Does Onfido Work in China? Identity-Verification Data Residency, PIPL Sensitive PI & ICP

For a company onboarding customers or verifying users in mainland China, the first instinct with Onfido is to ask whether its identity checks will run from inside the country. They generally will — Onfido’s verification is an API and SDK embedded in your own onboarding flow, not a consumer destination that China blocks at the border. So reachability is not where the China decision is settled. What settles it is the nature of the data Onfido collects to do its job, and where that data comes to rest. A passport or ID-card image and a live selfie or liveness scan are about as sensitive as personal information gets under China’s law, and Onfido keeps them in regions outside the mainland. That is a sensitive-personal-information, cross-border and data-residency question — and it sits upstream of latency. Onfido answers the residency half in its own documentation.

Onfido — now part of Entrust, which completed its acquisition in 2024 — runs no identity-verification cloud inside mainland China. Its own API documentation offers three region-specific environments, EU, US and Canada, and names no mainland-China site to choose. The moment a government-ID image, a facial biometric or a verification result collected from a person in China lands in one of those regions, you have made a cross-border transfer (数据出境) of personal information — and because that data is sensitive, a stricter branch of China’s law decides whether you were allowed to move it at all.

Onfido in China at a glance

Availability: reachable — but where does the identity data come to rest?

Onfido’s position is set in its own documentation, not by a load-time test. Its API documentation lists three “region-specific environments: EU, US, and Canada,” each with its own base URL and token, notes that “there is no default region” so you must pick one, and states that “for the EU region, data is physically stored in the Republic of Ireland, with backup storage in Germany.” Not one of the three is inside the mainland. So “can the onboarding SDK reach Onfido from Shenzhen?” is the wrong test. It reaches. The real question is where the ID images and face scans you collect in China come to rest, and whether they were allowed to leave the country at all — which is why this page publishes no first-party China latency figure for Onfido: speed is not the axis for a decision that turns on sensitive-data residency and consent.

One operational note worth naming: cross-border verification calls from the mainland to an offshore endpoint can be inconsistent, and the temptation is to force them through a network workaround. 21YunBox neither uses nor suggests any such circumvention — it is both a compliance risk and beside the point. The productive question is how to keep the China identity data on a lawful footing in the first place.

The data-residency question: an offshore KYC store is a cross-border transfer

Here is the gate most teams miss. A region in the EU, the US or Canada is, by definition, outside the mainland. The government-ID images, facial biometrics, extracted identity fields and verification results Onfido holds for your users in China are personal information, and loading them into an offshore region is a cross-border transfer of personal information under China’s Personal Information Protection Law. PIPL puts the duty on the handler — you, the organization running the onboarding, not Onfido the processor: Articles 38–40 require notice, a separate consent distinct from any general agreement to use your service, and one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification.

Above certain thresholds, or where the data qualifies as “important data,” that transfer may also require China’s data-export security assessment (数据出境安全评估) before anything leaves — and because ID and biometric data is sensitive, those thresholds are reached sooner. And if your organization is a critical information infrastructure operator, the Cybersecurity Law’s Article 39 (formerly Article 37 — the data-localization provision was renumbered by the 2025 amendment that took effect on January 1, 2026, with its substance unchanged) requires personal information generated in China to be stored in China — an in-country storage duty an offshore region in Ireland, Virginia or Montreal simply cannot satisfy. None of this turns on how quickly a check completes; it turns on whether the data had a lawful basis to be there. Which of these bite your specific deployment is a risk to confirm with counsel against what your verification flow actually collects.

ID documents and face scans are sensitive personal information — consent sits on top

Residency is only half of it, and for identity verification the other half is sharper than for most tools. Onfido works by capturing exactly the categories China’s law treats as most sensitive: an image of a government identity document, and a facial biometric from a selfie or liveness check. Under PIPL, biometric characteristics and data revealing a specific identity are sensitive personal information (Article 28), and processing them carries a stricter standard than ordinary data — a separate, specific consent and a demonstrated necessity, with a clear notice of the purpose and the impact before collection begins (Articles 29–30). The cross-border transfer to an offshore region then needs a further separate consent stacked on top of that.

Onfido gives you controls that can help — regional residency selection, deletion and retention tooling, and the ability to minimize what each environment holds — but those reduce exposure; they do not discharge the sensitive-PI consent, necessity and notice duties, which rest with you as the handler. Whether your necessity case holds, and exactly what your consent flow must say before a user uploads a document, are questions to settle with counsel.

No mainland region to file against — and why switching regions isn’t the fix

A China-facing sign-up screen, onboarding journey or verification page actually served to mainland visitors from inside China turns on an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33, and that filing has to attach to a hosting resource physically in the mainland. Onfido provides none, so there is nothing on Onfido to file against — the same structural gap the residency duty exposes, seen from the licensing side.

The obvious move is to switch the Onfido region to the one nearest China and call it in-country — but the three on offer are EU, US and Canada, and none is in the mainland, so moving from, say, the US region to the Canada region merely relocates the cross-border transfer; it does not end it. Keeping China-collected ID and biometric data in-country means standing up a China-resident home for the verification itself, so the sensitive data is captured, processed and stored in the country rather than sent abroad — while Onfido keeps serving the markets where it already works for you. That split — what must stay, what may go — is the heart of the work, and it is a legal question before it is a technical one.

This is a risk map, not a verdict: whether you owe a separate sensitive-PI consent, a further consent for the transfer, a data-export assessment, in-country storage, an ICP filing, or some combination depends on your entity, the identity data you collect, your role as handler, and who your users are — worth settling with counsel before you rely on it.

The lawful path — map, localize, deliver

There is a lawful way to verify identities for a China-facing presence, and it has a shape. First, map: our China team works through your PIPL exposure on both fronts — the sensitive-data processing and the cross-border transfer — identifying which identity records collected in China (ID images, facial biometrics, extracted fields, verification results) must stay in the country, what may lawfully leave, where a data-export assessment or an Article 39 storage duty bites, and what your consent and necessity notice has to cover before a user ever uploads a document. The legal conclusions are settled with counsel; we build the technical picture that feeds them.

Then localize: we stand up and integrate a consented, in-country identity-verification route for your China users — one that captures, processes and stores the ID and biometric data inside the mainland — so onboarding keeps working while that sensitive data stops leaving the country by default, and you keep Onfido for the markets where it already serves you.

Then deliver: the China-facing onboarding or sign-up surface your users actually reach is itself a public service in the mainland, so it carries an ICP filing (备案) duty and needs compliant, in-country delivery. 21YunBox delivers it in-country — the 21YunBox Optimizer — set in front of what you already run, with no rebuild and no re-platform. The result is identity verification that runs legally and compliantly for your users in China. What we never do — and what no one lawfully can — is hand you a route around China’s data-export rules or around any network restriction: we localize what must stay and deliver in-country, and we never move personal information out of China by stealth.

Get a compliance assessment →

Related reading:

• Cross-border data transfers under PIPL
• China’s data-export security assessment
• China’s Cybersecurity Law (data localization, Article 39)
• How to get an ICP filing for China

RELATED TECHNOLOGIES

Jumio

Jumio

Persona

Persona

Plaid

Plaid

Stripe Identity

Stripe Identity

Sumsub

Sumsub

Veriff

Veriff