China tightens regulatory net for multinational cloud operators

Foreign companies that use the IaaS and PaaS models will be subject to approval as they now lie under the new VATS category of internet resource collaboration (IRC) services, a subset IDC services.

This means that domestic companies will need to apply for the new IDC license to conduct cloud businesses. “This in theory makes IRC providers subject to the more onerous requirements of IDC,” said McKenzie, adding that the broader regulatory licensing regime will need to be updated to match the Catalogue.

SaaS, which provides remote point of access to software, has some of its forms fall outside the description of IRC services.

Once assumed to be the most heavily restricted, SaaS is being interpreted as a computing and not a telecom service, and the regulator sees the cloud as more of a business model than a sector of its own, said Bin Qi, a TMT partner at Jin Mao Partners. He added that this ambiguity allows the regulator to promote the service as room for innovation while it figures out how to legally oversee it.

For the time being, it will analyze the technical functions and facilities of the services on a case-by-case basis. Detailed approval conditions are expected to be released later this year.

MNCs' cloud services models

Multinationals are transforming their business models and leveraging software on a global scale to meet client needs, which are shifting from hardware to cloud-based platforms (IaaS, PaaS and SaaS). And the Chinese market—with all its cumbersome cybersecurity, data and foreign ownership restrictions—is too important to let go.

“Foreign investors can only enter the Catalogue's sectors through a JV and will need to comply with all the other laws that regulate these areas, such as those for reporting, data localization, encryption and decryption,” said Xiaoyan Zhang, counsel at Mayer Brown JSM. Such requirements are set by the PRC National Security Law and other pieces of legislation that govern information protection.

For instance, Apple's iCloud was required to have its data server in China and it partnered with state-owned China Telecom to enter the market. The company keeps its encryption keys overseas, but in the event of a national or cybersecurity issue, it will have to comply with Chinese laws in handing over this information.

Microsoft allied with 21Vianet, a Chinese data center that IBM is also working with, and reportedly saw a dramatic increase in their cloud revenue. Oracle struck a similar deal with Tencent Cloud, and Amazon expanded in the country with local firms ChinaNetCenter and Sinnet. HP, Intel, Cisco are all said to be pursuing similar strategies.

“Everyone is fighting to get a piece of the action,” said Qi, adding that despite the different partner arrangements, the MNCs all face the same market entry restrictions.

A Cisco survey in August 2015 found that 79% of Chinese organizations are using or planning to implement the cloud business—Alibaba pumped $1 billion into its cloud computing unit Aliyun last summer—and Bain predicted cloud spending in China could reach $20 billion by 2020.

Other big VATS and BTS updates

The internet information services (IIS) class under VATS was used by the old 2003 Catalogue as a catch-all licensing category for many services that didn't quite fit into the other fields, according to a Morrison & Foerster alert. 12 years later, this updated version expands the scope of internet businesses to five new fields:

• Information publishing and distribution
• Search engines
• Social media/network platforms
• Real-time information exchange, e.g. instant messaging and voice/video call services
• Information protection and processing, e.g. anti-virus software and spam filters

“The IIS category has been thoroughly revised due to the internet's rapid evolution and sheer amount of investment appeal and activity,” said Michelle Chan, partner at Bird & Bird.

Other new services have been added to the VATS category, such as content distributor networks (CDN), which cover caching, and internet domain names, which include DNS hosting.

Internet access services have been moved from Type II to Type I VATS. “It's harder to get licenses for Type I, so this isn't too surprising a move as, around seven years ago, there was a crackdown on the issuance of ISP [internet service provider] licenses,” said Chan.

Meanwhile, “online data processing and transaction” has been moved from Type I to II, paralleling the government's relaxation of foreign restrictions in e-commerce in 2015.

Despite these gestures and a legal provision that permits up to 50% foreign investment in VATS, practitioners say that, in practice, approval still remains largely discretionary and difficult to obtain for non-Chinese companies.

Chan believes that while the Catalogue serves to classify the business, it has no great impact on liberalizing foreign investment access to the telecom market. Take, for example, the Notice issued by the MIIT last June that said 100% foreign ownership in online data and transaction processing (e-commerce) is now permitted–in reality, very few foreign companies have been able to get licenses, she said.

