China ICP and PSB filing — sequence, requirements, and paths
Internet Content Provider (ICP) filing first, Public Security Bureau (PSB) filing within 30 days. Requirements, timelines, display rules, ongoing compliance, and how foreign teams complete Mainland China hosting filings.
If you plan to host a website or launch a mobile app on Mainland China infrastructure, two filings appear on every serious checklist: Internet Content Provider (ICP) filing and Public Security Bureau (PSB) filing. Below, we use ICP filing and PSB filing as shorthand for those full names.
They are separate processes, run by different authorities, and the law sets a fixed order between them. Mainland China hosting is the usual trigger — not simply having users in China while your product stays entirely offshore. Many foreign teams discover this only after they have already chosen a content delivery network (CDN), a domain, or a launch date.
This article explains what each filing is, why both matter, the sequence you must follow, a typical cloud-provider workflow, how foreign companies actually complete the work, and where projects most often stall. The goal is an accurate map — not a simplified checklist that breaks on first contact with Ministry of Industry and Information Technology (MIIT) or PSB review.
Key terms (read these first)
- Internet Content Provider (ICP) filing: Mandatory MIIT registration for a website or mobile app served from Mainland China servers or Mainland China CDN nodes. The property cannot legally open to the public until an ICP filing number is issued. In practice this is how regulators link domain → organizing entity → hosting location.
- Public Security Bureau (PSB) filing: Registration with the public security authority for the same online property. It records who operates the service and who is accountable for network security duties. Requirements can vary slightly by locality.
- Pre-approval: Some categories — news, publishing, education, healthcare, pharmaceuticals, culture, games, finance, and others — may need approval from a sector regulator before standard ICP filing can proceed. If your product touches a regulated category, assume extra review time.
- App filing: Mobile apps that provide internet information services in Mainland China must complete App filing under MIIT rules. Website ICP filing and App filing are related but not interchangeable. Since 2023, new apps distributed through Mainland China app stores generally need filing before publication; apps already live before that wave faced phased enforcement deadlines.
- Commercial ICP license: Separate from basic ICP filing. Required when the service processes payments, runs e-commerce, sells advertising placement, or facilitates online transactions — not only for paid membership or subscription content, and not for every foreign marketing site.
If you are unsure which of the above applies, that uncertainty is normal. Foreign teams rarely fail because the rules are secret; they fail because no one mapped triggers to their actual product and hosting plan early enough.
ICP filing at a glance
Internet Content Provider (ICP) filing is the base registration foreign teams encounter first when they choose Mainland China hosting. The table below mirrors what most provider checklists ask for before you open a filing order.
| Requirement | What it means |
|---|---|
| Organizing entity | Usually a Mainland China-registered company. Foreign parents typically file through a subsidiary, qualifying branch, representative office (where permitted for the category), or a landing partner arrangement |
| Provincial jurisdiction | ICP filing is processed through the provincial communications administration tied to the organizing entity’s registered location — not an arbitrary province you choose for convenience |
| Mainland China hosting | Purchase a Mainland China server or CDN product from your filing provider first — this is what triggers the console-based application with AWS China, Azure China, Alibaba Cloud, Tencent Cloud, and others |
| Domain | Register through an MIIT-approved registrar; complete real-name verification; keep registrant identity aligned with the organizing entity |
| Documents | Mainland China business license (or equivalent entity certificate), domain registration proof, legal representative ID, site administrator ID, and authorization letters if the applicant is not the domain registrant |
| Timeline | End-to-end ICP filing often takes roughly 3–4 weeks from a complete submission — provider pre-review is only the first segment |
| After approval | Display the ICP filing number in the website footer (and in-app where required); then complete PSB filing within 30 days of launch |
Which filing tier do I need?
- Informational site or corporate marketing, no payments on the Mainland China property → basic ICP filing only, plus PSB filing after launch.
- Payments, e-commerce, advertising sales, or online transactions on the Mainland China property → commercial ICP license after basic ICP filing — separate process and timeline.
- Mainland China hosting chosen but organizing entity unclear → resolve entity path before submitting; a structured assessment beats guessing from vendor marketing pages.
Why you need both filings
ICP filing: who is operating this service on the Mainland China internet?
Non-commercial internet information service filing is the base layer under MIIT rules.
- Purpose: traceability. The filing chain connects site or app → legal operator → physical server. If content on the network creates a compliance issue, authorities need a clear responsible party — not a foreign brand name with no Mainland China counterpart.
