MAALAT · PROBLEM BRIEF #04

China B2B Structural Risk

The four choke points every foreign operator must score before engaging
China in 2026

+-----------------------------------------------------------------------+

+-----------------------------------------------------------------------+

Published by MAALAT Research Systems · July 25, 2026 · maalat.co

1. The recurring problem

A foreign operator has China exposure. It might be a factory, a
distributor, a JV, a licensing partner, or a customer that pays in RMB.
The exposure worked for years. In 2026 it stops working the way it used
to.

Not because of one event. Because of four separate structural shifts,
each moving in the same direction, each capable of stopping the
engagement on its own. An export-control designation lands on a
supplier. A data-transfer route the finance team relied on for HR
reporting suddenly needs a nine-month regulator review. A JV partner
installs a chief legal representative who no longer answers HQ calls. A
correspondent bank stops clearing the payment.

Each shift has a name and a live enforcement case. Together they
describe a new operating environment: the rules for engaging China have
hardened faster than most foreign operators have updated their risk
registers, and the pauses that give current comfort mostly expire in
November 2026.

THE MEASURABLE STATE, JULY 2026

• US inbound duty exposure on China goods varies by HTS classification
  and can combine MFN duty, Section 301, Section 232 derivatives at
  10--50%, and product-specific bans (100% on cranes and chassis) as of
  24 July 2026 ([[Honigman tariff
  alert]{.underline}](https://www.honigman.com/alert-3462)). Operators
  must calculate the applicable stack at SKU level. Both the US
  affiliates-rule suspension and China's critical-minerals suspensions
  expire in November 2026.

• CAC penalties for cross-border data violations include a **RMB 10
  million** fine on Ctrip in June 2026 for failing to complete the
  required data-export security assessment --- characterised by counsel
  as a signal that the education phase is over ([[DLA
  Piper]{.underline}](https://privacymatters.dlapiper.com/2026/06/china-chinas-data-regulator-means-business-the-education-phase-is-over/),
  [[Bird &
  Bird]{.underline}](https://www.twobirds.com/en/insights/2026/china/cac-imposes-hefty-fine-for-data-export-violations)).
  CSL penalty ceilings are 20x higher from 1 January 2026 ([[Arnold &
  Porter]{.underline}](https://www.arnoldporter.com/en/perspectives/advisories/2026/02/china-data-privacy-and-cybersecurity-2025-year-in-review)).

• Nexperia China publicly instructed staff to disregard Dutch HQ
  instructions in October 2025, and the Amsterdam court order remains
  unresolved
  ([Morningstar]{.underline}).
  A new ODI security review covering asset disposals took effect on **1
  July 2026** ([[Morrison
  Foerster]{.underline}](https://www.mofo.com/resources/insights/260604-china-s-odi-rules-just-changed)).

• The EU 21st sanctions package, adopted 23 July 2026 --- two days
  before this brief's as-of date --- added 14 Chinese/HK entities and
  triggered Chinese retaliation within 24 hours
  ([Reuters]{.underline}).

These are not four independent risk trends. They are one integrated
pattern: the legal ceiling of exposure is rising sharply, while tactical
pauses give a floor that is lower than the trend. Foreign operators who
read only the pauses will misprice their exposure. This brief scores
against the ceiling.

2. What "structural risk" means in this brief

Structural risk is not the same as country risk, political risk, or
market risk. It is a different thing, and it needs its own definition.

Country risk is the probability the country deteriorates in ways that
hurt any operator (macro instability, currency collapse, war). Political
risk is the probability a specific policy change hurts a specific
operator (expropriation, licence revocation). Market risk is the
probability the sector shrinks or a competitor wins.

Structural risk, in the MAALAT sense, is different. It is the
probability that the plumbing an operator relies on to do business ---
the licences, the data pipes, the corporate structure, the payment rails
--- stops functioning as advertised, not because of a discretionary
policy move, but because the underlying legal architecture has changed
and the operator did not track the change.

Structural risk is what makes an engagement that worked in 2022
unworkable in 2026 even though nothing about the specific counterparty,
product, or market changed. The operator is running on old assumptions
about how the system works.

THE FOUR CHOKE POINTS

MAALAT groups foreign B2B structural risk in China into four choke
points. Each one, by itself, is enough to stop the engagement. The four
in combination compound. A foreign operator who has not scored all four
is scoring incompletely.

• Choke Point 1 --- Export controls. The right to move goods,
  components, and technology into and out of China across the US, EU,
  Japan, Korea, and China's own control regimes.

• Choke Point 2 --- Data and personnel. The right to move data,
  financial reports, and executives across the China border.

• Choke Point 3 --- Structure. The right to own, control, and exit a
  China business through the corporate structure originally chosen.

• Choke Point 4 --- Payment rails. The right to receive payment from
  China customers and remit funds out of China at the times and prices
  the operating model assumed.

The remainder of this brief scores each choke point individually and
then aggregates the four into a single China Structural Risk Score.

3. The method, in one page

The MAALAT China Structural Risk Score (CSRS) is a two-layer rubric.
Each of the four choke points is scored 0.0--5.0 based on its own
weighted dimensions. The four composites are then weighted-averaged into
a single CSRS on the same 0.0--5.0 scale, which maps to one of five
bands. Three override triggers can floor the CSRS at 4.5 regardless of
composite.

Choke-point weights

-------- ----------------------------- ------------ ---------------------------
# CHOKE POINT WEIGHT WHY THIS WEIGHT

1 Export controls 30% Highest legal-ceiling
exposure. Both US and China
suspensions expire Nov
2026.

2 Data and personnel 25% Broadest impact. Catches
every operator regardless
of sector.

3 Structure 25% Nexperia precedent + 1 Jul
2026 Chinese-outbound
security review make this a
live failure mode.

4 Payment rails 20% Workarounds still exist but
narrowing after EU 21st
package.
-------- ----------------------------- ------------ ---------------------------

Bands

-------------- ----------------- ---------------------------------------
BAND COMPOSITE OPERATOR READING**
RANGE**

Low 0.0 -- 0.9 Engagement operates on stable ground.
Reassess annually.

Moderate 1.0 -- 1.9 Named exposures exist but do not
threaten viability. Track quarterly.

Elevated 2.0 -- 2.9 Structural mitigations required. Do not
add exposure. Rescore semi-annually.

High 3.0 -- 3.9 Active de-risking programme mandatory.
New investment decisions on hold.

Severe 4.0 -- 5.0 Structural exit decision on the table.
Contain and unwind, not optimise.
-------------- ----------------- ---------------------------------------

Scoring perimeter

Two analysts scoring the same operator will produce different CSRS
results if the perimeter is undefined. The canonical CSRS perimeter is:

• The operator's own entity, plus any entity in which the operator
  holds ≥50% equity or exercises equivalent control (voting rights,
  board majority, contractual control).

• Direct counterparties inside China above a materiality threshold the
  operator sets in writing (typical thresholds: >10% of China revenue,
  >10% of China COGS, single-source for a critical input, or any
  counterparty in a regulated sector).

