Every Investment Was Approved. More Than RMB 190 Billion Still Reached the Controlling Shareholder.

Three insurers bought the trust plans.

The contracts were signed. The money moved.

Between November 2013 and January 2017, the purchases kept coming.

More than RMB 190.9 billion ended up under the control of the group behind the insurers.

In August 2022, the Shanghai No. 1 Intermediate People's Court convicted Tomorrow Holding and its actual controller, Xiao Jianhua, of illegally using funds, among other offenses. The court found that they had manipulated Huaxia Life, Tianan Life and Yian P&C into funding the group's sham financing projects without any substantive review. The insurers did this by buying trust plans, directly or indirectly. The scale was extreme. The mechanism was not: insurance money reaching a controlling shareholder through transactions that look ordinary on paper.

In September 2026, the National Financial Regulatory Administration (NFRA) published a draft revision of the PRC Insurance Law for public comment. The draft answers a question that matters to anyone who invests, manages or receives Chinese insurance money: when insurance funds reach a shareholder through an approved transaction, who is liable, and does the approval help?

The short answer

Under China's proposed Insurance Law revision, internal investment approval would not, by itself, protect an insurer or its staff from liability for the unlawful use of insurance funds. Draft Articles 87 and 115 address both sides of the problem: shareholders taking improper control of insurance assets, and prohibited conduct by the insurers investing them. Regulators would therefore look past whether a transaction was approved, to its structure, its counterparties and where the money finally went. Documented diligence may still matter when individual responsibility is assessed, but it is not an automatic defense. Approval does not establish legality; evidence may still affect liability.

Article 115: five prohibited uses of insurance funds, and who they bind

The current statute, the PRC Insurance Law (2015 Amendment), sets out the permitted forms of investment in Article 106. It has no provision listing what insurance money must never be used for. Those rules sit in NFRA's departmental regulations. The draft (Revised Draft for Public Comment, published September 4, 2026) moves them into the statute. Draft Article 115 provides that insurers, insurance asset management companies and their staff may not, in conducting insurance fund investment:

1. misappropriate, withhold or embezzle insurance funds or the assets formed by investing them;
2. use those funds or assets to provide guarantees or loans to others in violation of regulations;
3. use them for related-party transactions in violation of regulations;
4. use them to obtain improper benefits; or
5. engage in other conduct prohibited by laws, administrative regulations or NFRA rules.

Two drafting choices do most of the work. First, the employees are named as obligors in their own right, not merely as people the institution answers for. Second, the object of the prohibition is not only cash but "assets formed by investing" it. Pledging units of a debt investment plan, or shares bought with premium income, to secure a shareholder's borrowing is caught as squarely as wiring the cash.

The draft then closes the loop from the shareholder's side. Draft Article 87 lists eight things a shareholder or actual controller may not do. One of them is illegally occupying or controlling insurance funds and the assets formed from them. The prohibitions reach the shareholder's own controlling shareholder and actual controller. And the insurer and its staff are expressly barred from assisting.

An investment officer's conduct may therefore fall within both provisions: Article 115's prohibitions on the use of insurance funds, and Article 87's bar on assisting a shareholder. Multiple legal characterizations do not necessarily mean cumulative penalties. Under Article 29 of the PRC Administrative Penalty Law (2021 Revision, effective July 15, 2021), the same unlawful act may not be subject to more than one administrative fine. Where the act violates several provisions that prescribe fines, the provision carrying the higher fine applies. Neither provision makes procedural approval, by itself, a defense to unlawful conduct.

The penalties explain why this matters now. Under the current law, Article 164 caps the fine on an institution for "failing to use insurance funds in accordance with regulations" at RMB 300,000. Article 171 caps the fine on responsible individuals at RMB 100,000. When the former China Insurance Regulatory Commission penalized Foresea Life in February 2017 after its high-profile stake-building in a listed property developer, the fine for the improper use of funds was RMB 300,000. That was the statutory maximum. Its chairman was barred from the industry for ten years.

Conduct	Current law (2015)	Draft revision
Improper use of insurance funds, institution	RMB 50,000 to 300,000 (Art. 164)	1 to 10 times illegal gains; if none or under RMB 200,000, RMB 200,000 to 2 million (Art. 186)
Breach of an Article 115 prohibition, institution	No separate tier	1 to 10 times illegal gains; if none or under RMB 1 million, RMB 1 million to 10 million; license may be revoked (Art. 195)
Directly responsible individuals, Article 115 breach	RMB 10,000 to 100,000 (Art. 171)	RMB 200,000 to 2 million; disqualification for a period or for life (Art. 195)

Criminal liability already sits above the administrative regime. Article 185-1(2) of the PRC Criminal Law makes it an offense for insurers, insurance asset managers and certain other financial institutions to use funds in violation of state regulations. The institution is fined, and its directly responsible managers and staff face criminal liability. In the Tomorrow Holding case, the court convicted the controlling group and its actual controller of this offense. Who can be charged, and on what theory, depends on the facts of each case.

