Investigating Suspected Employee Fraud in a Chinese Subsidiary

A UK general counsel rings on a Friday afternoon: the finance manager in the Shanghai WFOE has been routing supplier payments through a related entity, the country head wants him out by Monday, and the group wants the money back. What looks like a straightforward dismissal in London is, in China, a layered problem involving criminal law, data protection, labour law and reputational risk — and the order in which you do things will determine whether the company recovers anything at all.

This note sets out how we approach a criminal-compliance internal investigation in a Chinese subsidiary, written for UK counsel who will be running the matter from London but relying on PRC-qualified advisers on the ground.

The criminal frame: occupational embezzlement and related offences

Most suspected employee fraud cases in a Chinese subsidiary fall under Article 271 of the PRC Criminal Law — occupational embezzlement (职务侵占罪), where an employee of a non-state company misappropriates company property using their position. Adjacent offences frequently in play include misappropriation of company funds (挪用资金, Article 272), non-state functionary bribery (Articles 163 and 164), and the contractual fraud and general fraud offences in Articles 224 and 266. Note that Amendment (XII) to the PRC Criminal Law, effective 1 March 2024, expanded the embezzlement, misappropriation and bribery offences to capture conduct involving private enterprises more broadly — which is directly relevant to wholly foreign-owned enterprises and Sino-foreign joint ventures.

The practical significance for UK counsel is twofold. First, criminal liability is personal: the company is the victim, not a co-defendant, provided the conduct is genuinely the employee's own. Second, the Public Security Bureau (PSB) has investigative powers — including the freezing of accounts and compelled production of bank records — that no private investigation can replicate. Whether and when to engage that machinery is the central strategic question.

Securing evidence lawfully: PIPL, DSL and employee privacy

The instinct of any UK investigator is to image the suspect's laptop, pull his corporate email and review his WeChat. In China, all of this is lawful only if done correctly, and unlawful evidence can both expose the company to civil and administrative liability and weaken any criminal complaint.

The framework you must respect:

• Personal Information Protection Law (2021): processing of employee personal information requires a lawful basis. "Human resources management" under a publicly issued internal policy is the usual basis, but it must be necessary and proportionate, and employees should have been informed.
• Data Security Law (2021): relevant where the company handles regulated data categories; affects how data is stored and whether it can be exported to the parent for review.
• PRC Civil Code (2021): protects privacy and personal information as civil rights; reviewing personal devices, personal email accounts or personal WeChat without consent is high risk.
• Labour Contract Law and internal rules: monitoring of corporate systems is generally defensible if the employee handbook and IT policy were lawfully adopted (consultation with employees, publication) and clearly notify staff that corporate devices and email are subject to monitoring.

Before any review begins, ask the subsidiary for: the employee handbook and IT/acceptable use policy in their current Chinese versions, evidence of their democratic adoption procedure, the employee's signed acknowledgement, and the data processing notice given on hire. If those are in order, review of corporate email, corporate devices and corporate-issued WeChat Work accounts can usually proceed. Personal devices, personal WeChat and personal email are off-limits without informed, voluntary written consent — and even then, we generally advise against touching them and instead leaving that ground for the PSB.

Forensic imaging should be performed in China by a domestic forensic provider, with a written chain-of-custody record in Chinese. If the parent intends to receive a copy of the dataset offshore, the cross-border data transfer requirements under PIPL must be assessed separately; "investigation" is not a magic exception.

Interviews: the do's and don'ts

Interviews are where most internal investigations in China go wrong. The cultural and legal expectations diverge sharply from a Kroll-style sit-down in London.

Do:

• Conduct interviews on company premises during working hours, with two interviewers and a Chinese-language note-taker.
• Give an Upjohn-equivalent warning adapted for China: explain that PRC-qualified counsel acts for the company, not the employee, and that what is said may be used in disciplinary, civil or criminal proceedings.
• Prepare a bilingual interview record and have the interviewee sign each page; this is the document a Chinese court or PSB officer will expect to see.
• Keep the questioning factual and document-led.