The BTS branch also introduced new services such as the LTE 4G network and satellite-based communication businesses, and removed obsolete ones including telegraphs and analog trunking. The written maximum foreign ownership in BTS is 49%, though in practice, the entire category is closed off to foreign investors.

By Katherine Jo

中国近期将云计算业务的某些部分纳入监管范围，促使 Microsoft 和 IBM 等全球 IT 巨头确保其本地合作伙伴遵循新要求。

不过自 2016 年 3 月 1 日生效的新分类系统并非面面俱到，而是仅涵盖两个部分，遗漏了一个关键方面。在工业和信息化部对《电信业务分类目录》（2015 年版）（以下称为“目录”）的诸多增删改动中，云计算的重新分类引起了最大争议。

“按照新规定，跨国企业的本地合作伙伴需要另外申请互联网数据中心 IDC 许可执照，” 美富律师事务所的 Paul McKenzie 说道。

电信业务主要分为两组：基础电信服务 (BTS) 和增值电信服务 (VATS)，其中分别包括两个子类别。工信部已开始针对各个组成部分来监管云业务。云计算共分三个类别，分别为基础设施即服务 (IaaS)、平台即服务 (PaaS) 和软件即服务 (SaaS)，后两者现已纳入工信部的监管领域。

具有 IaaS 和 PaaS 业务模式的外国公司如今属于新增值电信服务类别“互联网资源协作(IRC) 服务”（IDC 的一项子类别），因此需要获得批准。

这意味着，国内公司将需要申请新 IDC 许可执照，才能开展云业务。 “这理论上导致 IRC 提供商必须满足针对 IDC 的更复杂要求，”McKenzie 表示，“这一较广泛的监管许可执照机制将需要更新，以与新目录保持一致。”

SaaS 提供对软件的远程访问点，a其某些形式不属于 IRC 服务范围。

金茂凯德律师事务所的 TMT 合伙人齐斌表示，SaaS 曾是受限程度最高的业务类别，如今视为计算服务而非电信业务，而且监管机构认为云更多属于业务模式，而非独立行业。他还补充道，这一模糊性使监管机构能够在思考如何依法监管的同时，允许此服务领域创新发展的空间。

目前，监管机构将逐例具体分析这些服务的技术功能和设施。详细的批准条件预计将在今年后期发布。

跨国企业的云服务模式

跨国公司正谋求业务模式转型，并在全球范围内利用软件来满足客户需求，旨在从硬件转为云平台（IaaS、PaaS 和 SaaS）。而中国市场虽然具有难以处理的网络安全、数据和外国所有权限制，但仍然极其重要，难以放弃。

“外国投资者仅可通过合资企业进入该目录所涵盖的行业，并将需要遵循监管这些领域的所有其他法律，例如有关报告、数据本地化、加密和解密的规定。”孖士打律师行的张晓燕表示。此类要求包含在《中华人民共和国国家安全法》以及其他监管信息保护的法规中。

例如，Apple 的 iCloud 需要在中国部署数据服务器并与国企中国电信合作，才能进入中国市场。 Apple 将其加密密钥保存在海外，但如果出现国家或网络安全问题，则必须遵循中国法律交出这些信息。

Microsoft 与中国数据中心世纪互联（也是 IBM 的合作伙伴）建立联盟关系，在财务报表中实现云收益显着增长。 Oracle 与腾讯云建立了类似联合，而 Amazon 则与本地公司网宿科技和北京光环新网合作，扩展中国业务。 HP、Intel 和 Cisco 均表示将采取相似策略。

“所有外国公司都想在中国市场抢分蛋糕，”齐斌表示，“尽管选择不同的合作伙伴，但 跨国企业 都面临相同的市场准入限制。”

2015 年8 月的Cisco 调查表明，79% 的中国组织使用或计划实施云服务，阿里巴巴去年夏天为其云计算业务单位阿里云砸下10 亿美元，而Bain 预测到2020 年，中国市场的云投入可能将达到200 亿美元。

其他重大增值电信服务和 BTS 修改

根据美富律师事务所简报，2003 年旧版目录将增值电信服务下的互联网信息服务 (IIS) 视为涵盖不属于其他领域的多种服务的笼统许可执照类别。 12 年后，此更新版本将互联网业务范围扩展至五个新领域：

