How to Obtain Cross‑border M&A Approvals in China, Step‑by‑step (2026)

Any foreign buyer, private‑equity sponsor or multinational planning an acquisition in, or out of, the People’s Republic of China must navigate a multi‑regulator approval chain before a deal can close. Understanding how to obtain cross‑border M&A approvals in China in 2026 is more complex than in previous years: tightened cybersecurity and data‑export rules, updated CSRC governance requirements for listed targets, and evolving national security review triggers have added new procedural steps to what was already a demanding process. This guide maps every approval in chronological order, sets out the documents needed, provides realistic timelines with extension windows, and flags the 2026 regulatory changes that deal teams must build into their transaction timetables.

It is designed for general counsels, in‑house M&A teams, PE sponsors and external deal counsel who are at the pre‑LOI to pre‑closing stage and need to size the regulatory path ahead.

Overview of the M&A Approval Process in China and Who It Applies To

Cross‑border M&A approvals in China are not a single filing, they are a sequence of regulator‑specific clearances, each with its own trigger test, statutory clock and documentary requirements. Which approvals apply to a given transaction depends on the deal structure (share acquisition versus asset purchase), the nature of the target (listed versus unlisted, state‑owned versus private), the sector (restricted, encouraged or prohibited under the Foreign Investment Negative List), and whether the target processes personal data, “important data” or operates critical information infrastructure.

The principal regulators and their roles are as follows:

• SAMR (State Administration for Market Regulation). Merger control (antitrust) review under the Anti‑Monopoly Law. Applies where the parties’ combined turnover exceeds the notification thresholds.
• CAC (Cyberspace Administration of China). Cybersecurity review under the Measures for Cybersecurity Review. Triggered when the target is a critical information infrastructure operator or processes significant volumes of personal information or “important data” that may be exported cross‑border.
• National Security Review authority. Conducted through an inter‑agency mechanism originally established under MOFCOM (now coordinated by the State Council working mechanism). Applies to investments in sectors affecting national security, military, defence, critical technology, critical infrastructure and adjacent areas.
• CSRC (China Securities Regulatory Commission). Required when the target is a listed company or the deal involves new securities issuance, material asset restructuring or a change‑of‑control transaction subject to exchange and CSRC rules.
• SAFE (State Administration of Foreign Exchange). Post‑closing registration and foreign‑exchange steps for capital account transactions, cross‑border remittance and repatriation of proceeds.
• Local Administration for Market Regulation / company registry. Post‑closing filings to update business registration, shareholder records and statutory filings.

The decision tree is straightforward in principle: identify which triggers your deal hits, then sequence the filings so that each clearance is a condition precedent in the SPA. In practice, multiple approvals frequently run in parallel, and the M&A approval process in China in 2026 requires early coordination to avoid timeline blow‑outs.

Eligibility and Prerequisites for Cross‑Border M&A Approvals in China

Before any filing can be prepared, deal teams must run a structured eligibility assessment. Each regulator applies its own threshold or trigger test, and missing one at the screening stage is a common source of delay.

Key trigger tests

• Merger control (SAMR). Notification is mandatory where the combined worldwide turnover of all parties exceeds CNY 12 billion and at least two parties each have China turnover exceeding CNY 800 million, or where the combined China turnover exceeds CNY 2 billion and at least two parties each have China turnover above CNY 800 million. Simplified procedure thresholds apply to transactions with limited competitive overlap.
• Cybersecurity review (CAC). Required where the target is a critical information infrastructure operator procuring network products or services that may affect national security, or where the target processes personal information of more than one million individuals and the transaction involves a data‑related listing or cross‑border data export. Deal teams should prepare a data inventory early in due diligence to determine whether this threshold is met.
• National security review. Triggered when a foreign investor acquires actual control, or the ability to exert material influence, over a domestic enterprise in a sector covered by the national security review scope, including defence, critical agricultural resources, critical energy and resources, critical technology and critical infrastructure.
• CSRC approval. Required for material asset restructurings, tender offers and change‑of‑control transactions involving listed companies, as well as cross‑border securities offerings. The specific trigger depends on the exchange rules and whether the transaction meets the materiality thresholds prescribed by the CSRC.
• Foreign investment filing. Under the Foreign Investment Law, foreign investments must be reported through the enterprise registration system and the foreign investment information reporting system. Investments in Negative List sectors require separate pre‑approval.