Do not:

• Detain, restrict movement of, or threaten the employee. False imprisonment is a criminal offence and will destroy the case.
• Promise leniency, settlement or non-referral to the police in exchange for a confession — such promises are unenforceable and corrosive to the criminal route.
• Record the interview covertly. Open recording, with consent noted on the record, is the safer practice.
• Allow HR alone to "have a quiet word" before counsel has secured the documentary evidence.

Whether and when to file a criminal complaint (刑事控告)

A criminal complaint, or xingshi konggao, is filed by the victim company with the PSB at the place where the offence occurred or where the suspect or company is located. It is materially different from a civil claim. It is a written submission setting out the facts, the legal characterisation of the offence, the suspect's identity and the supporting evidence, and it asks the PSB to open a case (立案).

We typically advise filing only when:

1. The conduct plausibly meets the criminal threshold (for occupational embezzlement, the threshold is a matter of relatively substantial amounts, interpreted by the Supreme People's Court and Supreme People's Procuratorate guidance — your PRC counsel will pitch the figure for the relevant locality);
2. The documentary evidence is already organised into a coherent bundle, with a clear money trail;
3. The company has decided it is prepared to see the matter through, including cooperating with PSB requests and potentially appearing as a victim in a public prosecution; and
4. Civil recovery alone is unlikely to retrieve the funds, typically because assets have been dissipated or the suspect is uncooperative.

Once accepted, the PSB investigates, may detain the suspect, and refers the file to the People's Procuratorate, which decides whether to prosecute. The company has no control over timing and limited control over scope. Settlement remains possible at various stages, particularly where the victim's loss has been made whole, and can influence sentencing — but it cannot be guaranteed as a condition of filing.

If the PSB refuses to open a case, the complaint can be re-filed with additional evidence, escalated to the supervising procuratorate, or the matter pursued purely civilly.

Running termination in parallel without poisoning the criminal route

Dismissal and criminal complaint are independent tracks but they interact. Under the Labour Contract Law, the employer may terminate immediately and without severance for serious breach of internal rules or where the employee is held criminally liable. In practice:

• Base the termination on the disciplinary breach found by the investigation (falsification of records, conflict of interest, breach of the code of conduct), not on the unproven assertion that the employee is a criminal.
• Issue the termination notice in Chinese, citing the specific clauses of the handbook breached and the evidence relied on, and serve it properly.
• Do not rely solely on a confession extracted during the interview; ensure the disciplinary case stands on documentary evidence.
• Pay all statutory entitlements that are not lawfully withheld; wrongful withholding to "fund" recovery will produce a labour arbitration claim and tactically weaken the criminal complaint.
• Coordinate timing with PRC counsel: in some matters it is preferable to file the criminal complaint first (or simultaneously) so that the dismissal is not later cast as retaliation.

Expect a labour arbitration challenge in around half of contested dismissals. A well-evidenced investigation file is the company's best defence.

FAQ

Can we review the suspect's corporate WeChat and email from London? You can usually review corporate email and WeChat Work if the employee handbook and IT policy were properly adopted and notified. Exporting the data to the UK for review is a separate cross-border transfer question under PIPL and should be assessed before any data leaves China.

How long does a criminal complaint take from filing to charging decision? There is no fixed timetable. Acceptance of the case can take weeks; investigation and procuratorial review commonly run six to twelve months or longer for financial crime. UK clients should not plan around a fixed end-date.

Will filing a criminal complaint help us recover the money? Often yes, indirectly. The PSB can freeze accounts and the prospect of detention frequently produces restitution. But the criminal court does not award civil damages of right in every case, and a parallel civil claim or an incidental civil action is usually advisable.

Can we settle with the employee and withdraw the complaint? Once the PSB has opened the case, the company cannot unilaterally withdraw it; the offence is a public one. Restitution and the victim's attitude do influence prosecutorial and sentencing outcomes, and settlement is common, but it is not a switch the company controls.

How Eugen Law Firm assists

Eugen Law Firm acts as China counsel to UK firms running cross-border internal investigations into suspected fraud and embezzlement inside Chinese subsidiaries. We design and execute the investigation on the ground — evidence preservation under PIPL, bilingual interviews, criminal complaint drafting and PSB liaison — while coordinating with the UK lead on dismissal, civil recovery and group reporting.

To discuss a live or suspected matter on a confidential basis, please contact [email protected].