Does Sumsub Work in China? KYC Biometric & ID Data Residency, PIPL Cross-Border & ICP

For a fintech, exchange, marketplace or bank standing up customer onboarding for mainland China, the first instinct with Sumsub is to ask whether its verification flow will load from inside the country. It generally will — Sumsub’s KYC endpoints are not what China blocks at the border, so reachability is not where the China decision is settled. What settles it is data residency and the cross-border transfer of sensitive personal information: where the government-ID images, facial biometrics, liveness video and AML screening results Sumsub captures about your users come to rest, and whether you had a lawful basis to move that data out of China at all. Those are questions of China’s law, and they sit upstream of latency. Sumsub answers the residency half in its own documentation.

Sumsub runs no verification cloud inside mainland China. By its own docs its hosting defaults to Germany, and the data-residency regions it lets you choose are all offshore — so the moment an ID scan, a selfie-biometric or a liveness recording collected from a person in China lands in one of them, you have made a cross-border transfer (数据出境) of sensitive personal information, and a stricter body of law decides whether that was allowed.

Sumsub in China at a glance

Availability: reachable — but where does the identity data live?

Sumsub’s position is set in its own documentation, not by a load-time test. Its Local Data Processing page states that Sumsub “lets you determine the physical location where data is stored and processed,” that “Applicant data, images, videos, and other binary files will be stored locally in a particular region,” and — under the heading “Supported regions” — that “For the v2 processing level, we currently support the following regions:” namely the USA, UAE and Singapore. Its processor documentation is just as plain about the default: AWS hosting is “Germany – by default, other countries and regions – by request and if available.” Not one of those is inside the mainland.

So “can the onboarding screen reach Sumsub from Shanghai?” is the wrong test. It reaches. The real question is where your China-collected ID and biometric data sits, and whether it was allowed to leave the country at all — which is why this page publishes no first-party China latency or reachability figure for Sumsub: speed is not the axis for a decision that turns on residency and consent. One operational note worth naming: cross-border verification calls from the mainland to an offshore service can be inconsistent, and the temptation is to force them through a network workaround. 21YunBox neither uses nor suggests any such circumvention — it is both a compliance risk and beside the point. The productive question is how to keep the China verification data on a lawful footing.

The data-residency question: an offshore verification store is a cross-border transfer of sensitive PI

Here is the gate most onboarding teams miss. Applicant data hosted in any of Sumsub’s regions is, by definition, outside the mainland. The ID-document images, facial biometrics, liveness recordings and AML results it holds for your users in China are personal information, and loading them into an offshore region is a cross-border transfer of personal information under China’s Personal Information Protection Law. PIPL puts the duty on the handler — you, the organization operating the onboarding flow, not Sumsub the processor: Articles 38–40 require notice, a separate consent distinct from any general agreement to use your service, and one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification.

Two things sharpen this for a KYC platform specifically. First, most of what it captures is sensitive personal information, so the transfer consent must be specific to the overseas transfer and sit on top of the separate consent that sensitive processing already requires. Second, above certain thresholds, or where the data qualifies as “important data,” the transfer may require China’s data-export security assessment (数据出境安全评估) before anything leaves. And if your organization is a critical information infrastructure operator, the Cybersecurity Law’s Article 39 (formerly Article 37 — the data-localization clause was renumbered by the 2025 amendment that took effect on January 1, 2026, with its substance unchanged) requires that personal information generated in China be stored in China, an in-country storage duty an AWS region in Germany, the USA, the UAE or Singapore simply cannot satisfy. None of this turns on how quickly a check clears; it turns on whether the data had a lawful basis to be there. Which of these bite your specific deployment is a risk to confirm with counsel against what your verification flow actually collects.

