# China

> ICP filing applies to mini programs, the provincial timeline sits on your critical path, and what remains unresolved.

Source: https://miniapp.sollar.com/compliance/china/

---

If Sollar operates a mini app store in mainland China, a second and entirely separate regulatory
perimeter applies. This page describes what is known and marks what is not.

## ICP filing covers mini programs

Since **September 2023**, the MIIT's ICP filing requirement (备案) applies to mobile applications and
mini programs, not only to websites. Tencent enforces it inside its own developer portal for WeChat
mini programs, and any comparable platform operating in the mainland faces the same requirement.

**Each mini app needs its own filing.** It is not covered by the host's.

### Reported timeline

| Stage | Reported duration |
|---|---|
| Platform review | 1–2 days |
| SMS verification | 24 hours |
| Provincial telecommunications bureau | **1–20 days** |

The provincial bureau's step is the one that matters for planning. It sits on the developer's
critical path, it is outside anyone's control, and its range is wide enough that a release date
cannot be committed until it clears.

Plan filing as a precondition of the project, not a step before launch.

## What a filing requires

A registered mainland business entity, a responsible person with a mainland identity document, a
domain filed to that entity, and hosting inside the mainland. A foreign company without a mainland
entity cannot file, which makes the entity question a prerequisite rather than a detail.

## Content and data obligations

Beyond filing, mainland operation brings obligations that are not documentation footnotes:

- **PIPL** — the Personal Information Protection Law governs collection, consent, and cross-border
  transfer of personal information. Moving personal data out of the mainland has its own approval
  regime.
- **Data localisation** for several categories.
- **Real-name verification** requirements for certain service categories.
- **Content review** obligations that fall on the platform operator, meaning Sollar, for everything
  its mini apps publish.

Sensitive categories — health, finance, education, news, mapping — each carry their own licensing.

## Open, and material

> **CAUTION**
**Keycloak inside mainland China is unconfirmed.** Sollar's identity layer depends on Keycloak, and
whether it can operate compliantly inside the mainland, under PIPL and behind the national firewall,
has not been established. This is an inherited infrastructure risk, and it is not small: if it does
not hold, the identity architecture in the mainland is a different design, not a configuration
change.

Also open:

- Whether Sollar would operate the mainland store itself or through a licensed local partner. The
  answer changes who holds the filing, who carries the content-review obligation, and who is liable.
- How the mainland catalogue relates to the international one. Two catalogues, two review queues and
  two sets of accepted categories is the likely answer, and it doubles the operational surface.
- Whether cross-border identity — an employee of a multinational using the same Sollar account in
  Shanghai and in Frankfurt — is achievable under PIPL's transfer rules.

## What this means today

Nothing in Sollar's mini app specification assumes mainland operation, and nothing in it prevents
mainland operation. The package format, the manifest, the bridge and the review model are
jurisdiction-neutral.

What is **not** jurisdiction-neutral is the identity layer, the hosting, and the store operation.
Those are open questions with commercial and legal answers, not technical ones, and they are
recorded here as open rather than resolved by assumption.

## If you are building for a mainland tenant

Practical advice, given the above:

1. **Start the filing before you start the code.** The provincial step will not compress.
2. **Assume data localisation.** Design your backend so the mainland deployment is a separate
   instance with its own data, not a region flag on a global one.
3. **Do not design around cross-border identity** until the transfer question is answered.
4. **Expect a separate review queue** with different accepted categories.