• Tier-two counterparties only where a documented single-source
  dependency exists (one supplier, one bank, one logistics provider).

• Personnel with China nexus: any executive who has signed on behalf of
  the entity, holds legal-representative status, has China residency, or
  holds Chinese nationality, plus any employee travelling to China on
  operator business.

The perimeter itself must be documented in the scoring worksheet. A CSRS
produced with an ambiguous perimeter is not defensible.

Rules of the rubric

• Each dimension is scored 0.0--5.0 by the operator using the anchor
  scale in the appendix. 0 = negligible exposure; 5 = disqualifying
  exposure.

• Composite of each choke point is a weighted average across its
  dimensions. Half-up rounding to one decimal on the composite;
  intermediate calculations remain full precision.

• The canonical CSRS uses the 30/25/25/20 choke-point weights above.
  Operators may run an internal "operator-adjusted CSRS" using
  different weights that reflect their profile, but only the 30/25/25/20
  result is the CSRS. Both may be reported side by side; the label must
  be distinct.

• Override triggers (Section 10) can floor the CSRS at 4.5
  (prohibition-tier) or 3.5 (licence-tier) regardless of the weighted
  composite. When multiple triggers fire, the highest floor applies.

• Every score must cite the evidence supporting it. Dimensions scored
  without cited evidence are tagged Indicative; more than three
  Indicative dimensions in the same choke point invalidates the
  composite for that point.

• N/A treatment: dimensions that structurally do not apply to the
  operator (for example, dimension 6 of CP2 for an operator with no
  offshore-migration history) are marked N/A and excluded. The remaining
  dimension weights within that choke point are renormalised to sum to
  100%.

4. Five-minute read --- state of the four choke points

For the reader with five minutes and no time for the full rubric: this
is the one-line state of each choke point as of July 25, 2026. Every
line here is expanded in Sections 5--8 with sources.

CP1 --- Export controls (30% weight)

• BIS-assessed administrative penalties rose ~20x FY2024→FY2025
  ($16m→$324m per BIS FY2025 Annual Report); enforcement is now sized
  to matter.

• September 2024 affiliates rule (≥50% owned = same restrictions)
  suspended one year to 10 Nov 2026; ~20,000 Chinese entities in scope
  if it snaps back.

• China Announcements 70/72 (gallium, germanium, graphite, antimony,
  REE) suspended to 10 and 27 November 2026; Announcement 18 REEs remain
  controlled.

• US inbound duty stacks are HTS-specific and combine MFN, Section 301,
  Section 232 derivatives (10--50%), plus product-specific bans
  (connected vehicles, cranes, chassis 100%); 178 exclusions lapse 10
  Nov 2026.

CP2 --- Data and personnel (25% weight)

• CAC penalised Ctrip (RMB 10m) in June 2026 for PIPL Art. 66(2)
  cross-border data violations, signalling that the education phase is
  over (DLA Piper).

• CSL extraterritoriality has been in force since 1 January 2026; the
  automotive 2026 Edition (3 February 2026) is the most operationally
  onerous sector regime.

• Exit-ban usage against foreign executives (Wells Fargo Sep 2025
  released; Manus Mar 2026 unresolved) shows personnel leverage is now a
  live tool in commercial disputes.

• Foreign passport nationality is grounds for excluding an individual
  from access to "important data" under the automotive regime;
  equivalent restrictions in other sectors are on the same trajectory.

CP3 --- Structure (25% weight)

• Nexperia case (Chinese subsidiary refusing HQ instructions, Dutch
  government intervention, Chinese parent stripping Dutch unit) is the
  benchmark control-loss precedent.

• The 1 July 2026 Regulation on Outbound Investment (NDRC/MOFCOM)
  governs Chinese-outbound flows; implementation rules unissued. It does
  not directly regulate foreign-to-foreign exits of a China FIE.

• New VIE structures for US listing: 6% of post-2023 filings; 1
  clearance in 2026; 475-day filing time; CSRC explicit preference for
  restructuring. No credible completion path under current posture.

• Hello Group RMB 548m assessment established that treaty-substance-thin
  offshore holding structures do not get the 5% treaty rate; 10% WHT
  applies.

CP4 --- Payment rails (20% weight)

• Bank of Kunlun retained SDN designation; Bank of Heihe added to SDN 4
  June 2025 for supporting sanctioned Russian and DPRK financial
  activity. The precedent shows a single OFAC-adjacent event can close a
  corridor within weeks.

• CIPS Rulebook v3.6 (5 June 2026) tightened counterparty due diligence
  and introduced expedited-review pathways; direct participant network
  at 174 institutions across 51 jurisdictions.

• e-CNY B2B pilot expanded to 25 provinces (Q2 2026); mBridge crossed 40
  pilot banks (May 2026); non-USD RMB settlement is more available than
  18 months ago but concentrated in specific corridors.

• EU 21st sanctions package (23 July 2026) added bank-level Chinese
  designations for the first time at scale; the 22nd package trajectory
  is undated but points to more of the same.

Aggregate read

The signal across all four is not that China has become impossible ---
it is that the range of workable structures has narrowed, the cost of
the wrong structure has risen, and the timeline for building
alternatives has shortened. Any operator whose China plan has not been
rescored since Q3 2025 is operating on assumptions that the last twelve
months have invalidated in at least one choke point.

5. Choke Point 1 --- Export controls

The right to move goods, components, technology, and data with dual-use
potential into and out of China now sits at the intersection of at least
six regulatory regimes: US BIS, US OFAC, US Treasury (OISP), EU
dual-use, Japan METI, Korea MOTIE, and China's own MOFCOM
export-control machinery. Each has expanded materially since 2024.
BIS-assessed administrative penalties rose roughly 20x per the BIS
FY2025 Annual Report --- from $16 million in 2024 to $324 million in
FY2025 --- signalling that enforcement is now sized to matter, not just
to publish.

STATE OF PLAY, JULY 2026

• The US Entity List has paused since October 2025 (zero Chinese
  additions), with more than 100 Chinese firms including DeepSeek and
  CXMT held in a review queue to avoid escalation
  ([CSIS]{.underline};
  [[Chosun
  Biz]{.underline}](https://biz.chosun.com/en/en-it/2026/06/17/YP76NTAUFVCYJCFAJ7PX7Y6MOY/)).
  The BIS affiliates-rule suspension expires around 10 November 2026.

• The Outbound Investment Security Program (Treasury) has been effective
  since 2 January 2025, covering semiconductors, quantum, and AI.
  Treasury's COINS Act rulemaking is due 13 March 2027, with scope and
  Covered Foreign Persons list still undefined
  ([Skadden]{.underline}).

• US duty exposure on China goods varies by HTS classification.
  Applicable stacks may include MFN duty, Section 301, Section 232
  derivatives at 10--50%, and product-specific measures such as the
  connected-vehicle ban and 100% on cranes and chassis. 178 exclusions
  lapse 10 November 2026 ([[Wiley
  tracker]{.underline}](https://www.wiley.law/trump-administration-tariff-tracker);
  [Honigman]{.underline}).
  Operators must compute the applicable rate at SKU level rather than
  assume a headline aggregate.