Who bears the filing obligation

Merger control notification obligations fall on the notifying party, typically the buyer or, in a joint acquisition, both acquirers. The cybersecurity review obligation rests on the operator (the target), although in practice the buyer’s counsel coordinates the filing. National security review applications are generally submitted by the investor, though the target or a third party may also trigger the process. CSRC filings are the responsibility of the listed company and its advisers. SAFE registration is performed by the acquiring entity or its onshore subsidiary post‑closing.

Step‑by‑Step Procedure for Cross‑Border M&A Approvals

The following procedure sets out the typical sequence for a foreign inbound share acquisition. Outbound deals, asset acquisitions and state‑owned enterprise transactions may require additional or modified steps, but the core regulatory checkpoints remain the same. Each step identifies the responsible party, the key actions and the typical duration.

Step 1, Conduct pre‑deal screening and regulatory risk map

Before signing a letter of intent, assemble a cross‑functional team (legal, data privacy, tax, finance) to identify which approvals apply. The key deliverables at this stage are: a preliminary antitrust filing assessment (turnover data from both parties), a data inventory mapping the target’s personal information and important data holdings, a sector classification against the Foreign Investment Negative List, and an initial national security sensitivity assessment. For targets operating critical information infrastructure or holding data on more than one million individuals, engage a cybersecurity vendor to run a preliminary security gap analysis. This step typically takes one to three weeks and determines the shape of the entire approval timeline.

Step 2, File antitrust notification with SAMR

If the merger control thresholds are met, the notifying party must submit a Concentration of Undertakings Notification to SAMR. The filing includes prescribed forms, market‑share data, competitive analysis, copies of the transaction agreements and supporting documents. SAMR’s review proceeds in up to three phases under the Anti‑Monopoly Law: Phase I (preliminary review) lasts 30 calendar days; Phase II (further review) may add a further 90 calendar days; and Phase III (additional extension) may add a further 60 calendar days in complex cases. A simplified procedure is available for transactions with limited competitive overlap, which shortens the timeline. Pre‑filing consultation with SAMR is strongly recommended and can reduce the risk of the clock being stopped for supplementary information requests.

Step 3, Submit cybersecurity review application to CAC

Where the target is a critical information infrastructure operator or processes personal information exceeding the prescribed thresholds, a cybersecurity review application must be submitted to the CAC. The Measures for Cybersecurity Review require the operator to prepare a security assessment report, a data export justification (if cross‑border data transfer is involved), and a description of the supply chain and vendor risks. The CAC conducts an initial review, typically completed within approximately 30 working days, and may escalate to a special review phase that can extend the process to 90 days or more. Industry observers expect this step to become more common in cross‑border M&A as the scope of “important data” continues to broaden under 2025–2026 regulatory guidance.

Deal teams should begin the data inventory and remediation workstream as early as possible, running it in parallel with the antitrust filing to avoid sequential delay.

Step 4, Apply for national security review

Transactions that involve a foreign investor acquiring control or material influence over a domestic enterprise in a covered sector must be submitted for national security review. The review is conducted through an inter‑agency working mechanism. The process does not follow a single published statutory clock in all cases; instead, the authority sets the timetable on a case‑by‑case basis. In practice, reviews typically take between 30 and 90 days, but can extend considerably if the authority requests additional information or imposes conditions. Buyers should identify potential national security triggers during Step 1 and consider voluntary pre‑notification where the position is ambiguous. For a detailed breakdown of the national security review process, see our China national security review coverage.