- Why providers enforce it: Access providers (AWS China, Azure China, Alibaba Cloud, Tencent Cloud, and others) operate under “whoever provides access is responsible.” Without an approved ICP record, Mainland China domain name system (DNS) and hosting for the domain typically cannot proceed. Engineering can be ready long before the domain legally can.
PSB filing: who is accountable for security on the public network?
PSB filing for international network connection units sits in the public security system.
- Purpose: security oversight. Your operator becomes an accountable unit on the network — with duties around security policies, technical measures (such as log retention), personal information handling, and harmful-content reporting.
- Timing: After the site or app is live on the Mainland China network, PSB filing must be completed within 30 days in standard cases. Treat that window as operational, not optional.
How they fit together: ICP filing is market access under MIIT — you establish who is operating the service. PSB filing is security registration under public security — you confirm who will answer for ongoing duties. Complete ICP filing first, obtain the filing number, then complete PSB filing. Reversing the order, or going live before either is approved, is a common source of rework.
The diagram above is simplified on purpose. Solid lines are the usual path: a foreign company works with a China landing partner, registers the target domain, applies for ICP filing and PSB filing, and connects to Mainland China hosting. Dashed lines show optional paths — a Chinese subsidiary where one exists, or consultant support — that many foreign teams add as complexity grows.
Provincial jurisdiction and hosting alignment
ICP filing is not a single national inbox with identical rules in every province. The provincial communications administration that reviews your order is tied to where the organizing entity is registered — the province on the business license, not where your engineers sit or where most users live.
That matters for foreign companies in two practical ways:
- Entity setup: A wholly foreign-owned enterprise registered in Shanghai is generally filed through Shanghai’s provincial process; changing province later can mean rethinking the organizing entity or a change filing.
- Hosting and access provider: Your cloud provider submits to the province that matches the filing record. The domain, DNS, and Mainland China hosting product must align with what the provider binds to the order.
If you use Mainland China hosting without matching entity province, domain registrant, and access provider, the order often stalls before it reaches government review — not because MIIT rejected it, but because the provider cannot forward an inconsistent package.
What the typical cloud filing flow looks like
Most teams do not file by uploading PDFs to a single government homepage. They purchase Mainland China hosting first, then start in a cloud provider’s ICP filing console, which is integrated with MIIT systems. The steps below reflect a common pattern across major Mainland China providers; timing and field names differ, but the sequence is stable.
Step 0: Before you open a filing order
Have these aligned before you click “start filing”:
- Organizing entity (filing sponsor): The legal organizer on the application — usually a Mainland China company, not the foreign parent alone.
- Domain: Registered through an MIIT-approved registrar, real-name verified, with registrant identity consistent with the filing story.
- Mainland China hosting resource: A cloud account and server or hosting product purchased from the same provider you will use for filing — this purchase is what unlocks the filing console workflow.
- Core documents: Mainland China business license (or equivalent certificate for the organizing entity), domain registration certificate, legal representative ID, site administrator ID, and authorization letters if the applicant is not the domain registrant.
- Site or App scope: Uniform resource locator (URL), mobile app package name, service description, and content category that match what you will actually operate — not a placeholder landing page you plan to replace later.
- Responsible persons: Mainland China mobile numbers and IDs for the legal representative and site administrator; they receive short message service (SMS) verification and may be contacted during review.
- Security contact: A reachable Mainland China contact for PSB filing after launch.
- Internal owner: Someone on your team who tracks document versions, resubmissions, and the 30-day PSB filing window.
Missing one item here often adds weeks — not because review is slow, but because the order sits idle while teams reconcile entity, domain, and hosting across vendors.
Step 1: Complete the ICP filing order
- Basic information — Start an order in the provider console; enter organizer and site/App details. The system checks prerequisites.
- Organizer information — Legal name, certificate type, address, and responsible persons for the organizing entity.
- Website or App details — Service name, domain, content category, and access/hosting binding.
- Documents and verification — Upload the business license, domain proof, and responsible-person ID documents. The legal representative or site administrator may need to complete facial recognition verification or an in-person photo check at a designated location, depending on provider and province rules — a common blocker when no one on the team can be physically present in Mainland China.
- Final review — Confirm every field against live scope; submit.
Step 2: Cloud provider preliminary review
Reviewers usually respond within 1–2 business days. Approval forwards the package to the provincial communications administration. Content mismatch — live site text, app screenshots, or category tags that do not match the filing form — is one of the most frequent rejection reasons.
Step 3: MIIT SMS verification
Most filing types require SMS verification through the MIIT filing system. Whether your order needs additional steps depends on current MIIT and provider rules.