• UFLPA enforcement is up +51% in FY2025 detentions; the UFLPA
  Entity List has passed 116 designated firms
  ([CustomsValidator]{.underline}).

• China's counter-measures: April 2026 counter-extraterritoriality
  regulations penalise foreign firms that comply with foreign sanctions
  against Chinese entities ([[Mayer
  Brown]{.underline}](https://www.mayerbrown.com/en/insights/publications/2026/05/china-expands-its-playbook-new-industrial-supply-chain-and-counter-extraterritoriality-regulations-create-direct-compliance-conflicts-for-multinationals)).
  Rare-earth suspensions expire 10 and 27 November 2026 ([[Clark
  Hill]{.underline}](https://www.clarkhill.com/news-events/news/china-hits-pause-on-rare-earth-export-controls-and-what-it-means-for-supply-chains/)).

Dimensions and weights

-------- --------------------------------- ------------ ----------------------------------
# DIMENSION WEIGHT WHAT AN OPERATOR IS SCORING

1 List-capture depth 20% Counterparties or ≥50%-owned
affiliates on Entity List, MEU,
1260H, UFLPA, UEL, MOFCOM
Controlled Party.

2 Licence dependency 20% Share of China revenue requiring
BIS, METI, MOTIE, EU, or MOFCOM
licence.

3 Extraterritorial double-bind 15% Exposure to US chip rules reaching
China-HQ affiliates plus China
0.1% REE-content rule reaching
goods made outside China.

4 Retaliation-from-compliance 10% Whether UFLPA exits, EAR refusals,
OISP terminations, or CSDDD
tracing trigger April 2026
counter-actions.

5 Tariff / landed-cost stack 15% HTS-specific stack: MFN + 301 +
232 derivatives 10--50% +
product-specific bans, CBAM
certificates, $46/net-ton vessel
fees.

6 Critical-input 10%** China-origin REEs, magnets,
single-sourcing** gallium, germanium, antimony,
graphite anode, tungsten, indium,
molybdenum, bismuth, tellurium.

7 Detention exposure 10% UFLPA priority commodities in the
BOM (cotton, tomato, polysilicon,
aluminium, PVC).
-------- --------------------------------- ------------ ----------------------------------

How to score it

A pharmaceutical distributor moving finished dose forms out of China
with no critical-mineral content and no UFLPA-priority inputs scores low
on dimensions 6--7 but potentially high on dimension 5 depending on the
specific tariff line. An industrial equipment OEM importing from China
with rare-earth magnets in the drive train scores high on 6 and 7
regardless of counterparty designation, because the input dependency
itself is the exposure. A semiconductor equipment vendor scores high on
nearly every dimension because the sector is the target.

The rule of thumb: dimensions 1--4 measure who and what an operator can
legally interact with. Dimensions 5--7 measure the cost, dependency, and
detention risk of the goods themselves. Both matter. Neither substitutes
for the other.

6. Choke Point 2 --- Data and personnel

The Personal Information Protection Law (PIPL), Data Security Law (DSL),
and Cybersecurity Law (CSL) form the base of China's data regime. The
22 March 2024 CAC provisions, the September 2024 municipal FTZ
implementation, the automotive 2026 Edition (3 February 2026), and the
amended CSL (extraterritorial from 1 January 2026) form the current
stack. Procedural burden has eased. Enforcement severity has sharpened.
Personnel risk has become a stated policy instrument.

STATE OF PLAY, JULY 2026

• CAC monthly Security Assessment applications are down ~60% and
  SCC filings down ~50% year-on-year, and validity extended from 2 to 3
  years
  ([MoFo]{.underline}).
  The reduction reflects broader FTZ negative lists (17 sectors) and
  automotive exemptions, not overall relaxation.

• The Ctrip case (13 June 2026) --- RMB 10 million fine for failing
  to complete the required data-export security assessment and unlawful
  cross-border transfer of personal information --- was characterised as
  one of the most significant PIPL penalties to date and, in counsel's
  words, marks the end of the education phase ([[Bird &
  Bird]{.underline}](https://www.twobirds.com/en/insights/2026/china/cac-imposes-hefty-fine-for-data-export-violations);
  [[DLA
  Piper]{.underline}](https://privacymatters.dlapiper.com/2026/06/china-chinas-data-regulator-means-business-the-education-phase-is-over/)).
  Consumer-facing sectors with cross-border data flows should treat
  themselves as within the enforcement priority set.

• US IPO filings by Chinese companies: 56 in 2024, 14 in 2025, **1 in H1
  2026** --- a 95% year-on-year drop
  ([LLYC]{.underline}).
  Nasdaq's $25 million floor for China-based issuers is live from June
  2026 ([SRFC]{.underline}).
  Hong Kong IPO fundraising was +92% in H1 2026 as the substitute route.

• The Regulation on Outbound Investment (Chinese-outbound) effective **1
  July 2026** treats cross-border data transfer and personnel deployment
  as controlled channels for Chinese investors making or disposing of
  overseas investments, with 1--3 year outbound-investment bans and
  personal manager liability. This is a first-order constraint on
  Chinese counterparties in JV, licensing, and offshore-holding
  structures, and a second-order constraint on foreign operators that
  rely on those counterparties to complete cross-border flows ([[Morgan
  Lewis]{.underline}](https://www.morganlewis.com/pubs/2026/06/regulation-on-outbound-investment-why-chinese-counterparty-compliance-is-now-a-deal-risk)).

• Documented exit-ban cases 2024--2026: Wells Fargo (resolved
  diplomatically September 2025), USPTO, Manus (unresolved March 2026),
  AstraZeneca, Astellas, Kroll/Nomura. US State Department has held the
  China travel advisory at Level 2 since 27 November 2024, naming
  exit bans specifically ([[State
  Department]{.underline}](https://travel.state.gov/en/international-travel/travel-advisories/china.html)).

Dimensions and weights

-------- ------------------------ ------------ ----------------------------------
# DIMENSION WEIGHT WHAT AN OPERATOR IS SCORING

1 Important-data / CIIO 20%** Automotive R&D, industrial
exposure** process, financial, or energy data
held. Designation is
self-identified with mandatory
filing.

2 Route dependency for 15%** HR, CRM, group reporting, global
routine HQ flows** systems needing SCC/assessment
rather than exemption or FTZ
carve-out.

3 Enforcement-target 10%** Consumer-facing travel,
profile** hospitality, retail = high (Ctrip
pattern).

4 Exit-path liquidity 15% Whether the plan needs an offshore
buyer or a US listing. Inbound M&A
−31% H1 2026; US IPO −95%.

5 Diligence feasibility 15%** Whether valuation needs underlying
on China targets** data. CAC security assessment now
sits inside closing conditions.

6 Offshore-migration 10%** Prior Singapore-wash,
legality** licence-plus-secondment, or
offshore IP-holding structures now
covered by the 1 Jul 2026
Chinese-outbound investment
regulation where a Chinese
investor is on the outbound side.