Step 5, Obtain CSRC clearance for listed targets

Where the target is a company listed on a PRC stock exchange and the transaction constitutes a material asset restructuring, tender offer or change of control, CSRC approval is required. The listed company, together with its financial adviser and PRC counsel, prepares a disclosure package including a restructuring report or prospectus, independent financial adviser opinions and valuation reports. The relevant stock exchange conducts an initial review before the matter is escalated to the CSRC. The combined review window typically spans 20 to 60 business days, though consultation rounds and supplement requests can extend this period. Early engagement with the exchange and preparation of the disclosure package well before the filing date are critical to managing the timeline.

Step 6, Complete SAFE registration and foreign exchange steps

After closing, the buyer (or its onshore subsidiary) must register the transaction with SAFE and the designated foreign exchange bank. This involves submitting capital account registration forms, capital verification certificates issued by a PRC auditor, and evidence of the completed share transfer. The bank coordinates with SAFE to process the registration, which typically takes two to six weeks depending on the completeness of the documentation and the processing speed of the local branch. Cross‑border remittance of the purchase price, and any future repatriation of dividends or disposal proceeds, requires compliance with SAFE’s capital account rules.

Step 7, File post‑closing company registry updates and tax clearances

Within the period prescribed by local practice (commonly 30 days of closing), the target company must update its business registration with the local Administration for Market Regulation to reflect the new shareholder structure. Tax clearance certificates should be obtained from the competent tax bureau, confirming the target’s pre‑closing tax position and any withholding tax obligations arising from the share transfer. These filings are typically handled by local PRC counsel and should be embedded as conditions subsequent or post‑closing obligations in the SPA.

Required Documents and Information for Cross‑Border M&A Approvals in China

The documents needed span every stage of the approval chain. Some are prepared by the buyer, others by the target, and several require notarisation, consularisation or certified translation. The table below consolidates the core document set. Deal teams should treat this as a working checklist and adapt it to their specific transaction structure.

Foreign‑language documents generally require certified Chinese translations. Documents executed outside the PRC may need notarisation by a local notary in the country of origin and consularisation (or apostille, where applicable) before they are accepted by PRC regulators. Allow additional lead time, typically one to three weeks, for legalisation processes.

Timeline and Key Deadlines for Cross‑Border M&A Approvals in China in 2026

One of the most common questions from deal teams is: how long does the M&A approval process in China take? The answer depends on how many regulatory clearances are triggered and whether they can be run in parallel. The table below sets out the statutory clocks, typical extension windows and practical notes for each approval.

For a straightforward deal triggering only SAMR review (simplified procedure), the regulatory clearance path may take as little as four to eight weeks from filing. A complex transaction triggering antitrust, cybersecurity and national security reviews, with a listed target requiring CSRC clearance, can extend the regulatory timeline to six months or longer. The key to managing the timeline is parallel processing: filing the SAMR notification and CAC cybersecurity review simultaneously where possible, and preparing CSRC disclosure materials during due diligence rather than after signing.

When drafting the SPA, deal teams should set the long‑stop date with sufficient buffer for the longest reasonably expected approval path, and include walk‑away rights and reverse break fees calibrated to the regulatory risk. Early indications suggest that in 2026, regulators are increasingly willing to engage in pre‑filing consultations, which can reduce the risk of clock‑stopping information requests.

Costs, Fees and Tax Considerations for Cross‑Border M&A Approvals in China

Regulatory filing fees in China are generally modest compared to some other jurisdictions, but the total cost of the approval process, including professional advisers, cybersecurity remediation and tax, can be substantial. The table below provides indicative cost ranges. All figures are approximate and should be confirmed with local counsel for the specific transaction.

Deal teams should also budget for contingent costs: antitrust remedy negotiations (behavioural or structural commitments) can generate significant additional legal and economic advisory fees, and cybersecurity remediation may require technical infrastructure investment that was not anticipated at the LOI stage.