Step 4: Provincial administration review
After SMS verification where applicable, the provincial administration conducts final review. Approval completes ICP filing; notice goes to the phone and email on record. Track status in the provider console. End-to-end, a complete ICP filing often takes roughly 3–4 weeks — not the 1–2 business days of provider pre-review alone. Missing documents, identity verification delays, or category mismatches extend that range.
Step 5: After ICP filing is approved
| Item | Description |
|---|---|
| Launch website or App | You may go live on approved scope. Bind your domain to the Mainland China hosting endpoint, configure DNS, and serve traffic. |
| Display ICP filing number | Websites: Show the filing number in the footer with a link to the MIIT verification page. Apps: Show the number in Settings, About, or another prominent screen. Some provinces also require a copyright line under the service description. |
| PSB network filing | Complete PSB filing within 30 days of launch through the national internet security management service platform. |
| Commercial ICP license (if applicable) | Services that process payments, run e-commerce, sell advertising, or facilitate online transactions may need a commercial ICP license after basic ICP filing — separate process, separate timeline. |
How to display ICP and PSB filing numbers
Display rules are part of compliance, not a cosmetic footer task.
ICP filing number format
Authorities issue a unique ICP filing number tied to the organizing entity and province. Numbers typically follow a pattern such as province abbreviation + ICP + filing sequence — for example, a Beijing-registered entity may receive a number beginning with the Beijing province code, followed by ICP and a numeric segment. Use the exact string issued in your approval notice; do not paraphrase or drop the province prefix.
Where to display
| Property type | Placement |
|---|---|
| Website | Footer on the homepage and other main entry pages; visible without scrolling on standard desktop layouts |
| Mobile app | Settings, About, or another screen users can reach without special access |
| Both | Link the ICP filing number to the MIIT filing verification page where province rules require it |
After PSB filing is approved, many teams display both the ICP filing number and the PSB filing number in the same footer or About area. Requirements vary by province and product type — confirm against your provider checklist at launch.
Example — Launchready.cn: The site footer shows the ICP filing number and PSB filing number side by side. Each number links to the official MIIT or public security verification page and is paired with the standard badge icon. The layout is compact enough for a global footer without crowding primary navigation.
A simplified markup pattern:
<div class="footer-filing" aria-label="Filing information">
<p>
<a href="https://beian.miit.gov.cn/" target="_blank" rel="noopener noreferrer">
<img src="/path/to/icp-badge.png" alt="">
<span>京ICP备2026030642号-1</span>
</a>
</p>
<b>|</b>
<p>
<a href="https://beian.mps.gov.cn/#/query/webSearch?code=11011502040161"
target="_blank" rel="noopener noreferrer">
<img src="/path/to/psb-badge.png" alt="">
<span>京公网安备11011502040161号</span>
</a>
</p>
</div>Replace badge image paths and filing strings with the values issued for your property. Keep both links reachable from every main entry page on the site.
Ongoing compliance after approval
ICP filing and PSB filing are not one-time events. Foreign teams that treat approval as “done” often discover compliance debt at the worst moment — during a hosting migration, entity change, or enterprise customer audit.
Changes that typically require a filing update
- Organizing entity change — merger, new subsidiary, or switching from a partner entity to your own
- Domain change — new primary domain or material change to the filed domain set
- Access provider / hosting change — moving between cloud accounts or Mainland China hosting products
- Service scope change — new payment flows, new regulated content categories, or a marketing site that becomes a logged-in product
These usually trigger a change filing or a new filing order through your access provider — not an informal DNS update alone.
Periodic verification and content duties
MIIT and access providers may require periodic verification that registered information is still accurate — contact details, responsible persons, and service description. PSB filing duties continue after the initial registration: security contacts must stay reachable, logs and policies must match what you declared, and authority requests need a Mainland China business-hours owner.
Plan an internal owner for filing record hygiene the same way you plan on-call for production incidents.
Mistakes product teams make after approval
Foreign product teams often treat filings as a launch checkbox and stop updating the record when reality changes. Three patterns show up repeatedly in enforcement actions:
A) Filing records left stale after material changes. When the company structure or hosting infrastructure changes significantly — merger, new entity, cloud account migration, or scope expansion — teams fail to submit a change filing or updated PSB registration. The record no longer matches what is live. Cloud providers and provincial administrations run periodic checks; mismatches trigger reminders, warnings, and official compliance records against the organizing entity.