Why investment approval is not a safe harbor

Lawyers trained in common law systems tend to read governance through process. If a decision went through an independent committee, on documented diligence, with conflicts declared, the people who made it are usually well protected. The business judgment rule is the clearest form of that instinct.

Neither the current Insurance Law nor the draft contains an equivalent safe harbor. Article 115 looks at what happened to the money, not at how the decision was reached. The Tomorrow Holding judgment shows why. The court found that the controllers had stopped the insurers from conducting substantive review at all.

Enforcement under the current law already looks through form. In June 2025, NFRA revoked Tianan Life's business license. The violations cited included using investment assets to provide guarantees or loans, and channeling benefits to the actual controller through related-party transactions. Three individuals were barred from the insurance industry for life. In the same month, Huaxia Jiuying Asset Management, another former affiliate of the group, was penalized for misusing funds and for misstatements in its related-party reporting.

That does not make the approval file irrelevant, though its role differs from what a common law reader might expect. The file is evidence of who took part in the decision, what they knew and what they asked, and that evidence can cut either way. A sign-off on a structure whose end recipient nobody examined shows participation. A documented inquiry, a recorded dissent or an escalation to the board points the other way.

Article 33 of the Administrative Penalty Law provides that no penalty is imposed where a party has sufficient evidence that it was not at fault. That is not a general due-diligence defense. Whether an individual investment officer can show an absence of fault will depend on that person's actual duties, knowledge and involvement, and on the evidence of reasonable diligence. How regulators will apply the provision to individual staff under the draft remains to be seen.

The related party is rarely the named counterparty

The practical difficulty is that the connection to the shareholder seldom appears at the first layer. In my experience, where an insurance-funded transaction later turns out to be a related-party transaction, the link usually sits two or three layers down. A related-party screen that stops at the named counterparty will clear transactions that a regulator, applying substance over form, may later reclassify.

Consider a hypothetical transaction. A foreign private equity firm manages an onshore investment fund, and a Chinese insurer invests in that fund through a domestic asset management product. The fund then acquires an equity interest in a portfolio company that is ultimately controlled by an affiliate of the insurer's shareholder. The manager has no direct contractual relationship with that shareholder and may not know the relationship exists, yet the investment may still raise related-party concerns for the insurer, because the relevant relationship lies beyond the immediate contracting parties.

For the manager, the more pressing question is usually what happens to the deal. A violation of an NFRA departmental rule does not, by itself, invalidate a contract under the mandatory-provision test in Article 153 of the PRC Civil Code, which looks to laws and administrative regulations. Regulatory violations may still be relevant to a separate public-order analysis, particularly where the arrangement implicates financial security or the public interest. Article 17 of the Supreme People's Court's Interpretation on the General Part of Contracts (effective December 5, 2023) governs that analysis and directs courts to weigh factors including the intensity of regulatory supervision and the social consequences of the conduct.

It is not a rule that every financial-regulatory breach voids a contract. The outcome depends on the nature of the rule violated, the transaction and the interests affected. Validity, regulatory sanctions and restitution are therefore separate questions, and a manager should assess both the insurer's authority to invest and what would follow if a regulator later challenged the investment.

The Measures for the Administration of Related-Party Transactions of Banking and Insurance Institutions (effective March 1, 2022) already require related parties to be identified on a look-through basis. The draft lifts that duty into the statute. Article 90 requires insurers to identify related-party relationships accurately. Article 92 requires major shareholders and actual controllers to supply their ownership structure and related-party information. A missed link would then be a breach of statute, not only of departmental rules.

Foreign investors frequently overestimate how far a trust or partnership wrapper separates them from this analysis. The wrapper determines who signs the contract, but the draft is concerned with who ends up receiving the money.

What the draft leaves unsettled

This is a consultation draft. Article numbers, and possibly the penalty tiers, may change before the National People's Congress Standing Committee adopts a final text. Several points are genuinely open even on the current wording.

Not every guarantee or related-party transaction is banned. Items 2 and 3 of Article 115 prohibit guarantees, loans and related-party transactions made "in violation of regulations." The content of the prohibition will therefore come from NFRA rules, not from the statute alone. An arm's-length related-party transaction that has been properly identified, approved and reported remains permissible.

