Payment Compliance and Filing Guide: ICP, EDI, Payment Licenses, and the Second Clearing Boundary
Compliance problems in payment-related business share one trait: you never notice them until they become decisive. A channel shuts down, settlement funds freeze, the business has to migrate. And the overwhelming majority are not failures of technical capability but of not knowing what needs to be arranged.
This article separates compliance into three layers: website and application compliance covering filings and licenses, payment business compliance covering licenses and second clearing, and operating business compliance covering industry qualifications. All three must pass. This is a structural overview, and the applicable standards should be confirmed against the latest regulator requirements and professional legal advice.
1. What Each of the Three Layers Covers
| Layer | What it governs | Typical requirements |
|---|---|---|
| Website or application | Whether you may legally operate online | ICP filing, value-added telecom license, mobile app filing |
| Payment business | Whether you may legally touch the money | Payment business license, or a licensed partner plus staying in bounds |
| Operating business | Whether you may sell what you sell | Industry licenses, category qualifications, product compliance |
The payment layer is where most mistakes happen, because it is not a binary question of having a certificate but a structural question of whether the fund path crosses a boundary.
2. ICP Filing Is Not an ICP License
This is the most commonly confused pair, and the most consequential.
An ICP filing is the baseline requirement for any site served from domestic infrastructure. It is essentially registration and confers no operating qualification. Having a filing number does not authorize commercial activity.
An ICP license, part of the value-added telecom business license, is an operating qualification for charging users for information services over the internet. The test is direct: does your site charge users directly? If it does, a license rather than a filing is usually required.
Many teams only arrange the filing and discover the license requirement at the point of charging, by which time channel qualification review is already blocked. The correct order is to determine whether a license is required, then decide hosting and filing, and only then connect a payment channel.
3. EDI Licenses and Platform Businesses
If your business is a platform providing online data processing and transaction processing for others, letting buyers and sellers transact on your site, an EDI license may apply.
The key test is your role: are you selling your own goods, or providing a venue for third parties? The latter is platform business with entirely different qualification requirements, plus obligations around platform responsibility, merchant management and information retention.
This is also why platform businesses must use the service provider model rather than collecting funds themselves. The former is a compliant architecture; the latter is second clearing. For model selection, see aggregate payment and the service provider model.
4. Payment Licenses and the Second Clearing Boundary
A payment business license is the legal qualification for conducting payment business. The overwhelming majority of companies neither hold one nor should apply, since the bar is extremely high. The correct approach is partnering with a licensed institution.
The problem lies in how you partner. There is exactly one test: did the money pass through your account?
- User payment goes directly into the merchant's own collection account and you provide only technology or matchmaking: compliant;
- User payment enters your account and you then settle to the merchant: secondary clearing, unlicensed payment business;
- You hold a payment license: licensed operation, a separate category.
Three common boundary crossings: a platform collecting payment for goods and distributing to merchants, using personal accounts to pool transaction funds, and running a fund pool to delay settlement. All three are frequently presented internally as technical solutions, and all three are compliance red lines.
The correct approach is split settlement: funds reach merchants directly and the platform collects only its own commission. That solves multi-party distribution without touching a fund pool.
5. Mobile App and Mini Program Filing
Regulators now require mobile internet applications and mini programs to complete filing before providing services. If you operate an app or mini program carrying payment functionality, filing is a prerequisite for launch, not an optional step.
Practical impact: unfiled applications may be blocked from distribution channels, and payment channel qualification review may require filing details. Confirm the filing status of apps and mini programs before connecting payment.
6. Foreign Exchange Compliance for Cross-Border Collection
If your business collects from overseas, beyond the payment channel's own qualifications you must consider forex requirements: authenticity of the underlying transaction, compliance of the settlement path, and differences between individual and corporate conversion rules. Common risks are fabricating trade background and splitting collections across individuals' annual facilitation quotas, both of which are explicit violations.
The compliant approach is to use institutions holding cross-border payment qualifications, retain complete transaction evidence such as orders, logistics and service delivery records, and ensure the collecting entity matches the operating entity.
7. Qualification Checklist for Channel Onboarding
Connecting a domestic payment channel typically requires:
- Business license, corporate or sole proprietorship
- Legal representative identity documents and authorization
- Settlement account details, corporate account
- Business scenario evidence such as site or app screenshots and product descriptions
- Industry qualifications for the corresponding category
- ICP filing details, with a license in some scenarios
- Filing details for mobile apps or mini programs
Business scenario evidence is the item most often rejected, because it must show that you genuinely operate the business you describe. Prepare product pages, pricing pages, terms of service and refund policy screenshots together, which passes far more often than a homepage alone.
8. Six Common Violation Scenarios
Scenario one: a filing but no license while charging users directly. The most frequent omission, and it constitutes unlicensed operation on inspection.
Scenario two: category mismatched with actual operations. Reporting virtual goods as retail to obtain a lower rate leads to retroactive rate adjustments once risk controls notice.
Scenario three: a platform collecting payment for goods. Classic second clearing, which beyond compliance risk produces a frozen fund pool and merchants pursuing the platform collectively.
Scenario four: receiving corporate revenue into personal accounts. This violates payment settlement rules and creates tax exposure.
Scenario five: splitting cross-border collections to evade quota. Explicitly prohibited, with consequences including frozen accounts and administrative penalties.
Scenario six: operating outside the registered scope. A business license scope that does not match actual business fails channel review and subsequent inspections.
9. A Ten-Item Compliance Self-Audit
- Has the site completed ICP filing, and do the filing details match the actual entity?
- Do you charge users directly, and if so, is an ICP license required?
- Do you provide a venue for third parties, and if so, what EDI requirements apply?
- Is the fund path user to merchant directly, with no platform collection?
- Do you use split settlement rather than settling from a fund pool?
- Have apps and mini programs completed filing?
- Does the contracted industry category match actual operations?
- Are industry qualifications complete and current?
- Is the settlement account a corporate account belonging to the merchant entity?
- For cross-border business, do you use licensed institutions and retain complete transaction evidence?
The value of a self-audit is finding problems early. If any of these ten is in doubt, resolve it before scaling transaction volume, because remediation cost grows with scale.
For fee and cost structure, see the domestic payment channel fee structure. For merchant onboarding and sub-merchant management, see aggregate payment and the service provider model. For the compliance discussion around hosting without a filing, see hosting a website overseas without an ICP filing. For cross-border collection options, see the cross-border payment selection matrix. More options are collected under the Payment category.
Source: 16IDC original. Product capabilities, pricing and eligibility requirements follow the relevant providers’ official documentation and contract terms.