Does Ramp Work in China? Data Residency, ICP & Cross-Border Rules

For a corporate-card and spend-management platform sitting behind a China entity, the first question about Ramp is not whether its dashboard opens quickly from Shanghai. It does — delivery is not where this is decided. Ramp is the system of record for how a company spends: the card numbers and every swipe tied to them, cardholder identities and the employees behind each card, reimbursement bank details, and — through its bill-pay and accounting side — vendor master data, bank-account numbers and tax identity. Almost all of it is personal information, and the card and financial-account numbers are sensitive personal information under Chinese law. Ramp runs that data on cloud infrastructure in the United States, with no mainland-China region and no self-hosted option, and its cards are issued by US banks. So the real axis is two doors: where those records are allowed to come to rest, and the fact that issuing cards and moving money inside China is itself a licensed activity. Neither is measured in milliseconds.

Ramp in China at a glance

No mainland region, so the card and vendor records leave the country

Start with where the data rests, because that is where the decision actually turns. Ramp’s Trust Center names its infrastructure provider as “Amazon Web Services” and lists each of its subprocessors as located in the “United States.” None of them sits in mainland China, and Ramp publishes no self-hosted or sovereign-region option — it is a cloud-only service it operates itself. That is not a criticism of Ramp’s security posture; it holds SOC attestations and encrypts data at rest and in transit. It is simply the fact that matters for China: the records come to rest abroad.

So the moment your China entity issues a card to a mainland employee or onboards a mainland vendor, and Ramp ingests that person’s card number, identity, bank account or tax ID, personal information about someone in China has moved to infrastructure outside the country. Under China’s Personal Information Protection Law that is a cross-border transfer, and PIPL puts the duty on the handler — you, alongside the platform. Articles 38–40 require notice, a separate consent distinct from any employment or vendor agreement, and one lawful transfer mechanism: a CAC security assessment, the CAC standard contract, or certification. Above the state thresholds, or where the data set counts as “important data,” that export can also require China’s data-export security assessment before anything leaves. And a residency duty can sit on top: for a critical information infrastructure operator or a high-volume handler, personal information collected in China must be stored in China (PIPL Article 40). The same logic runs through the Cybersecurity Law, whose in-country storage duty now sits at Article 39 (formerly Article 37 — renumbered by the 2025 Cybersecurity Law amendment, in force January 1, 2026, with its substance unchanged). A US cloud store cannot meet an in-country storage duty.

Card numbers, bank details and cardholder identities are sensitive personal information

It is worth being precise about what Ramp holds, because it is exactly the category Chinese law treats most carefully. A corporate-card platform’s reason for existing is to hold the card numbers, the swipe-by-swipe transaction trail, and the identities of the people and vendors on both sides of each payment — cardholder names and employee records, reimbursement bank accounts, and, on the bill-pay side, vendor bank-account numbers and tax identity. Taken together that is a detailed financial profile of real people and the entities they represent.

Under PIPL Article 28, sensitive personal information is information that, if leaked or misused, could readily harm a person’s dignity or safety — and it names financial accounts specifically. Card numbers, bank-account and routing details, and the identity records behind them are squarely within it. Processing sensitive personal information requires a specific purpose, strict necessity, and — for the cross-border leg — the separate consent and transfer mechanism above, at a higher bar than for ordinary data. The practical upshot: the single most useful thing a spend platform does, hold the exact details needed to pay and reconcile, is also the thing that makes its China-facing use a sensitive-data question rather than a convenience one.

The second door: issuing cards and paying into China is a licensed activity

Residency is only the first door. Because Ramp issues cards and moves money, a second door applies on top. Ramp’s own disclaimers are explicit that its cards are issued by US banks — “The Ramp Visa Commercial Card is issued by Sutton Bank, Member FDIC,” the Corporate Card “issued in the U.S. by Celtic Bank,” the Business Card by “Lead Bank, Member FDIC” — with its newer non-US programs issued by partners in the UK, the EEA and Canada. None of those issuers is in mainland China. Issuing cards, acquiring and settling for domestic mainland transactions is a licensed activity under the Regulations on the Supervision and Administration of Non-Bank Payment Institutions (State Council Order No. 768, in force May 1, 2024): providing payment services for domestic transactions requires an onshore licensed path, and transaction processing, settlement and data storage for domestic transactions must be completed within China. A US-bank-issued card program is not a China payment license, and a foreign provider does not run domestic mainland card issuance or payment from offshore on its own account.

