State Council Decree No. 837 (effective July 1, 2026) establishes a security-focused legal framework that reshapes outbound M&A. It does not ban consumer sector deals, but it changes how they must be structured, approved, and integrated.
Resident individuals are, for the first time, explicitly included within the regulatory framework for outbound investment. In the past, individual overseas investments, such as setting up BVI companies, Cayman entities, or purchasing overseas property, were primarily governed by the State Administration of Foreign Exchange (SAFE) under Circular 37, which focused on foreign exchange administration n but lacked a systematic permitting and compliance guidance system. Decree No. 837 now establishes a regulatory foundation at the administrative regulation level. Although Article 33 authorizes relevant authorities to formulate separate implementation rules for individual investments, the direction is clear: the grey area in individual outbound investment is closing. For consumer sector M&A, a significant number of transactions involve high-net-worth individuals participating through family offices or SPVs. Going forward, the investment paths, funding sources, and offshore asset control relationships of these individual investors must all be able to withstand regulatory “look-through” scrutiny.
“Indirect” investment being brought under supervision means multi-layered offshore structures can no longer circumvent compliance obligations. The new decree adopts a “substance-over-form” review principle. In the past, some consumer companies sought to avoid Chinese regulatory oversight by setting up holding companies in Hong Kong, the Cayman Islands, or Singapore, and then executing acquisitions through those offshore entities. Under the new rules, however, such “round-tripping” or “routing” behavior itself may be deemed an independent outbound investment, requiring its own separate filing or approval. The Meta acquisition of Chinese-founded AI startup Manus closed in late 2025; in April 2026 the NDRC ordered the parties to unwind it. The deal sits outside the consumer sector, but the precedent applies directly to it: even if both transacting parties are non-Chinese entities, if the deal involves core Chinese assets, technology, or personnel, Chinese regulators have the authority to intervene. If a consumer M&A target has Chinese R&D teams, Chinese consumer data, or core technology originating from China, it still faces review risk even if “whitewashed” as a non-Chinese entity through offshore structures.
“Indirect transfer” of technology exports has been effectively closed off. Article 13 explicitly prohibits the indirect outflow of state-restricted or prohibited goods, technologies, and important data through means such as “cross-border personnel placement, overseas technical training, and remote technical guidance.” This provision means that post-acquisition “technology handover” and “knowledge transfer” can no longer be treated as routine integration activities. If the target company possesses independently developed cosmetic formulation technologies, AI-driven personalized recommendation algorithms, smart manufacturing processes, or similar assets, the cross-border transfer of such technologies must undergo export control compliance assessment and obtain the requisite permits prior to the acquisition. The previously common approach of “acquire first, integrate technology later” may now constitute a direct violation under the new rules.
Compliance assessment for technology exports must be elevated to the transaction structuring stage. Previously, companies tended to conduct “technology due diligence” and “compliance due diligence” as separate workstreams. Under the new regulatory regime, these two must be integrated and pursued in tandem. This is particularly critical for consumer sector targets that carry a “tech-enabled” identity such as smart beauty devices, AI-powered fashion platforms, or big-data-driven supply chain management systems. The origin of their technology, the location of their R&D teams, where data is stored, and the degree of technological linkage to China all directly affect whether the transaction will trigger a national security review. If a target company’s core technology originated in China and its R&D team is primarily based in mainland China, even if its registration has been relocated offshore, regulators may still scrutinize its cross-border transfer. This means that in consumer M&A, the “technology nationality” of the target asset is more critical than its “registration nationality.”
Supervision no longer stops the moment the filing receipt is obtained. In the past, if the filing approvals from the National Development and Reform Commission (NDRC) and the Ministry of Commerce (MOFCOM) were secured and foreign exchange registration was completed, the deal was considered “cleared.” Under the new decree, investors and their overseas investment entities must “establish robust systems for compliance management, internal controls, work safety, and emergency response,” and “commit necessary personnel, funds, and equipment resources” to these efforts. This means that the post-merger integration (PMI) phase now requires not only business integration but also the simultaneous establishment of an overseas corporate governance system that meets Chinese regulatory requirements. After acquiring overseas brands, consumer companies must ensure that their overseas subsidiaries can continuously fulfill information reporting obligations, cooperate with regulatory inspections, and complete compliance assessments in advance for any subsequent capital increases, reinvestments, or asset disposals.
The specific impact on consumer M&A is reflected in the drafting of transaction documents. Buyers must explicitly stipulate in transaction agreements that sellers are obligated to cooperate in obtaining Chinese regulatory approvals, and that ODI filings and national security review clearances must be conditions precedent to closing. Additionally, during the post-closing transition period, buyers are required to adjust the target company’s governance structure, compliance systems, and data management practices to satisfy China’s ongoing supervisory requirements. Furthermore, because regulators can intervene at any stage of an investment’s lifecycle, provisions in transaction agreements relating to “regulatory changes”, such as Material Adverse Change (MAC) clauses, reverse breakup fees, and termination provisions, must also be adjusted accordingly to address the uncertainties introduced by the new regulatory landscape.
The decree also introduces a countermeasure mechanism that changes the risk calculus on the other side of the table. Articles 24 and 25 authorize State Council departments to act against foreign organizations and individuals that discriminate against Chinese investors, with measures that include restricting their China-related import and export activity, their inbound investment, and their transactions with Chinese counterparties. For consumer M&A, the practical consequence is that regulatory risk is no longer one-directional. A seller or co-investor in a jurisdiction with an active foreign investment screening regime must now weigh the possibility that a hostile screening decision triggers Chinese countermeasures against its own China business. Counterparties with meaningful China revenue will price this into deal terms, and buyers should expect the question to surface in negotiations over conditions precedent and allocation of regulatory risk.
Decree No. 837 turns compliance in consumer outbound M&A from a one-off filing exercise into an obligation that runs the full length of the transaction. Whether it involves the participation of individual investors, the design of indirect holding structures, the cross-border flow of technology and data, or the triggering of national security reviews and the application of countermeasure mechanisms, all require M&A teams to conduct integrated assessments across legal, technical, data, and geopolitical dimensions. For consumer transactions, the previously prevalent model of “light on compliance, heavy on deal-making” is no longer sustainable. It must be replaced by a comprehensive compliance management system that runs through the entire deal continuum: from pre-deal due diligence and transaction structuring, through regulatory approvals and post-merger integration, to eventual asset disposals and exits.
For mid-market consumer acquirers, the practical burden is heavier than the legal text suggests. The compliance model the decree requires (export control assessment at structuring, data localization review in diligence, governance systems built into post-merger integration) assumes capabilities that large corporates hold in-house and most mid-market buyers do not. A buyer running two or three cross-border transactions a decade cannot justify a standing team for this, yet under the new framework the absence of one is now a source of execution risk, not merely legal risk: transactions structured without these assessments will stall at review or become violations after closing. The acquirers that transact successfully under Decree No. 837 will be those that bring regulatory, technical, and deal workstreams into a single process from the outset, whether by building that capacity or by retaining advisors who carry it across borders as standard practice. Compliance has become part of the transaction’s architecture. Treating it as a closing condition is the one approach the new framework has clearly foreclosed.
Author:
Yang Yu
Associate
Receive our latest market insights, news and reports, and business bulletins.