7 Personnel-in-country 10%** Executives with dual heritage,
exposure** signatory authority, legal-rep
status, or unresolved disputes
travelling to China.

8 Frontier-tech 5%** AI, semiconductor, quantum teams
personnel in China (Manus precedent ---
concentration** engineer exit restriction now a
stated policy tool).
-------- ------------------------ ------------ ----------------------------------

How to score it

A software vendor with no China entity but SaaS customers in China
scores low on dimensions 1--2 (no China-side data at rest) but
potentially high on dimension 3 if the product touches consumer data. A
JV with a Chinese partner in manufacturing scores high on dimension 4
(exit-path liquidity depends on the JV partner or a buyer) and dimension
5 (any material buyer will need underlying data). A financial-services
firm with China-based analysts scores high on dimensions 1, 7, and 8
simultaneously and should treat that combination as a compounding risk,
not three separate ones.

The rule of thumb: dimensions 1--3 measure standing exposure to
enforcement. Dimensions 4--6 measure the risk of a strategic decision
(exit, acquisition, restructuring) becoming impossible. Dimensions 7--8
measure the risk of losing a person, either through a travel restriction
or a career-shortening detention.

7. Choke Point 3 --- Structure

Structural risk in the corporate sense --- the risk that the entity you
hold and the control mechanisms you rely on stop functioning --- has
moved from theoretical to demonstrated in the last twelve months. The
Foreign Investment Law of 2020 formally superseded the JV laws. The 2024
Company Law rewrote governance defaults. The 2024 Manufacturing Negative
List went to zero restrictions. All of these are the easing story. The
tightening story is what makes this a choke point.

STATE OF PLAY, JULY 2026

• VIE structures are not banned but are being de facto dismantled. Only
  6% of post-2023 offshore listings were VIEs, filings take an
  average of 475 days, and only one VIE cleared in 2026 (Manycore).
  Zero VIEs among the seven red-chip acceptances in March--April 2026
  ([Caixin]{.underline}).
  CSRC has told candidates to dismantle while publicly denying a blanket
  ban
  ([Reuters]{.underline}).

• The 2024 Foreign Investment Negative List holds at 29 entries, with
  Manufacturing at zero, Financial Services at 100% foreign ownership
  permitted in principle, but a de jure vs de facto gap. Autos: JV
  limits gone since 2022, yet only two majority conversions
  completed and Toyota's wholly owned EV unit took six years ([[State
  Dept]{.underline}](https://www.state.gov/reports/2025-investment-climate-statements/china)).
  The counter-case: Starbucks ceded 60% to Boyu Capital, closed 4
  February 2026
  ([Starbucks]{.underline}).

• Nexperia China publicly instructed staff to ignore Dutch HQ in October
  2025 and control has not been restored
  ([Morningstar]{.underline};
  [Reuters]{.underline}).
  This is the new benchmark control-loss case for foreign investors in
  China.

• The Regulation on Outbound Investment (NDRC/MOFCOM), effective **1
  July 2026**, governs Chinese-outbound flows: Chinese investors making,
  restructuring, or disposing of overseas assets. It is not a direct
  approval regime for a foreign shareholder selling its equity in a
  China FIE. It does directly bite when the counterparty on the buy or
  sell side is Chinese, when a Chinese-controlled offshore holding sits
  in the chain, or when the transaction disposes of an overseas asset
  held through a Chinese investor. Implementation rules --- filing
  thresholds, review procedures, retrospective scope --- are unissued
  ([[Morrison
  Foerster]{.underline}](https://www.mofo.com/resources/insights/260604-china-s-odi-rules-just-changed)).

• Dividend withholding tax remains 10% (treaty 5% only with genuine
  substance --- Hello Group's RMB 548m assessment is the enforcement
  precedent). Treasury plumbing has genuinely improved (nationwide cash
  pooling, doc waivers, seconds-not-days settlement) even as structural
  gating tightens ([[DLA
  Piper]{.underline}](https://www.dlapiper.com/en-us/insights/publications/2026/01/official-release-of-the-2025-cross-border-cash-pooling-regulations);
  [PwC]{.underline}).

Dimensions and weights

-------- ----------------------- ------------ ----------------------------------
# DIMENSION WEIGHT WHAT AN OPERATOR IS SCORING

1 Structural legitimacy 20%** VIE/red-chip contractual
of holding chain** dependence vs equity ownership.
VIE = high; wholly foreign-owned
enterprise (WFOE) = low.

2 Negative-list 15%** JV/majority requirements in
exposure of revenue telecoms, medical, education,
lines** aviation, nuclear, water
transport, surveys.

3 De jure vs de facto 15%** Sectors where the rules permit
control gap** majority control but approval
discretion is the binding
constraint.

4 Governance 15%** AoA conformed to 2024 Company Law;
hard-wiring** simple-majority defaults;
mandatory employee-representative
director at ≥300 employees.

5 Operational command 15%** Whether HQ can enforce
of China entity** instructions on payroll, chops,
licences, exports. Nexperia is the
benchmark failure case.

6 Cash-out throughput 10% Dividend WHT + treaty substance +
SAFE process. >30% equity
outbound loans need case-by-case
approval.

7 Exit optionality 10% Sale of the China business through
Chinese counterparties or
Chinese-controlled offshore chains
touches the 1 Jul 2026
Chinese-outbound security review;
direct foreign-to-foreign exits do
not, but still face SAFE, tax, and
MOFCOM standard clearance.
-------- ----------------------- ------------ ----------------------------------

How to score it

A US-listed China tech company holding its operations through a VIE
scores at or near 5 on dimension 1 by construction. A wholly
foreign-owned manufacturing plant established in 2018 scores near 0 on
dimensions 1--3 but should still score dimensions 4--5 carefully --- the
2024 Company Law employee-representative rule catches every entity with
300+ staff regardless of ownership. A 50/50 JV in a sector still on the
negative list scores high on 2 and 3 and needs a very careful read of 4
and 5, because the Nexperia pattern is easiest to trigger where control
is contractual rather than absolute.

The rule of thumb: dimensions 1--3 measure who is legally allowed to own
what. Dimensions 4--5 measure whether the ownership is enforceable in
practice. Dimensions 6--7 measure what happens when the operator wants
the money out or the business sold.

8. Choke Point 4 --- Payment rails

The plumbing that moves money between a foreign operator and China
customers, suppliers, or subsidiaries has bifurcated. Chinese domestic
rails (CIPS, CBETS, e-CNY) have expanded capability. Access to those
rails has tightened. USD correspondent banking, still the default for
most cross-border China B2B flows, now carries measurable
secondary-sanctions exposure. The one-line summary: the rails got better
and the right to use them got narrower.