• 信息发布和递送
• 搜索引擎
• 社交媒体/网络平台
• 信息即时交互，例如即时通信和语音/视频通话服务
• 信息保护和处理，例如防毒软件和垃圾邮件过滤器

“IIS 类别已基于互联网的快速发展以及巨大的投资吸引力和高额活动进行全面周密的修订。 ”鸿鹄律师事务所的合伙人 陈曼珊说道。

其他新服务也已添加到增值电信服务类别，例如内容分销商网络 (CDN)（包括缓存）和互联网域名（包括 DNS 托管）。

互联网访问服务已从增值电信服务 II 类移至 I 类。 “I 类许可执照更难获得，这一变动并不令人惊讶，大约七年前就曾打击互联网服务提供商 ISP 许可执照的签发，”陈曼珊说道。

与此同时，“在线数据处理与交易处理”从 I 类变为 II 类，与政府在 2015 年放松外国企业电子商务限制的政策相符。

尽管政策放松且法规允许最高 50% 的外国增值电信服务投资，但执业者表示，在实践中仍然具有很大的自由裁量性，而且外国公司仍难以获得批准。

陈曼珊认为，此目录旨在对业务领域进行分类，对于放开外国投资进入电信市场并无太大影响。她表示，举例而言，虽然工信部在去年六月发布的通知中宣布，目前允许外国投资拥有100% 的在线数据处理与交易处理（电子商务）业务所有权，但实际上仅有极少数外国公司能够获得这一许可。

BTS 分支也引入了新服务，例如 LTE 4G 网络和卫星通信业务，同时移除了电报和模拟集群通信等过时业务。针对 BTS 领域书面规定的最大许可外国所有权为 49%，但在实践中，这整个类别都对外国投资者封闭。

（作者：赵修敏）

China moved to bring sections of the cloud computing business under a regulatory umbrella recently, pushing global IT giants including Microsoft and IBM to ensure that their local partners comply with the new requirements.

The new classification system–which took effect on March 1–leaves the job half-done, though, covering two parts and leaving a key area in the shadows. Among the various additions and deletions in the Ministry of Industry and Information Technology (MIIT)'s Classified Catalogue of Telecommunications Services (2015 Edition) (Catalogue), the re-categorization of cloud computing has sparked the most debate.

“The IDC [internet data center] license is the new thing that the MNCs' local partners will need to apply for,” said Paul McKenzie of Morrison & Foerster.

Telecom services are categorized in two main groups: basic telecom services (BTS) and value-added telecom services (VATS), with each consisting of two sub-types. The MIIT has approached the cloud business through its individual components. The lower two of the three categories of cloud computing – Infrastructure as a Service (IaaS), Platform as a Service (PaaS) and Software as a Service (SaaS) – are now under the ministry's regulatory fold.

Foreign companies that use the IaaS and PaaS models will be subject to approval as they now lie under the new VATS category of internet resource collaboration (IRC) services, a subset IDC services.

This means that domestic companies will need to apply for the new IDC license to conduct cloud businesses. “This in theory makes IRC providers subject to the more onerous requirements of IDC,” said McKenzie, adding that the broader regulatory licensing regime will need to be updated to match the Catalogue.

SaaS, which provides remote point of access to software, has some of its forms fall outside the description of IRC services.

Once assumed to be the most heavily restricted, SaaS is being interpreted as a computing and not a telecom service, and the regulator sees the cloud as more of a business model than a sector of its own, said Bin Qi, a TMT partner at Jin Mao Partners. He added that this ambiguity allows the regulator to promote the service as room for innovation while it figures out how to legally oversee it.

For the time being, it will analyze the technical functions and facilities of the services on a case-by-case basis. Detailed approval conditions are expected to be released later this year.

MNCs' cloud services models

Multinationals are transforming their business models and leveraging software on a global scale to meet client needs, which are shifting from hardware to cloud-based platforms (IaaS, PaaS and SaaS). And the Chinese market—with all its cumbersome cybersecurity, data and foreign ownership restrictions—is too important to let go.

“Foreign investors can only enter the Catalogue's sectors through a JV and will need to comply with all the other laws that regulate these areas, such as those for reporting, data localization, encryption and decryption,” said Xiaoyan Zhang, counsel at Mayer Brown JSM. Such requirements are set by the PRC National Security Law and other pieces of legislation that govern information protection.