That is a door we help you map, not one we walk through. 21YunBox is not a licensed payment institution and holds no China payment license, so the license and the rails sit with a licensed onshore provider and your counsel. What we add on this leg is advisory: helping you see where your particular flow — which entity spends, whether any part of it amounts to providing domestic payment or card services to mainland users, which rails and partners it touches — sits against Order No. 768, so you know exactly what counsel and a licensed partner need to confirm. None of this means Ramp is “blocked” in China; it means the card-and-payment leg has its own compliance surface, separate from residency.

Narrowing what crosses doesn’t close the door

The reasonable instinct is to reduce the exposure inside the tool — limit which legal entities issue Ramp cards, restrict which mainland vendors are onboarded, or keep some records in a self-managed system. Those levers are worth pulling: they shrink what personal information crosses the border and can lower the volume that triggers the heavier thresholds. But they change the magnitude, not the nature. As long as a mainland cardholder’s card details or a mainland vendor’s bank account are stored or processed in the United States, a cross-border transfer is still happening and the residency question is still open; trimming the payload does not convert a US store into an in-country one, and it does not file the China-facing surface. Reachability is likewise beside the point — a dashboard that opens instantly can still rest the records in the wrong place and still leave the card-and-payment leg unlicensed.

Which of these actually bite your operation turns on your entity, your data volumes, your role under Chinese law, and who your cardholders and payees are — and this page is a map of that exposure, not a ruling on it. Treat each door as a risk to settle with qualified counsel against what you truly collect, store and pay, before your China flow depends on it.

The lawful path — map, localize, deliver

There is a lawful shape for running Ramp behind a China operation, and it does not rip Ramp out. First, map. Our China compliance team reads your PIPL, data-residency and payment-license obligations against your actual setup — which mainland cardholder, employee and vendor records you collect, your data volumes, whether your systems or role bring you within the critical-information-infrastructure or high-volume thresholds, and what your notice-and-separate-consent flow must cover. The legal conclusions are settled with your counsel; we build the technical and architectural picture that feeds that decision.

Then localize. Where the China leg must stay in-country, we keep the China-resident cardholder and vendor records — the card, identity, bank and tax details tied to mainland people — on a consented, in-country footing, stored and processed inside the mainland where the law requires it, while Ramp keeps doing what it does for the rest of your spend. The point is not to replace your card platform but to put the China-resident records where they belong.

Then deliver. Any China-facing surface the flow needs — a cardholder onboarding portal, a vendor intake form, a status page your mainland users load — is a public mainland internet service, so it needs an ICP filing and compliant in-country delivery. 21YunBox delivers it in-country — the 21YunBox Optimizer — in front of the stack you already run, with no rebuild and no re-platform. Two boundaries, stated plainly: on the payment-license leg our role is advisory — 21YunBox is not a licensed payment institution, so the license and the card-and-payment rails sit with a licensed onshore provider and your counsel, not with us; and on everything else we are a compliant overlay and a partner to Ramp, not a competitor. What we never do — what no one lawfully can — is route you around China’s data-export rules or any network restriction: we map the path, localize the records that must stay, and deliver the surface in-country. 21YunBox never uses or suggests circumvention of any kind. The result is a China-facing operation that runs legally and compliantly for your users in China.

Get a compliance assessment →

Related reading:

• China’s Regulations on the Supervision and Administration of Non-Bank Payment Institutions (Order No. 768)
• Cross-border data transfers under PIPL
• China’s data-export security assessment measures
• China’s Cybersecurity Law — data localization (Article 39, formerly Article 37)
• How to get an ICP filing for China

RELATED TECHNOLOGIES

Anaplan

Anaplan

BILL

BILL

BlackLine

BlackLine

Expensify

Expensify

OneStream

OneStream

Oracle EPM Cloud

Oracle EPM Cloud

Tipalti

Tipalti

Workiva

Workiva