STATE OF PLAY, JULY 2026

• CIPS H1 2026 volume was **RMB 100.9 trillion (4.395 million
  payments)**, annualising to ~12% growth vs 2025's RMB 180.2 trillion
  --- a sharp deceleration from 40%+ compound growth through 2024
  ([[CIPS
  statistics]{.underline}](https://www.cips.com.cn/kjjqgsyyingw/cipsfw/index.shtml);
  [[China
  Daily]{.underline}](https://global.chinadaily.com.cn/a/202603/03/WS69a642bea310d6866eb3b485.html)).

• RMB share of global payments per SWIFT: 2.18% (June 2026). RMB
  share of global reserves per IMF: 1.99%. Both flat or lower
  year-on-year ([[Trade Treasury
  Payments]{.underline}](https://tradetreasurypayments.com/articles/usd-dominates-the-global-currency-and-trade-finance-market-swifts-global-currency-tracker-june-2026);
  [IMF]{.underline}).
  Yuan internationalisation is stalling in dollar-weight terms.

• The EU 21st sanctions package, adopted 23 July 2026, designated 14
  Chinese/HK entities and triggered a 14-entity Chinese counter-listing
  on the EU within 24 hours
  ([Reuters]{.underline}).
  The 18th package (July 2025) was the first-ever Chinese bank
  designation. The pattern says more bank-level listings are available
  as an EU escalation lever.

• US Treasury has written to at least two Chinese banks under EO 14114
  secondary-sanctions authority for Iran-oil exposure
  ([Reuters]{.underline}).
  The Heihe precedent --- Chinese banks progressively refusing
  Russia-linked payments from 9 (Mar 2024) to >98% (Aug 2024) to Heihe
  closing in September 2025 --- shows how quickly Chinese banks de-risk
  to protect USD access ([[Yahoo
  Finance]{.underline}](https://finance.yahoo.com/news/key-chinese-bank-reportedly-halts-092655214.html)).

• Bank readiness gap: only ~half of surveyed overseas banks can
  execute account opening, FX, and cross-border settlement together;
  only 40% offer RMB hedging ([[Bank of China White
  Paper]{.underline}](https://pic.bankofchina.com/bocappd/rareport/202606/P020260609657287428574.pdf)).
  A working rail is not the same as a usable rail.

Dimensions and weights

-------- ----------------------- ------------ ----------------------------------
# DIMENSION WEIGHT WHAT AN OPERATOR IS SCORING

1 USD correspondent 20%** Share of China flows that must
dependence** transit a USD correspondent chain
(imports EO 14114 exposure and
OFAC screening delay).

2 Counterparty 20%** Distance from suppliers/customers
designation proximity** to current OFAC and EU lists ---
teapot refineries, Shandong
logistics, border banks.

3 Bank concentration / 15%** Number of banks that can actually
de-risking risk** execute the full China workflow.
Single-bank dependence = Heihe
scenario.

4 Settlement-time 10%** Whether operations survive a
variance tolerance** 12--20 day compliance hold on a
critical payment.

5 Cost leakage 10% All-in 1--5% of transaction value
plus 1--3% penalty on
USD-denominated invoicing.

6 Capital-account exit 10%** Dividend repatriation 2--6 weeks
friction** fully documented; 1 April 2026
offshore-proceeds repatriation
rule.

7 Conflict-of-laws 10%** Whether a Chinese blocking order
exposure** could require a counterparty to do
what sanctions compliance forbids.

8 Rail-substitution 5%** Whether RMB/CIPS invoicing is
readiness** actually available via the
operator's bank. Access is
bank-mediated only.
-------- ----------------------- ------------ ----------------------------------

How to score it

An importer paying Chinese suppliers in USD through a European bank with
US correspondent banking scores high on dimension 1, and any
counterparty even loosely adjacent to a listed entity pushes dimension 2
up sharply. A JV exporting from China to customers in the Gulf or ASEAN,
invoiced in RMB and settled through CIPS, scores lower on dimensions
1--2 but higher on dimension 8 (bank access) and dimension 6 (getting
the money back to HQ). A firm paying salaries and rent in China from an
onshore WFOE bank account, generating RMB revenue locally, and
repatriating dividends annually has the simplest profile --- but should
still score dimension 6 carefully given the 1 April 2026 rule change.

The rule of thumb: dimensions 1--3 measure the sanctions-and-bank-access
story. Dimensions 4--5 measure the operational cost of moving money.
Dimensions 6--7 measure whether money can leave. Dimension 8 measures
optionality if the primary path fails.

9. Aggregate: reading the CSRS score

The CSRS is the weighted average of the four choke-point composites
using the 30/25/25/20 weights. It sits on a 0.0--5.0 scale and maps to
one of five bands. A single number is not the point --- the number is a
summary of what an operator has actually scored underneath. But the
number is useful because it forces the operator to reduce a diffuse
"China is complicated" instinct into a defensible position that can be
tracked over time.

What each band means in practice

• Low (0.0--0.9): An operator scoring here is either genuinely
  low-exposure (small China footprint, sector-agnostic goods, no
  sensitive data, no personnel in country, RMB-only invoicing) or
  scoring optimistically. Rescore annually.

• Moderate (1.0--1.9): Named exposures exist and are being managed.
  No structural mitigations required beyond routine compliance
  monitoring. Track quarterly.

• Elevated (2.0--2.9): Structural mitigations required. This is the
  band where an operator should stop adding exposure and start building
  alternatives --- second bank, second supplier, second data pathway.
  Rescore semi-annually.

• High (3.0--3.9): Active de-risking programme mandatory. New
  investment decisions on hold pending programme milestones. Board-level
  visibility. Rescore quarterly.

• Severe (4.0--5.0): Structural exit decision on the table. The
  question is no longer how to optimise the China operation but how to
  contain it and unwind it in an orderly way. Weekly review cadence
  until the CSRS moves.

The aggregate as a directional signal

A CSRS of 2.4 is Elevated. So is a CSRS of 2.7. The difference between
them matters less than the delta from the previous score. A CSRS moving
from 2.4 to 2.9 in one quarter is more significant than a CSRS holding
steady at 3.2. The number's job is to force conversation about the
trend, not to fetishise the exact decimal.

Tracking cadence: an operator can only see the delta if the prior score
is captured. The scoring worksheet must freeze the perimeter, the 30
dimension scores, the four composites, the CSRS, and any
override-trigger state at each read. The band determines the minimum
cadence (annual at Low; quarterly at High; weekly at Severe), but
tracking cadence should not be looser than quarterly in any band above
Low.

Canonical CSRS vs operator-adjusted CSRS

The canonical CSRS uses the 30/25/25/20 choke-point weights and the
dimension weights published in this brief. Those weights reflect
MAALAT's reading of what has moved most since 2024 across all foreign
B2B operators. Only a score using those exact weights is the CSRS.

An operator whose sector or profile makes the canonical weights a poor
fit --- a data-heavy fintech that should weight CP2 higher, a
semiconductor OEM that should weight CP1 higher, a services firm with no
goods flow that should weight CP1 lower --- may run a separate
"operator-adjusted CSRS" using different weights. Both scores can be
reported, but the labels must be distinct. Do not call an adjusted
result the CSRS. The whole point of the canonical score is comparability
across operators, sectors, and time; that comparability is destroyed the
moment the weights become bespoke and unlabelled.

