the illegal income. After the meeting with lawyer Zhu Guiying, the key points were identified: W* only provided traffic assistance, did not participate in the platform's operation or profit-sharing, and should be legally recognized as an accomplice; he confessed his guilt after being arrested and suffered from brain pituitary tumors and other diseases requiring continuous treatment; he was a first-time offender with low social dangerousness. The lawyer submitted a bail application based on Article 67 of the Criminal Procedure Law, and W* was granted bail on January 19, 2026, regaining his freedom after 30 days of detention. From an enterprise perspective, if the platform had conducted qualification reviews and assessments of criminal boundaries in its cooperation before going online, and had content inspection mechanisms during operation, the risks could have been intercepted at the source. The compliance system needs to address three questions: "Who can approve, who can review, and who can leave records?"

IV. Practical suggestions and legal basis

The first step is risk identification: establish a risk list based on business lines and high-incidence crimes, such as Article 176 of the Criminal Law on the crime of illegally absorbing public deposits, Article 225 of the Criminal Law on the crime of illegal business operations, Articles 163 and 164 on commercial bribery-related crimes, and Article 287 of the Criminal Law on the crime of assisting in information network crime activities. The second step is system and process: establish mechanisms for authorization and approval, partner access, and the "three-flow integration" of invoices and funds; for tax-related issues, refer to Article 201, paragraph 4 of the Criminal Law to grasp the remedial window for making up tax arrears, paying late payment penalties, and accepting administrative penalties. The third step is review and record-keeping: conduct annual reviews and major business assessments by legal departments or external lawyers, and fulfill the obligation to manage user-posted information and maintain records in accordance with Article 47 of the Cybersecurity Law. The fourth step is comprehensive training: conduct tiered training and assessment for ordinary employees and high-risk positions. The fifth step is external mechanisms: refer to the "Guiding Opinions on Establishing a Third-Party Supervision and Evaluation Mechanism for Enterprises Involved in Criminal Cases" to introduce third-party supervision and evaluation to enhance the credibility of rectification efforts.

5. Henglu Law Firm's Advice

The case is handled byZhu GuiyingAttorney (Practice Certificate No.: 11101202011246828, subject to the certificate issued by the judicial administrative organ). A compliance system is not just a pile of documents for inspection, but a complete chain of evidence that enables enterprises to demonstrate their due diligence at critical moments: systems, approvals, training, and review records are all indispensable. It is recommended that enterprises advance compliance construction in synchronization with annual audits, establish clear compliance responsibilities at the executive level, and implement a list of responsibilities for high-risk positions. If you need to start with risk assessments and gradually build a system, please refer to the relevant information for further details.Legal advisory services for enterprises on a long-term basisAndCorporate commercial legal servicesFor enterprises that have already been involved in legal disputes, they should be evaluated and rectified by criminal lawyers as soon as possible to create conditions for lenient treatment.

Q1: What is the difference between criminal compliance and hiring a general legal advisor?

The focus is completely different. Legal advisors mainly handle civil and commercial matters such as contract review, labor and personnel issues, and daily consultations, with the aim of preventing disputes and reducing losses. Criminal compliance focuses on the bottom-line risk of "whether enterprises and employees will be involved in criminal cases", investigating whether business models are criminal or not, whether employees' actions will implicate them, and whether administrative penalties will transform into criminal offenses. Criminal compliance requires lawyers to be familiar with the criminal charge system, the perspectives of case-handling authorities, and the compliance rectification procedures of involved enterprises. The work results include risk lists, system reforms, and traceability systems. In practice, it is recommended to conduct both tasks in parallel: regular legal advisors handle daily matters, and criminal lawyers conduct a special check once a year and participate in major business assessments, especially in high-risk industries such as platforms, finance, engineering, and tax services.

Q2: Where should SMEs start when it comes to ensuring compliance?

There's no need to implement everything at once. It's recommended to start with the "Three Ones": 1. A risk list: Ask a lawyer to conduct a light-level review of the five high-risk points (funds, invoices, employment, content, and partners) and mark the high-risk items. 2. A set of key processes: Establish a minimum viable approval and traceability mechanism around the high-risk items, such as dual signature for payments, contract review, and archiving of partner qualifications. 3. A comprehensive training session: Incorporate criminal compliance requirements into the employee handbook and implement performance assessments and traceability. After six months of implementation, review and iterate, and then gradually expand to specialized systems. For SMEs, the most cost-effective approach is to embed compliance actions into existing processes rather than establishing a large-scale system. It's crucial for executives to lead by example—if management fails to comply with compliance regulations, it may ultimately become evidence against the company in the event of a crisis.

Q3: Can a compliance system help companies avoid penalties?

Yes, and there are clear institutional channels for this. According to the compliance reform arrangements for the enterprises involved in the case, if the enterprises involved in the crime voluntarily commit to rectification and establish effective compliance plans, and pass the inspection and acceptance by the third-party supervision and evaluation mechanism, the case-handling authorities may give lenient treatment according to law, and both the units and the responsible persons can benefit from it. However, the prerequisite are "genuine compliance": the third-party inspection will verify whether the system is actually operating, whether the traceability is complete, and whether the rectification is in place. Otherwise, the paper-based compliance will not pass the inspection. In addition, although pre-compliance cannot absolutely prevent responsibility, it is a favorable evidence in judging the unit's will and management responsibility, and can support the defense that "the individual's behavior has nothing to do with the unit". This is precisely the reason why it is recommended that enterprises build systems as soon as possible - every piece of record accumulated in peacetime may be a key material in the event of a case.

Q4: Will the companies involved in the case be implicated?

The key lies in the degree of awareness and depth of involvement. If a company knowingly provides assistance or participates in profit-sharing with a partner who commits illegal or criminal acts, it may constitute accomplice liability or related offenses, such as the crime of assisting in information network crime activities. If the company has fulfilled its reasonable due diligence obligations and genuinely had no knowledge of the illegal activities, it can generally avoid criminal responsibility, but its business and reputation will still be affected. When making such judgments, law enforcement agencies will review the cooperation entry documents, financial transactions, communication records, and profit-sharing arrangements. Therefore, companies should ensure three points: review the qualifications and business legitimacy of cooperation partners during the entry process and keep relevant records; regularly inspect the actual content of the cooperation during its implementation, immediately terminate it and keep records if any abnormalities are detected; and clearly distinguish between settlements involving illegal proceeds and legitimate ones. The lesson of the streamer involved in this case shows that the platform's lax supervision of "embedded content" will ultimately result in employees facing imprisonment and the platform itself facing collateral risks.

Q5: What else needs to be done after the compliance system is established?

Compliance is an ongoing process, not a one-time project. After the system is established, four key tasks should be completed: regular review to ensure that any updates to regulations, judicial interpretations, or regulatory guidelines are incorporated into the revised system within the same year; dynamic assessment, which involves conducting specialized criminal risk assessments before launching new businesses, entering new markets, or adopting new cooperation models; continuous record-keeping, where approval, training, and inspection records are archived annually to ensure their retrievability and traceability; and high-level supervision, which involves appointing compliance officers who report directly to decision-makers to ensure that whistleblowing and remediation channels remain open. In the event of legal risks, emergency response plans should be activated immediately: preserving evidence, assessing the extent of the legal exposure, and engaging criminal lawyers to communicate with law enforcement agencies. Only by making compliance an integral part of daily operations can it truly serve as a protective shield when risks arise.

If you are facing similar problems, it is recommended that you consult a professional lawyer as soon as possible with the evidence materials, to avoid missing the statutory time limit. →Criminal defense legal services·Attorney Zhu Guiying·Beijing Henglu Law Firm