B) Invalid contact details for responsible persons. The legal representative, site administrator, or security contact listed on the filing must stay reachable on a valid Mainland China mobile number. When contact information goes stale, the filing entity cannot respond to provider or government messages after an incident. Consequences escalate quickly: cloud access suspended, DNS and ports 80/443 on filed servers stop serving traffic, and mobile apps may be removed from app stores without a grace period for foreign teams operating remotely.
C) DNS pointed outside Mainland China. Serving users through filed domains while resolving DNS to servers or CDNs outside Mainland China violates the hosting alignment implied by the filing. Detection can trigger immediate cloud service interruption or app store delisting.
Whether the violation is intentional or accidental, filing non-compliance tends to produce immediate operational penalties — not a long negotiation window. If the breach amounts to providing illegal internet content or services to users in Mainland China, the organizing entity may face fines in the tens of thousands of yuan (CNY) on top of service suspension.
How foreign companies complete ICP and PSB filing
A foreign parent company cannot always appear as the Mainland China organizing entity on its own. In practice, foreign teams choose among a few models — often combining more than one over time.
| Path | When teams consider it | What it means in filing terms | Trade-offs |
|---|---|---|---|
| Chinese subsidiary | You already plan a long-term operating entity in China | Subsidiary is the organizing entity; foreign parent is off the MIIT form but may still support operations | Full local control; entity setup and ongoing compliance cost |
| Representative office or branch | Provider guidance lists a registered Mainland China office for your foreign company | The office may act as organizing entity only where category and provider rules allow — not every product type qualifies | Lower setup than a full subsidiary for some firms; narrow operating scope |
| China landing partner | You need Mainland China hosting and filings without building a full local company first | A qualified partner coordinates entity alignment, filing orders, hosting access, and PSB filing follow-through under a defined responsibility matrix | Faster start; requires clear contracts on who signs, who holds credentials, and who responds to authorities |
| Hybrid product architecture | Core product stays offshore; China users reach a China landing partner’s front door service | China-facing site, proxy, or app shell is what gets filed; scope must match the filed property exactly | Common for software as a service (SaaS); engineering and compliance scopes must stay aligned |
None of these paths removes the sequence: ICP filing, then PSB filing within 30 days of launch, on the property that actually serves users.
Foreign teams also underestimate handoffs. The foreign product owner owns the roadmap; the organizing entity owns the legal form; the cloud account owner binds hosting; the landing partner may coordinate — but only if roles are written down before the first submission. When those roles blur, resubmissions follow.
Where a landing partner fits
A China landing partner is not a workaround for filing. It is an operating model for foreign companies that need:
- a Mainland China organizing-entity path aligned with hosting choice,
- provider-console filing managed with correct scope and documents,
- domain, DNS, and hosting that match what MIIT approved,
- PSB filing tracked inside the 30-day window,
- a single coordination point between your product team and Mainland China compliance steps.
That is the role Chinaready is built for: China readiness and controlled Mainland China deployment for foreign digital products — assessment first, then filing, hosting, and route decisions tied to evidence rather than vendor defaults.
We do not treat ICP filing or PSB filing as a checkbox unrelated to product reality. We start with whether your category, content, and architecture should file on this path, then map who files, what domain and scope, and how PSB filing and display obligations are owned after approval.
If you are evaluating partners, ask the same questions of any provider:
- Who is the organizing entity on the ICP filing form, and why?
- Who holds the cloud account and domain credentials?
- Who responds to provider and government messages in Chinese business hours?
- What happens to the filing if the partnership ends?
- How many staff hold valid AWS or Azure professional certifications?
- How many staff have university degrees in computer science or a related field?
- How large is the software development team, and does it include dedicated architects and DevOps/SRE specialists?
Clear answers build more trust than a promised timeline alone.
Where foreign SaaS teams get stuck
These blockers sit outside engineering — in entity setup, documents, and sequencing.
Entity and identity
Mainland China filing expects a Chinese legal entity or an arrangement that satisfies provider and MIIT rules for the organizer field. A representative office or branch may work for some categories but is often not accepted as the organizing entity for every product type — confirm before you commit to an entity structure. Foreign certificate types, unsigned authorization letters, or a mismatch between the domain registrant and the organizing entity cause delays. Real-name verification for domain and cloud accounts must match the story on the form. Facial or in-person identity checks for the legal representative or site administrator stall projects when no Mainland China contact can complete them.
