A Doctor Took Less Than $5,000 in Kickbacks. Regulators Traced It to a Listed Drugmaker Three Companies Away.

Why liability-shifting clauses in China's CSO agreements do not survive a look-through compliance review.

Four WeChat transfers. Thirty-five thousand yuan, paid out over a year.

A promotion consultant in Shanghai paid a physician to prescribe more of a blood-thinning drug.

Regulators fined the consultant three hundred thousand yuan for commercial bribery. Then they kept going.

They asked the drug's distributor to name the party actually responsible. The distributor's answer led straight to a company whose shares trade on the Shenzhen Stock Exchange.

This is not really a story about one small promotion contract. It is what a look-through compliance review looks like in practice, and it raises a question every pharmaceutical company relying on a Contract Sales Organization, or CSO, should ask: can liability for commercial bribery actually be contracted away? Under the framework reaching full effect this year, the answer is no.

The case behind that answer is worth telling briefly. The sequence matters more than the amounts.

The Case Behind the Question

In January 2023, Shanghai Haiyilai Enterprise Consulting Management Partnership signed a one-year information services agreement to promote Shanghai Hongjian Pharmaceutical's dalteparin sodium injection, sold as Wanmaining, to Shanghai hospitals. Over the following year, Haiyilai's sales director paid a physician roughly 35,000 yuan across four transfers. That corresponded to 18,275 units of the drug prescribed in the same period. Haiyilai collected close to 870,000 yuan in fees from Hongjian for the same work.

Shanghai regulators fined Haiyilai 300,000 yuan for commercial bribery in August 2025. That would ordinarily be the end of it. Instead, the Shanghai Pharmaceutical Affairs Institute opened a credit evaluation proceeding against Hongjian and required it to identify who was actually responsible. Hongjian answered by submitting its own sales contracts and invoices, naming its supplier: Hebei Changshan Biochemical Pharmaceutical, the listed manufacturer known to investors as Changshan Pharmaceuticals (300255.SZ). The evaluation then moved to the manufacturer itself.

Three companies, one enforcement thread. A kickback of a few thousand dollars reached a listed company's compliance record.

Regulators have never treated the CSO structure itself as the problem. A CSO is not a licensed category under Chinese law; most register under ordinary scopes like marketing planning or information consulting, and none of that requires a Drug Trading License. What regulators test for is whether the fee paid corresponds to a real, verifiable service. That gap has a specific history: China's Two-Invoice System eliminated the layered distributor margins that used to move a drug from factory to hospital, and the same margin resurfaced as a "promotion service fee" paid to a CSO. The invoice changed from a sales invoice to a service invoice. The underlying profit allocation barely changed at all.

A CSO agreement is not unlawful. A CSO agreement used as a channel for undocumented payments is. That distinction is what the rest of this analysis turns on.

The Chain a Credit Evaluation Actually Follows

Most compliance discussions of CSO risk focus on the promotion agreement itself: who signed it, what it says about responsibility, what invoices back it up. Lawyers unfamiliar with China's CSO model often assume that a clean written agreement settles the question of who answers for a promoter's conduct. The Haiyilai case shows it does not. A look-through review does not stop at the agreement; it follows the money and the paper past the parties who signed it.

Prescribing physician
      ↑ payment
CSO / promotion consultant  ── fined for commercial bribery
      ↑ service fee
Distributor  ── ordered to name the responsible party
      ↑ sales contract + invoices
Manufacturer  ── credit evaluation extended upstream

Each link in that chain is a separate legal relationship, usually governed by a separate contract with its own liability clauses. None of those clauses stopped the evaluation from moving to the next link. The mechanism driving that movement — the Price and Procurement Credit Evaluation System, operated by China's National Healthcare Security Administration since 2020 — does not ask which contract assigns fault. It asks the distributor to prove where the money and the goods actually came from, and follows the answer wherever it leads.

Why the Rules Now Point in the Same Direction

Three developments are converging within about a year of each other. Each closes a different gap that used to let a liability-shifting clause do its job.

The Administrative Measures for Pharmaceutical Representatives (Announcement No. 42 of 2026, National Medical Products Administration and six other authorities, promulgated May 7, 2026, effective August 1, 2026) closes the "we assessed nothing" gap. Article 8 requires a marketing authorization holder that commissions a professional organization for academic promotion to assess that organization's capability, and to agree on compliance requirements and violation liability. It must also sign a management agreement and obtain authorization letters from the individuals doing the promotion. Article 24 separately bars pharmaceutical representatives from handling sales tasks, payment, or invoices, and bars the holder from assigning them sales targets at all.