10. Override triggers

Three named event families floor the CSRS regardless of the weighted
composite. Two floor at 4.5 (prohibition-tier). One floors at 3.5
(licence-tier). The distinction matters because not every designation
carries the same legal consequence: an OFAC SDN is a prohibition for US
persons, while a US Entity List addition triggers a licence requirement
with a presumption of denial for many end-uses but is not, by itself, an
automatic transaction ban. Conflating them overstates the score in one
direction and understates it in the other.

Trigger A1 --- Prohibition-tier listing exposure (floor 4.5)

Any counterparty of the operator, within the scoring perimeter defined
in Section 3, appears on: OFAC SDN or any OFAC list carrying a full
transaction prohibition for US persons; an EU asset-freeze designation
carrying a full prohibition under the relevant regulation; or any
equivalent third-country full-prohibition list (UK OFSI, Japan
METI-designated, Canada SEMA) where the operator has jurisdictional
nexus. Composite floor 4.5.

Rationale: a full-prohibition designation converts a compliance question
into a strict legal bar. The remaining dimensions become mitigations of
a known fact rather than assessments of probability. The operator's
task is to unwind or ring-fence, not to optimise.

Operational cadence when triggered: legal review within 5 business days;
ring-fencing or unwind decision within 30 days; if the unwind route is
not viable, escalation to board within 60 days.

Trigger A2 --- Licence-tier designation exposure (floor 3.5)

Any counterparty of the operator, within the scoring perimeter, appears
on: the US Entity List (EAR licence requirement); the Military End-User
List (MEU) or Military-Intelligence End-User List (MIEU); Section 1260H
list (Chinese military-companies list, non-prohibitive but reputational
and procurement-restrictive); the UFLPA Entity List (rebuttable
presumption on imports); MOFCOM Controlled Party or Unreliable Entity
List (China-side); or any EU/UK/Japan control-list entry that requires
licence or enhanced review without full prohibition. Composite floor
3.5.

Rationale: licence-tier designations are not automatic bars but they
materially raise the cost, timeline, and denial probability of the
transaction. Scoring them as prohibition (4.5) overstates the exposure;
scoring them as zero understates it. The 3.5 floor captures the
operational reality: the counterparty is workable only through enhanced
controls that may or may not clear.

Operational cadence when triggered: licensing feasibility review within
10 business days; contingency plan for licence denial within 30 days; if
licence is denied or materially delayed, re-evaluate against Trigger A1
(some licence denials, in practice, become prohibitions).

Trigger B --- Live control-loss (floor 4.5)

The operator's China subsidiary or JV has demonstrably ignored HQ
instructions (the Nexperia benchmark) or local management has taken
unilateral action on chops, licences, exports, or payroll in the last 90
days without HQ authorisation. Composite floor 4.5.

Rationale: once operational control is contested, every other structural
safeguard weakens. Access to underlying data becomes a fight. Cash
movements slow or stop. The corporate register can be updated without HQ
knowledge. This trigger is designed to catch the moment before a
Nexperia-style public rupture, not after.

Operational cadence when triggered: external counsel engaged within 5
business days; independent audit of chops, bank access, and legal-rep
filings within 30 days; if control cannot be re-established within 90
days, initiate structural intervention (chairperson change, JV dispute
resolution, or exit).

Trigger C --- Personnel-in-country under duress (floor 4.5)

Any current executive of the operator is under a China travel
restriction, or any unresolved commercial dispute exists where a China
counterparty has signalled willingness to invoke exit-ban leverage
against an executive. Composite floor 4.5.

Rationale: personnel risk is not a probability --- once it materialises,
it dominates every other consideration. The Wells Fargo case (September

2025. and the Manus case (March 2026, still unresolved) show the
      pattern: bans surface at departure, and their resolution is diplomatic
      rather than legal. The correct posture once this trigger fires is to
      freeze non-essential travel of any executive who has any exposure
      profile, not just the affected individual.

Operational cadence when triggered: immediate travel-hold on all China
exposure; K&R and legal counsel within 24 hours; embassy notification;
parallel diplomatic track opened within 5 business days.

11. Worked example --- EuroInd Manufacturing (illustrative)

This worked example is a composite operator, not a real company. It
exists only to demonstrate the rubric end-to-end. The name, numbers, and
counterparty details are illustrative.

Operator profile

• EuroInd Manufacturing SE, headquartered in Germany. Publicly listed on
  Frankfurt exchange. €1.8bn revenue 2025, €420m from China.

• China footprint: one wholly foreign-owned enterprise (WFOE) in Suzhou
  producing industrial pumps and drives; one 55% JV in Shanghai with a
  Chinese SOE for large-frame motors; distribution network of eight
  independent Chinese distributors covering tier-1 and tier-2 cities.

• Data profile: telemetry from installed base flows to EU cloud; no
  consumer PI; some "important data" implications from automotive OEM
  customers who use EuroInd drives in EVs.

• Personnel: 340 employees in China, including one German Vorstand
  member (Head of Asia) who spends ~50% of working days in China; two
  other German expats on payroll in Suzhou.

• Payments: EUR settlement through Deutsche Bank USD correspondent, with
  a Standard Chartered RMB pathway for domestic-Chinese flows.

• Scoring perimeter (documented): parent SE + Suzhou WFOE (100%) +
  Shanghai JV (55%) + eight named distributors (each >10% of respective
  product-line China revenue). Tier-two suppliers excluded; two are
  single-source and included.

CP1 --- Export controls (composite target)

-------- ----------------------------- ------------ ----------- ------------------------ -----------
# DIMENSION WEIGHT SCORE ANCHOR EVIDENCE CONF.

1 BIS Entity/MEU list 20%** 2.0 No direct-list High
exposure** counterparty. One
tier-two motor supplier
is on the UFLPA Entity
List (rebuttable
presumption on imports);
EuroInd has switched but
transition ongoing. Not
1.0 because the
transition is not
finished.

2 BIS affiliates-rule 15%** 2.5 If the affiliates rule Medium
exposure post-10 Nov 2026** snaps back on 10 Nov
2026, three current
EuroInd customers become
in-scope as ≥50%
affiliates of Entity
List parents.
Contingency in place but
not tested.

3 MOFCOM export-control 15%** 3.5 EuroInd's motor line High
exposure (rare uses NdFeB magnets that
earths/gallium/germanium)** fall under Announcement
18 (never suspended).
Reverse-flow licence
required for parts sold
back to non-Chinese
customers. One licence
delay in Q2 2026.

4 EU dual-use / national 10%** 1.5 Standard industrial High
control-list exposure** motors and drives; no
listed dual-use items in
current product mix. Not
0 because
next-generation servo
drives under development
touch ML 22 categories.

5 US inbound tariff-stack 15%** 2.5 ~$80m of Shanghai-JV High
exposure (HTS-specific)** output is shipped to US
customers. HTS 8501
(motors) carries MFN
2.4% + Section 301 List
3 at 25%. Two
178-exclusion HTS lines
lapse 10 Nov 2026.