Hosting and domain alignment
The domain registrar, DNS, and hosting provider must align with the filing order. An offshore registrar, a third-party DNS, and a Mainland China cloud account can work — but only when each layer is configured for MIIT review. Teams that change hosting after approval often trigger change-of-access workflows that feel like starting over. If you are weighing global CDN versus Mainland China origin, see Cloudflare and China — it depends on your filing path.
Content and category risk
A SaaS marketing site filed as “corporate information” while the live product offers payments, user-generated content, or regulated vertical features will fail review — or create downstream liability. Pre-approval categories add months. Map product features to filing categories before submission, not after a rejection.
Operational readiness
PSB filing expects a reachable security responsible person, Chinese-language policies where required, and someone who can respond to authority requests. If your team has no Mainland China business-hours owner, PSB filing stalls at launch even when ICP filing is already approved.
Internal sequencing mistakes
Typical errors: forgetting to complete PSB filing on time after ICP filing is approved; pointing DNS to Mainland China hosting before ICP filing is approved; treating global CDN acceleration as a substitute for filing; splitting “test” and “production” domains without updating filing scope. Each creates a false sense of progress.
What happens if you skip filing
Operating without required filings is not a gray area for Mainland China-hosted properties.
Technical consequences
Hosting and CDN providers suspend or refuse service for unfilled domains. DNS may stop resolving to Mainland China endpoints. A product that “worked in testing” can go dark on launch day when the provider enforces access rules.
Regulatory and business consequences
Authorities can order takedowns and block renewal or transfer of domains and cloud resources tied to non-compliant services. The responsible business entity may be subject to monetary penalties — fines imposed on the organizing entity named in the filing chain, not only on individual managers. Enterprise customers and distributors in China increasingly ask for filing numbers during due diligence.
The “we’ll fix it later” trap
Retrofitting filing after launch means reconciling live content with approved scope, sometimes changing the organizing entity, and explaining history to reviewers. Teams routinely spend more time fixing filing debt than they would have spent filing in the correct order upfront.
Frequently asked questions
How long does China ICP filing take?
Plan roughly 3–4 weeks from a complete submission to ICP filing approval. Cloud provider pre-review often takes 1–2 business days; provincial administration review adds the bulk of the wait. Incomplete documents, failed identity verification, or content mismatches extend the range.
Do foreign companies need ICP filing?
Foreign companies need ICP filing when they host a website or mobile app on Mainland China infrastructure — not merely when they have users in China while staying entirely offshore. The foreign parent usually files through a Mainland China organizing entity or a structured partner arrangement.
What is the difference between ICP filing and a commercial ICP license?
ICP filing is the base registration for non-commercial internet information services on Mainland China hosting. A commercial ICP license is a separate authorization for services that process payments, run e-commerce, sell advertising, or facilitate online transactions. Most commercial models require ICP filing first, then the commercial license.
Is ICP filing required for mobile apps?
Yes, when the app is distributed or operated as an internet information service on Mainland China infrastructure. Since 2023, App filing enforcement has tightened for new apps and for apps already published before that wave. App filing follows related but distinct rules from website ICP filing — map both if you ship iOS, Android, and web.
What is PSB filing and when is it due?
Public Security Bureau (PSB) filing registers the operator’s network security responsibilities for the same property. Complete it within 30 days of launching on the Mainland China network after ICP filing is approved — not before ICP filing completes.
What happens if you operate without ICP filing?
Access providers typically suspend Mainland China hosting and DNS for non-compliant domains. Authorities can order takedowns, impose fines on the organizing entity, and block domain or cloud resource renewals. Enterprise buyers in China increasingly treat filing numbers as a due-diligence requirement.
Before you pick a hosting route
The decision is not simply “enter China or not.” It is which filings apply, which entity path fits, who owns each step, and how long the full sequence takes — so infrastructure choices follow compliance, not the other way around.
Quick self-check:
- We know whether our product triggers ICP filing (Mainland China hosting for a website or mobile app — not just China users offshore)
- We have identified the organizing-entity path — subsidiary, representative office or branch (if eligible), landing partner, or hybrid — and who signs government-facing forms
- We have budgeted roughly 3–4 weeks for ICP filing, then PSB filing within 30 days of launch
- We have mapped category, data, and feature triggers that add pre-approval or commercial licensing
- We have assigned an operational owner for provider messages, document resubmission, display obligations, and the security contact
If several boxes are unchecked, that is not a failure — it is the normal state before the first structured assessment. A China Readiness Assessment maps filing triggers to your actual product and recommends a route — including whether Chinaready should act as your landing partner for filing and Mainland China deployment, or whether a different scope fits better.