The two penalty tiers may overlap. Article 115's catch-all fifth item could pull ordinary rule breaches into Article 195, where fines start at RMB 1 million, rather than Article 186, where they start at RMB 200,000. The draft does not say where the line falls.

The standard for individual liability is undefined. Article 195 reaches the "directly responsible" managers and staff, but the draft does not say what diligence would discharge that responsibility. I would be cautious about treating a documented inquiry as a complete answer. It may still bear on whether the individual was at fault at all. Based on the regulator's past practice, I would also expect it to weigh heavily on whether a case is treated as "serious," which is the threshold for disqualification.

Timing will matter for existing investments. Under Article 37 of the Administrative Penalty Law, penalties generally follow the law in force when the conduct occurred, unless the new law is more lenient. Whether an existing investment becomes subject to the revised law will therefore depend on the timing and nature of the relevant conduct. A transaction completed before the law takes effect should be distinguished from continuing violations, new drawdowns and later investment decisions.

Practitioner's Note

The failures exposed by these cases cannot be explained simply as failures of investment analysis. The court's own finding points somewhere else: the controllers manipulated the insurers into skipping substantive review. An investment committee cannot provide meaningful protection if its members lack the independence to question transactions the controlling shareholder wants.

The proposed revision would raise the cost of failing to exercise that independence. Directly responsible staff would face much greater personal exposure. That may give them a reason to ask where the money is going, and to record the answer. But personal liability alone cannot replace effective governance, substantive diligence and the ability to challenge a controller.

For foreign investors and fund managers dealing with Chinese insurance capital, the practical question is therefore not simply whether an investment was approved. It is whether the approval reflects an independent assessment of the transaction's actual structure, its ultimate beneficiaries and its regulatory compliance.

An approval process is only as reliable as the independence and information behind it.

Questions Clients Ask

Does the draft ban insurers from all related-party transactions? No. It bans related-party transactions conducted in breach of regulations, and those that occupy or divert insurance funds. Transactions that are properly identified, priced on fair terms, approved and reported remain lawful. The risk lies mainly in failing to identify the relationship in the first place.

Can a foreign fund manager face legal or commercial consequences if a Chinese insurer invests through a prohibited related-party structure? Article 115 does not directly impose its obligations on an independent fund manager merely because the manager receives an investment from a Chinese insurer. Other liability cannot be ruled out where a manager knowingly takes part in the arrangement. The more common exposure is commercial. The insurer may be ordered to correct the investment or may be unable to meet further capital calls, and the contract's validity may be questioned on the public-order grounds discussed above. Expect deeper look-through diligence on your investors, portfolio and affiliates.

Is any of this in force yet? No. The draft must still pass through the national legislature. Until then, the current Insurance Law and existing NFRA rules govern, and current-law penalties apply. Enforcement practice, as the Tianan Life decision shows, already looks through structures to where the money went.

Legal Authorities

• PRC Insurance Law (Revised Draft for Public Comment, published by NFRA September 4, 2026), Articles 87, 90, 92, 115, 186 and 195 (NFRA notice)
• PRC Insurance Law (2015 Amendment), Articles 106, 164 and 171
• PRC Criminal Law, Article 185-1(2)
• PRC Administrative Penalty Law (2021 Revision, effective July 15, 2021), Articles 29, 33 and 37
• PRC Civil Code (effective January 1, 2021), Article 153
• Supreme People's Court Interpretation on Several Issues Concerning the Application of the General Part of the Contracts Book of the Civil Code (effective December 5, 2023), Article 17
• Measures for the Administration of Related-Party Transactions of Banking and Insurance Institutions (effective March 1, 2022)
• Shanghai No. 1 Intermediate People's Court, first-instance judgment against Tomorrow Holding and Xiao Jianhua (August 19, 2022) (court announcement)
• NFRA administrative penalty decisions concerning Tianan Life (June 13, 2025) and Huaxia Jiuying Asset Management (June 2025)
• CIRC administrative penalty decision against Foresea Life (February 2017)

Related Reading

• Private Equity Fund Risk Resolution and Manager Continuity: A Practical Legal Framework — on what happens to a fund when its manager can no longer be relied on.
• He Sold Control of a Listed Company for 1.29 Billion Yuan — At Exactly 29.99%, Not 30% — on how Chinese regulators read control behind the form of a transaction.
• What Happens to Your Chinese Company When Its Actual Controller Dies — on the actual controller as a legal concept in PRC corporate practice.

More on this area of practice: Corporate & Commercial.

---

This article is general legal analysis of PRC law as of the last reviewed date below. It is not legal advice and does not create a lawyer-client relationship. The provisions of the draft Insurance Law discussed here are in a draft for public comment and may change before enactment.

Last reviewed: October 17, 2026.