6 UFLPA/forced-labour 10%** 2.0 One tier-two aluminium Medium
exposure** castings supplier in
Xinjiang was flagged Q1
2026; EuroInd terminated
in Q2 2026. Residual
exposure in inventory in
transit. FY2026
shipments detentions
+51% year-on-year at
CBP.

7 Third-country secondary 10%** 1.5 Japanese and Korean High
exposure (Japan/Korea/EU)** control lists mirror US
on advanced
semiconductors; EuroInd
product mix is not
affected. EU 21st
package added specific
Chinese banks;
EuroInd's Standard
Chartered rail is
unaffected.

8 Enforcement precedent 5%** 2.5 Industrial-equipment Medium
breadth in operator's sector has seen 2
sector** mid-size BIS settlements
in FY2025 for licence
violations on
rare-earth-magnet
motors. Precedent is
close to EuroInd's
product line.
-------- ----------------------------- ------------ ----------- ------------------------ -----------

CP1 composite = 0.20×2.0 + 0.15×2.5 + 0.15×3.5 + 0.10×1.5 + 0.15×2.5 +
0.10×2.0 + 0.10×1.5 + 0.05×2.5 = 2.25. Rounded to 2.3. Band: Elevated.
Note the 3.5 score on rare-earth licence exposure is dimension-specific:
it is not a 4.5 because the licences have been granted (with delay), not
denied; not a 2.5 because the licence-delay pattern is now consistent
enough that treating it as background noise would understate the risk.

CP2 --- Data and personnel (composite target)

-------- --------------------------- ------------ ----------- ------------------------ -----------
# DIMENSION WEIGHT SCORE ANCHOR EVIDENCE CONF.

1 Cross-border 20%** 3.0 Telemetry classified as Medium
data-transfer legality** "important data" under
automotive OEM
downstream rules; SCC
filed Q4 2025 but has
not received clearance;
interim mitigations in
place.

2 PIPL/DSL/CSL enforcement 15%** 2.5 Ctrip RMB 10m fine in High
exposure** June 2026 is the current
benchmark; EuroInd not a
consumer-facing operator
but automotive
downstream is a live
enforcement priority.

3 Automotive 2026 Edition 15%** 3.5 EuroInd drives are Medium
specific exposure** inside EV powertrains;
the 2026 Edition
applies. Foreign
passport exclusion from
important-data access
affects the German Head
of Asia directly;
workaround in place is
fragile.

4 Personnel-in-country 15%** 3.0 Head of Asia (Vorstand Medium
exposure** member) spends ~50% of
days in China. Two
German expats on
payroll. One unresolved
supplier dispute in the
Suzhou courts creates
theoretical exit-ban
vector.

5 Trade-secret protection 10%** 2.5 IP registered in China; High
posture** NDAs in place with JV
partner and
distributors. Source
code for firmware kept
in EU cloud only;
access-logged. No IP
theft incident to date.

6 Offshore-migration 10%** N/A No offshore migration in High
legality** scope; EuroInd operates
directly through its SE
parent. Dimension
excluded per Appendix
N/A rule; remaining
weights renormalised.

7 Personnel with 10%** 1.5 One senior manager in Medium
dual-nationality/heritage the Shanghai JV holds
exposure** Chinese nationality with
prior US residency. No
direct signals to date,
monitored.

8 Data-localisation 5%** 2.0 Local-China data centre High
infrastructure cost** established Q3 2025 for
regulated telemetry;
capex €4m; ongoing opex
€1.2m/yr; not a
strategic constraint.
-------- --------------------------- ------------ ----------- ------------------------ -----------

CP2 composite: dimension 6 is N/A; remaining weights renormalised from
90% base to 100% (each multiplied by 100/90 = 1.111). Weighted average =
(0.222×3.0 + 0.167×2.5 + 0.167×3.5 + 0.167×3.0 + 0.111×2.5 + 0.111×1.5 +
0.056×2.0) = 2.72. Rounded to 2.7. Band: Elevated. The 3.5 on Automotive
2026 Edition is dimension-specific: not a 4.5 because the operator has a
fragile-but-live workaround, not a 2.5 because passport exclusion is now
a hard-coded rule in the sector regime.

CP3 --- Structure (composite target)

-------- ----------------------- ------------ ----------- ------------------------- -----------
# DIMENSION WEIGHT SCORE ANCHOR EVIDENCE CONF.

1 Structural legitimacy 20%** 1.5 Direct SE→WFOE and SE→JV High
of holding chain** structure; no VIE, no
offshore intermediate.
Structurally clean.

2 Negative-list 15%** 1.0 Manufacturing at zero on High
exposure of revenue 2024 negative list;
lines** product lines not
restricted.

3 De jure vs de facto 15%** 3.0 Shanghai JV: EuroInd Medium
control gap** holds 55% but two board
seats to SOE partner;
chair rotates biennially;
SOE holds legal
representative.
Documented tension on
procurement decisions Q1
2026.

4 Governance 15%** 2.0 AoA updated to 2024 High
hard-wiring** Company Law Q1 2025
across both entities;
employee-representative
director in place at
Suzhou WFOE (>300
employees).
Simple-majority defaults
documented.

5 Operational command 15%** 2.5 Suzhou WFOE: HQ command Medium
of China entity** clean, chops and legal
rep controlled by
EuroInd. Shanghai JV: two
Q2 2026 instances where
local management ignored
HQ pricing guidance. Not
Nexperia-level; watched.

6 Cash-out throughput 10% 2.5 Dividend WHT: EuroInd has High
direct German-China
structure, no
treaty-substance exposure
like Hello Group. 2024
dividend RMB 180m
repatriated in 9 months
(slow). Cross-border cash
pooling now available.

7 Exit optionality 10% 2.5 Direct foreign-to-foreign Medium
exit of Suzhou WFOE
possible without
triggering the 1 Jul 2026
Chinese-outbound
regulation; standard
SAFE/tax/MOFCOM path.
Sale to Chinese buyer
would trigger. JV exit is
contractually tied to SOE
consent.
-------- ----------------------- ------------ ----------- ------------------------- -----------

CP3 composite = 0.20×1.5 + 0.15×1.0 + 0.15×3.0 + 0.15×2.0 + 0.15×2.5 +
0.10×2.5 + 0.10×2.5 = 2.10. Rounded to 2.1. Band: Elevated. The 2.0 on
governance hard-wiring is dimension-specific: not a 3.5 because AoA is
conformed and employee-rep is in place, not a 1.0 because the JV
governance still has known friction points that require quarterly board
management.

CP4 --- Payment rails (composite target)

-------- ----------------------- ------------ ----------- ------------------------ -----------
# DIMENSION WEIGHT SCORE ANCHOR EVIDENCE CONF.

1 USD 20%** 2.5 Deutsche Bank USD High
correspondent-banking correspondent for
exposure** USD-denominated flows;
OFAC screening delays
average 5 business days;
no direct SDN-adjacent
counterparty in current
book.

