Case Overview

In June 2026, NetEase Pay received regulatory penalties for four major compliance violations spanning high‑risk areas including payment services, fund clearing, data security and anti‑money‑laundering (AML) customer due diligence, constituting a comprehensive compliance‑risk incident. Regulators issued a warning and a fine of RMB 2.204 million against the institution. Meanwhile, two directly responsible staff from the technology and AML teams were held personally liable under the “institution‑plus‑individual” dual‑penalty regime. In addition, this penalty will be factored into regulatory ratings, directly affecting the enterprise’s payment‑license renewal in 2027 and exposing it to dual risks concerning operational qualification and brand reputation.

Four Core Violations

1. Non‑standard procedures for payment‑account opening, information verification and ongoing account management;
2. Non‑compliant fund‑clearing procedures with deficiencies in clearing‑control mechanisms;
3. Inadequate end‑to‑end security governance over user payment data, in breach of financial‑data compliance requirements;
4. Perfunctory customer due diligence and failure to perform ongoing AML risk‑screening obligations.

Compliance and Risk‑Control Gaps Exposed at the Enterprise

This penalty stems not from isolated operational errors, but from systemic weaknesses in compliance‑system development and ineffective risk‑control mechanisms. Four key issues are identified:

1. Paper‑only compliance and broken end‑to‑end controls: Formal compliance policies were established but not embedded into business workflows. Business teams prioritized efficiency over compliance, with pre‑approval, in‑process oversight and post‑review compliance mechanisms absent.
2. Weak data compliance and neglected technical‑function compliance: Compliance responsibilities for technical roles were overlooked. Frameworks for data classification, data masking, access‑rights management and risk monitoring were incomplete. Compliance gaps in technical‑operation activities led to data‑security violations.
3. Deficient AML foundational performance: Customer‑due‑diligence procedures were superficial. Capabilities for risk classification, ongoing screening and abnormal‑transaction monitoring were insufficient. Risk controls merely satisfied basic formalities and failed to mitigate risks such as money laundering and fraudulent account openings.
4. Ambiguous accountability and insufficient self‑inspection mechanisms: Compliance obligations were disproportionately assigned to the compliance department, with no clear compliance duties for business and technical roles. Internal accountability frameworks were inadequate. Self‑audits were lacking, resulting in poor risk foresight and closed‑loop remediation capabilities.

Case Conclusion and Industry Insights

The NetEase Pay penalty signals that financial‑industry compliance supervision has entered a new phase featuring personal accountability, full‑scope governance and technology‑driven compliance. Regulators have departed from the traditional model of penalizing institutions without holding individuals accountable. Data compliance, role‑based compliance and front‑line‑duty compliance have become fundamental prerequisites for financial institutions.

For payment institutions and fintech firms, compliance is no longer a supporting function but a cornerstone of business operations. Enterprises must abandon complacency, break down silos between business and compliance functions, enforce accountability across all staff, and remedy gaps in data and AML risk controls. Sustained self‑inspection and remediation will enable sound compliant operations and mitigate multiple business risks such as regulatory sanctions, qualification restrictions and brand impairment.

By Michelle Zhu, Office Supervisor