For instance, Apple's iCloud was required to have its data server in China and it partnered with state-owned China Telecom to enter the market. The company keeps its encryption keys overseas, but in the event of a national or cybersecurity issue, it will have to comply with Chinese laws in handing over this information.

Microsoft allied with 21Vianet, a Chinese data center that IBM is also working with, and reportedly saw a dramatic increase in their cloud revenue. Oracle struck a similar deal with Tencent Cloud, and Amazon expanded in the country with local firms ChinaNetCenter and Sinnet. HP, Intel, Cisco are all said to be pursuing similar strategies.

“Everyone is fighting to get a piece of the action,” said Qi, adding that despite the different partner arrangements, the MNCs all face the same market entry restrictions.

A Cisco survey in August 2015 found that 79% of Chinese organizations are using or planning to implement the cloud business—Alibaba pumped $1 billion into its cloud computing unit Aliyun last summer—and Bain predicted cloud spending in China could reach $20 billion by 2020.

Other big VATS and BTS updates

The internet information services (IIS) class under VATS was used by the old 2003 Catalogue as a catch-all licensing category for many services that didn't quite fit into the other fields, according to a Morrison & Foerster alert. 12 years later, this updated version expands the scope of internet businesses to five new fields:

• Information publishing and distribution
• Search engines
• Social media/network platforms
• Real-time information exchange, e.g. instant messaging and voice/video call services
• Information protection and processing, e.g. anti-virus software and spam filters

“The IIS category has been thoroughly revised due to the internet's rapid evolution and sheer amount of investment appeal and activity,” said Michelle Chan, partner at Bird & Bird.

Other new services have been added to the VATS category, such as content distributor networks (CDN), which cover caching, and internet domain names, which include DNS hosting.

Internet access services have been moved from Type II to Type I VATS. “It's harder to get licenses for Type I, so this isn't too surprising a move as, around seven years ago, there was a crackdown on the issuance of ISP [internet service provider] licenses,” said Chan.

Meanwhile, “online data processing and transaction” has been moved from Type I to II, paralleling the government's relaxation of foreign restrictions in e-commerce in 2015.

Despite these gestures and a legal provision that permits up to 50% foreign investment in VATS, practitioners say that, in practice, approval still remains largely discretionary and difficult to obtain for non-Chinese companies.

Chan believes that while the Catalogue serves to classify the business, it has no great impact on liberalizing foreign investment access to the telecom market. Take, for example, the Notice issued by the MIIT last June that said 100% foreign ownership in online data and transaction processing (e-commerce) is now permitted–in reality, very few foreign companies have been able to get licenses, she said.

The BTS branch also introduced new services such as the LTE 4G network and satellite-based communication businesses, and removed obsolete ones including telegraphs and analog trunking. The written maximum foreign ownership in BTS is 49%, though in practice, the entire category is closed off to foreign investors.

By Katherine Jo

中国近期将云计算业务的某些部分纳入监管范围，促使 Microsoft 和 IBM 等全球 IT 巨头确保其本地合作伙伴遵循新要求。

不过自 2016 年 3 月 1 日生效的新分类系统并非面面俱到，而是仅涵盖两个部分，遗漏了一个关键方面。在工业和信息化部对《电信业务分类目录》（2015 年版）（以下称为“目录”）的诸多增删改动中，云计算的重新分类引起了最大争议。

“按照新规定，跨国企业的本地合作伙伴需要另外申请互联网数据中心 IDC 许可执照，” 美富律师事务所的 Paul McKenzie 说道。

电信业务主要分为两组：基础电信服务 (BTS) 和增值电信服务 (VATS)，其中分别包括两个子类别。工信部已开始针对各个组成部分来监管云业务。云计算共分三个类别，分别为基础设施即服务 (IaaS)、平台即服务 (PaaS) 和软件即服务 (SaaS)，后两者现已纳入工信部的监管领域。

具有 IaaS 和 PaaS 业务模式的外国公司如今属于新增值电信服务类别“互联网资源协作(IRC) 服务”（IDC 的一项子类别），因此需要获得批准。

这意味着，国内公司将需要申请新 IDC 许可执照，才能开展云业务。 “这理论上导致 IRC 提供商必须满足针对 IDC 的更复杂要求，”McKenzie 表示，“这一较广泛的监管许可执照机制将需要更新，以与新目录保持一致。”