What Changes in 2026, Regulatory Hooks for Cross‑Border M&A Approvals in China

The 2025–2026 regulatory cycle has introduced several changes that directly affect how to obtain cross‑border M&A approvals in China in 2026. Deal teams should incorporate the following into their workflow:

• Expanded cybersecurity and data‑export controls. The CAC has continued to broaden the scope of “important data” and refine the triggers for mandatory cybersecurity review. The likely practical effect is that more cross‑border transactions, particularly those involving targets in technology, healthcare, automotive and financial services, will require a CAC filing. Deal teams should run a data inventory and cross‑border data‑flow analysis before signing.
• CSRC corporate governance updates for listed targets. Updated CSRC rules have strengthened governance requirements for material asset restructurings and change‑of‑control transactions involving listed companies. Early indications suggest that the CSRC is placing greater emphasis on independent director oversight, related‑party transaction scrutiny and enhanced disclosure of the buyer’s funding sources and post‑acquisition plans.
• Heightened scrutiny of cross‑border financial data flows. Regulators have increased focus on the cross‑border transfer of financial data as part of both cybersecurity review and SAFE/capital account compliance. Industry observers expect that transactions involving fintech targets or targets with significant financial data holdings will face additional review layers.
• National security review scope refinement. The inter‑agency mechanism has continued to refine the sectors and activities covered by national security review. For further detail on the current scope and filing process, see our China national security review guide.

The cumulative effect of these changes is that the regulatory pathway for cross‑border M&A in China is wider and deeper than in previous years. Deals that would previously have required only an antitrust filing may now also trigger cybersecurity and data‑export reviews, adding weeks or months to the timetable. Building these steps into the deal timeline from the outset, rather than discovering them mid‑process, is essential.

Common Pitfalls and How to Avoid Them

• Late data mapping. Failing to prepare the target’s data inventory before signing leaves the deal team unable to assess whether a CAC cybersecurity review is required. Run the data inventory during due diligence, not after.
• Sequencing errors in the SPA. Signing the SPA without embedding all necessary regulatory clearances as conditions precedent exposes the buyer to completion risk. Each identified approval should be a named CP with a defined long‑stop date.
• Failing to budget for remediation. Cybersecurity gap remediation, antitrust remedy compliance and CSRC supplement requests all generate costs that deal teams frequently underestimate. Include a contingency line in the deal budget from the outset.
• Poor local counsel coordination. Cross‑border M&A approvals in China involve multiple regulators operating on different clocks. Appointing a single PRC lead counsel to coordinate all filings, rather than splitting regulatory workstreams across firms, reduces the risk of misalignment.
• Underestimating SAFE and post‑closing steps. SAFE registration and FX remittance are often treated as administrative formalities, but incomplete or incorrect documentation can delay capital repatriation by weeks. Pre‑stage SAFE documentation with the designated bank before closing.
• Ignoring pre‑filing consultation opportunities. Both SAMR and the CAC offer pre‑filing consultation mechanisms. Using these can surface potential issues early and reduce the likelihood of clock‑stopping information requests during the formal review period.

Conclusion

Cross‑border M&A approvals in China are no longer a matter of filing a single antitrust notification and waiting. The 2026 regulatory environment demands a structured, multi‑regulator workflow, from pre‑deal screening through SAMR, CAC, national security and CSRC clearances to SAFE registration and post‑closing filings. Understanding how to obtain cross‑border M&A approvals in China in 2026 requires early identification of triggers, parallel processing of filings, realistic timeline planning and close coordination with experienced PRC counsel. Practitioners who build these steps into their deal architecture from the LOI stage will be best positioned to close transactions on schedule and avoid the costly pitfalls that derail unprepared deal teams.

For guidance tailored to a specific transaction, contact a China cross‑border M&A specialist through our directory.

Sources

1. State Administration for Market Regulation (SAMR), merger control guidance
2. Cyberspace Administration of China (CAC), cybersecurity review measures
3. China Securities Regulatory Commission (CSRC)
4. State Administration of Foreign Exchange (SAFE)
5. Global Law Experts, China national security review (2026)
6. Ministry of Commerce (MOFCOM), foreign investment guidance
7. China Briefing, market commentary and regulatory updates (2024–2026)