ID documents, face biometrics and AML results are sensitive personal information — consent and a DPIA sit on top

Residency is only half of it. A KYC platform works by collecting the most identifying attributes a person has — a government-ID document, a photograph of their face matched to it, a liveness recording to prove they are real, and a trail of screening hits against watchlists. Under PIPL, a face biometric and a government-identity document are sensitive personal information, which carries a stricter standard than ordinary PI: a specific purpose and demonstrated necessity, a separate, specific consent before collection, and a personal-information protection impact assessment (PIPIA, Articles 55–56) completed in advance. The cross-border transfer to an offshore region then needs a further consent on top of all of that. Sumsub gives you controls that can help — regional data residency, retention settings, and the ability to minimize what each environment holds — but those reduce exposure; they do not discharge the consent, notice and impact-assessment duties, which rest with you as the handler. Whether a given attribute counts as sensitive, and exactly what your consent flow and PIPIA must cover, are questions to settle with counsel.

No mainland region to file against — and why “pick another region” isn’t the fix

A China-facing onboarding page, verification screen or customer portal actually served to mainland visitors from inside China turns on an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33, and that filing has to attach to a hosting resource physically in the mainland. Sumsub provides none, so there is nothing on Sumsub to file against — the same structural gap the residency duty exposes, seen from the licensing side.

The obvious move is to switch the Local Data Processing region to one nearer China and call it in-country — but the regions Sumsub offers are the USA, UAE and Singapore, with Germany as the default, and none is in the mainland. Moving applicant data from, say, Singapore to the UAE merely relocates the cross-border transfer; it does not end it. Sumsub’s own docs note it is “working to expand support to include non-AWS data centers such as Huawei Cloud and AliCloud” — but that is a stated future plan, not a mainland-China residency option you can turn on today, and even an in-country region would resolve only the storage half: the separate consent, the impact assessment and the ICP filing would still sit with you. Keeping China-collected verification data in-country means standing up a consented, China-resident route for the identity checks your China entity runs — in-country processing and storage for the ID, biometric and AML records — while you keep Sumsub for the markets it already serves. That split — what must stay, what may go — is the heart of the work, and it is a legal question before it is a technical one.

This is a risk map, not a verdict: whether you owe separate consent, a transfer mechanism, a data-export assessment, an impact assessment, in-country storage, an ICP filing, or some combination depends on your entity, the identity data you hold, your role as handler, and who your users are — worth settling with counsel before you rely on it.

The lawful path — map, localize, deliver

There is a lawful way to run identity verification for a China-facing presence, and it has a shape. First, map: our China team works through your PIPL exposure on both fronts — the sensitive-PI processing and the transfer — identifying which verification records collected in China (ID images, face biometrics, liveness, AML results) must stay in the country, what may lawfully leave, where a data-export security assessment or an Article 39 storage duty bites, and what your consent flow and impact assessment have to cover. The legal conclusions are settled with counsel; we build the technical picture that feeds them.

Then localize: we stand up and integrate a consented, China-resident footing for the China verification data — in-country processing and storage on a China-legal identity-verification route for the China entity — so onboarding keeps working while those sensitive records stop leaving the country by default, and you keep Sumsub for the markets where it already serves you.

Then deliver: the China-facing onboarding flow, portal or app your users actually reach is itself a public service in the mainland, so it carries an ICP filing (备案) duty and needs compliant, in-country delivery. 21YunBox delivers it in-country — the 21YunBox Optimizer — set in front of what you already run, with no rebuild and no re-platform. The result is customer onboarding that runs legally and compliantly for your users in China. What we never do — and what no one lawfully can — is hand you a route around China’s data-export rules or around any network restriction: we localize what must stay and deliver in-country, and we never move personal information out of China by stealth.

Get a compliance assessment →

Related reading:

• Cross-border data transfers under PIPL
• China’s data-export security assessment
• China’s Cybersecurity Law (data localization, Article 39)
• How to get an ICP filing for China

RELATED TECHNOLOGIES

Jumio

Jumio

Onfido

Onfido

Persona

Persona

Plaid

Plaid

Stripe Identity

Stripe Identity

Veriff

Veriff