SaaS 提供对软件的远程访问点，a其某些形式不属于 IRC 服务范围。

金茂凯德律师事务所的 TMT 合伙人齐斌表示，SaaS 曾是受限程度最高的业务类别，如今视为计算服务而非电信业务，而且监管机构认为云更多属于业务模式，而非独立行业。他还补充道，这一模糊性使监管机构能够在思考如何依法监管的同时，允许此服务领域创新发展的空间。

目前，监管机构将逐例具体分析这些服务的技术功能和设施。详细的批准条件预计将在今年后期发布。

跨国企业的云服务模式

跨国公司正谋求业务模式转型，并在全球范围内利用软件来满足客户需求，旨在从硬件转为云平台（IaaS、PaaS 和 SaaS）。而中国市场虽然具有难以处理的网络安全、数据和外国所有权限制，但仍然极其重要，难以放弃。

“外国投资者仅可通过合资企业进入该目录所涵盖的行业，并将需要遵循监管这些领域的所有其他法律，例如有关报告、数据本地化、加密和解密的规定。”孖士打律师行的张晓燕表示。此类要求包含在《中华人民共和国国家安全法》以及其他监管信息保护的法规中。

例如，Apple 的 iCloud 需要在中国部署数据服务器并与国企中国电信合作，才能进入中国市场。 Apple 将其加密密钥保存在海外，但如果出现国家或网络安全问题，则必须遵循中国法律交出这些信息。

Microsoft 与中国数据中心世纪互联（也是 IBM 的合作伙伴）建立联盟关系，在财务报表中实现云收益显着增长。 Oracle 与腾讯云建立了类似联合，而 Amazon 则与本地公司网宿科技和北京光环新网合作，扩展中国业务。 HP、Intel 和 Cisco 均表示将采取相似策略。

“所有外国公司都想在中国市场抢分蛋糕，”齐斌表示，“尽管选择不同的合作伙伴，但 跨国企业 都面临相同的市场准入限制。”

2015 年8 月的Cisco 调查表明，79% 的中国组织使用或计划实施云服务，阿里巴巴去年夏天为其云计算业务单位阿里云砸下10 亿美元，而Bain 预测到2020 年，中国市场的云投入可能将达到200 亿美元。

其他重大增值电信服务和 BTS 修改

根据美富律师事务所简报，2003 年旧版目录将增值电信服务下的互联网信息服务 (IIS) 视为涵盖不属于其他领域的多种服务的笼统许可执照类别。 12 年后，此更新版本将互联网业务范围扩展至五个新领域：

• 信息发布和递送
• 搜索引擎
• 社交媒体/网络平台
• 信息即时交互，例如即时通信和语音/视频通话服务
• 信息保护和处理，例如防毒软件和垃圾邮件过滤器

“IIS 类别已基于互联网的快速发展以及巨大的投资吸引力和高额活动进行全面周密的修订。 ”鸿鹄律师事务所的合伙人 陈曼珊说道。

其他新服务也已添加到增值电信服务类别，例如内容分销商网络 (CDN)（包括缓存）和互联网域名（包括 DNS 托管）。

互联网访问服务已从增值电信服务 II 类移至 I 类。 “I 类许可执照更难获得，这一变动并不令人惊讶，大约七年前就曾打击互联网服务提供商 ISP 许可执照的签发，”陈曼珊说道。

与此同时，“在线数据处理与交易处理”从 I 类变为 II 类，与政府在 2015 年放松外国企业电子商务限制的政策相符。

尽管政策放松且法规允许最高 50% 的外国增值电信服务投资，但执业者表示，在实践中仍然具有很大的自由裁量性，而且外国公司仍难以获得批准。

陈曼珊认为，此目录旨在对业务领域进行分类，对于放开外国投资进入电信市场并无太大影响。她表示，举例而言，虽然工信部在去年六月发布的通知中宣布，目前允许外国投资拥有100% 的在线数据处理与交易处理（电子商务）业务所有权，但实际上仅有极少数外国公司能够获得这一许可。

BTS 分支也引入了新服务，例如 LTE 4G 网络和卫星通信业务，同时移除了电报和模拟集群通信等过时业务。针对 BTS 领域书面规定的最大许可外国所有权为 49%，但在实践中，这整个类别都对外国投资者封闭。

（作者：赵修敏）