The Anti-Unfair Competition Law (2025 Revision, effective October 15, 2025) closes the "prove it" gap. The commercial bribery provision moved from the old Article 7 to Article 8, and the burden of proof moved with it. Bribery by an operator's staff member is now presumed to be the operator's own conduct. The operator must prove the payment was unrelated to securing a transaction or a competitive advantage. The regulator no longer has to prove the opposite. Fines under the revised law can also reach the legal representative and the responsible individuals directly, up to one million yuan, not just the entity.

Worth flagging for accuracy: the Haiyilai penalty predates this amendment. It was issued in August 2025, two months before the revised law took effect, so regulators relied on the older Article 7(1)(3). The same facts today would fall under Article 8, and the company would carry the burden the regulator used to carry.

The Judicial Interpretation (II) on handling criminal cases of embezzlement and bribery (effective May 1, 2026) closes the "the employee takes the fall" gap. It narrows the standard for finding a unit, rather than an individual, guilty of bribery. Prosecutors now focus on whether the company actually benefited and where the bribe funds genuinely came from. Letting an employee absorb criminal responsibility while the company keeps the commercial benefit is losing its practical value.

Read together, the three rules remove every exit a liability-shifting clause used to rely on: the excuse of not knowing, the advantage of not having to prove anything, and the option of leaving one employee to answer for the company.

Where the Liability-Shifting Clause Falls Apart

The clause I see most often in these agreements assigns sole responsibility for any violation arising from promotion activity to the CSO, with the pharmaceutical company or distributor expressly carved out. On its face, that looks like a complete transfer of risk.

In my experience, that clause is one of the most common provisions in Chinese CSO agreements and one of the least useful once a look-through review actually starts. Under the reversed burden of proof, the company must affirmatively show the bribery was unrelated to it; the contract's own allocation of blame does not discharge that burden. Under the Administrative Measures, a marketing authorization holder that "instigates or connives at" a violation is itself at fault. Connivance describes a failure to act, not an active instruction. A purely defensive clause does nothing to show the company met its actual oversight duty. And under the credit evaluation mechanism, no one asks what the contract says at all; the distributor is simply told to produce its own paper trail.

I would also caution against treating a clean-looking chain as evidence that an arrangement is safe. The Haiyilai case took roughly two and a half years to surface, from the original service agreement to the eventual penalty. The most consistently underestimated risk in this area, in my experience, is the assumption that formal alignment of contract, goods, invoice, and payment flows — the "four-flow consistency" long treated as the ceiling of CSO compliance — is still sufficient. Regulators now treat that alignment as a starting point for inquiry, not a stopping point.

What Actually Protected Anyone in This Case

Nothing in the Haiyilai case turned on which company's name appeared on which agreement. It turned on whether each party could produce, on request, a paper trail showing what it actually did for the money it received or paid. Hongjian could show its supply chain. Haiyilai could not show a comparable record of the services its fee was meant to cover, and that absence, not the promotion agreement's wording, is what the penalty rested on.

Practitioner's Note. For a company sitting anywhere in a CSO relationship, the practical protection has never been the indemnification clause. It is the ability to produce, months or years later, a verifiable record that a service was actually delivered for the fee collected: attendance logs, materials used, dated photographs, expense receipts, and a paper trail that does not depend on the counterparty's cooperation to reconstruct. A liability clause tells a court who should pay if something goes wrong. A verifiable service record is what determines whether anything was wrong in the first place, and it is the only thing a credit evaluation actually asks to see.

---

FAQ

Does this mean CSO arrangements are illegal in China? No. The structure itself remains lawful. What the current framework targets is a CSO fee that cannot be tied to a real, documented service.

If a liability-shifting clause does not work, what should replace it? Not a different allocation of blame, but a contractual mechanism for producing evidence: defined deliverables, a verification and sign-off process, and record-retention obligations that survive the relationship's end. The clause worth drafting establishes what must be documented, not who is blamed if it isn't.

---

This article discusses a publicly reported enforcement matter and general regulatory developments. It does not constitute legal advice and should not be relied upon in relation to any specific transaction or dispute. Readers facing a comparable situation should seek advice on their own facts.

Legal Authorities

• Administrative Measures for Pharmaceutical Representatives (Announcement No. 42 of 2026, National Medical Products Administration and six other authorities, promulgated May 7, 2026, effective August 1, 2026), Articles 8, 24
• Anti-Unfair Competition Law (2025 Revision, effective October 15, 2025), Article 8 (formerly Article 7)
• Interpretation (II) of the Supreme People's Court and the Supreme People's Procuratorate on Several Issues Concerning the Application of Law in Handling Criminal Cases of Embezzlement and Bribery (effective May 1, 2026)
• Price and Procurement Credit Evaluation System, National Healthcare Security Administration (in operation since 2020)

Last Reviewed: July 23, 2026