2 Sanctioned-corridor 15%** 1.5 No exposure to Bank of High
proximity** Kunlun or Bank of Heihe.
Standard Chartered China
entity has cross-border
activities not in
EuroInd's corridor.

3 EU sanctions 15%** 2.0 None of the Chinese Medium
bank-list exposure banks designated in the
(21st + trajectory)** 21st package appear in
EuroInd's bank
counterparty list. 22nd
package trajectory is
undated but
pattern-consistent.

4 CIPS/RMB rail 15%** 2.5 Standard Chartered High
availability and supports CIPS direct
readiness** participation.
RMB-denominated
invoicing in place for
~30% of Chinese
customers. CIPS Rulebook
v3.6 (5 Jun 2026)
requires enhanced due
diligence not yet fully
embedded.

5 Counterparty 15%** 2.0 Full OFAC/EU/UK High
screening depth** screening on all
counterparties monthly;
UBO tracing at contract
onboarding; no gaps
identified in Q2 2026
audit.

6 Trade-finance 10%** 2.0 Standard Chartered and Medium
access** Deutsche Bank both
continue to provide LC
and forfaiting; pricing
widened 40bp Q1 2026 for
China exposure but
capacity intact.

7 e-CNY / mBridge 10%** 3.0 e-CNY B2B pilot in 25 Medium
readiness** provinces but EuroInd
not yet enrolled;
mBridge access is
bank-mediated and not
yet in place. Not a
current constraint; a
future optionality gap.
-------- ----------------------- ------------ ----------- ------------------------ -----------

CP4 composite = 0.20×2.5 + 0.15×1.5 + 0.15×2.0 + 0.15×2.5 + 0.15×2.0 +
0.10×2.0 + 0.10×3.0 = 2.20. Rounded to 2.2. Band: Elevated. The 1.5 on
sanctioned-corridor proximity is dimension-specific: not a 0 because
Standard Chartered China-entity presence in adjacent corridors
introduces a monitoring obligation, not a 2.5 because there is no direct
exposure to the SDN-designated banks.

CSRS aggregate

------------------------- --------------- ------------ -----------------------
CHOKE POINT COMPOSITE WEIGHT CONTRIBUTION

CP1 Export controls 2.3 30% 0.69

CP2 Data and 2.7 25%** 0.68
personnel**

CP3 Structure 2.1 25% 0.53

CP4 Payment rails 2.2 20% 0.44

CSRS (canonical) 2.3 100% Elevated band
------------------------- --------------- ------------ -----------------------

Override triggers

• Trigger A1 (prohibition-tier): Not fired. No SDN, EU asset-freeze, or
  full-prohibition designation among current counterparties.

• Trigger A2 (licence-tier): Fired. One tier-two motor supplier on UFLPA
  Entity List (transitioning out); one JV partner is a Chinese SOE
  subject to sectoral scrutiny. Composite floor 3.5. Because the
  canonical CSRS of 2.3 is below the floor, the operative CSRS becomes
  3.5.

• Trigger B (control-loss): Not fired. Two documented pricing-guidance
  overrides at Shanghai JV are captured in CP3 dimension 5, not at
  trigger level.

• Trigger C (personnel-under-duress): Not fired. Head of Asia has no
  travel restriction; the Suzhou supplier dispute has not escalated to
  exit-ban signals.

Operative CSRS and what this means

EuroInd's canonical CSRS is 2.3 (Elevated). The Trigger A2 licence-tier
floor lifts the operative CSRS to 3.5 (High). The operator's task is
not to argue the floor away but to work the underlying licence-tier
exposures: complete the UFLPA-Entity-List supplier transition, and
stress-test the JV governance for SOE-partner sensitivity if the parent
moves to a full-prohibition list. The delta from prior scoring (Q1 2026
CSRS 2.6, no override fired) is driven entirely by the tier-two UFLPA
finding and the SOE-partner scrutiny --- both events new since March
2026.

An operator-adjusted CSRS could weight CP1 higher (export controls
dominate this operator's profile) and CP4 lower. That is a legitimate
internal management view. It is not the CSRS. Both should be reported
side by side to preserve comparability.

12. Operator playbook

An operator with a CSRS between Elevated and Severe (2.0--5.0) needs to
know which structures generally operate cleanly under current
conditions, which have no commercially credible completion path, and
which are workable only conditionally. These are directional categories,
not blanket judgments --- each depends on the operator's sector,
counterparties, and perimeter.

Structures that generally operate cleanly

• **Wholly foreign-owned enterprise (WFOE) in a non-restricted sector,
  established pre-2024, with local Chinese revenue and local Chinese
  costs.** Manufacturing (2024 negative list at zero), professional
  services outside restricted sub-sectors, and non-consumer B2B services
  generally operate cleanly subject to CP2 conditions on data movement
  and CP3 conditions on dividend and offshore-holding substance. Add
  tariff-stack pressure (CP1) for goods-flow operators.

• **Direct-trade with China customers on RMB terms, settled through CIPS
  via a foreign bank that supports it.** Reduces USD correspondent
  dependence and OFAC screening delay. Requires a bank that can actually
  do it --- most cannot.

• FTZ-based operations for data-heavy or automotive activities. The
  17-sector FTZ negative lists and 2026 automotive exemptions genuinely
  reduced procedural burden for compliant operators.

• Hong Kong listing as substitute for US listing. HKD 285.8bn raised
  in 2025 (world #1); H1 2026 +92%. The route is open and functional for
  Chinese issuers who need public capital.

**Structures with no commercially credible completion path in current
conditions**

• New VIE structures for US listing. Six percent of post-2023
  filings; one clearance in 2026; 475-day filing time; explicit CSRC
  preference for restructuring. No credible completion path under
  current CSRC posture; operators evaluating the route should assume it
  fails unless CSRC posture visibly shifts.

• US IPO route for China-based issuers below $25m. Nasdaq floor is
  live from June 2026. The route is effectively closed for smaller
  issuers regardless of quality.

• **Cross-border data flows relying on the September 2024 provisions
  without SCC or Security Assessment where important data is involved.**
  The Ctrip case ended the education phase. Any consumer-facing operator
  moving customer data offshore without a route is exposed.

• **Payment routes through small Chinese banks near sanctioned
  corridors.** The Heihe precedent shows a single OFAC-adjacent event
  can close the corridor within weeks.

Structures that are workable only conditionally

• **JVs in sectors where the negative list eased but approval discretion
  is the binding constraint (autos, financial services, medical
  devices).** The formal rules permit majority foreign control; the
  practical reality often does not. Score dimension 3 (de jure vs de
  facto control gap) carefully.

• **Offshore holding structures for China operations
  (Cayman-BVI-HK-WFOE) with limited substance.** The Hello Group
  treaty-substance assessment is the precedent. Thin substance means the
  treaty rate does not apply and the operator pays the 10% WHT anyway.

• Executives with dual heritage travelling to China. Not
  disqualifying --- Wells Fargo's executive was released --- but the
  pattern is that exit bans are being used more, not less, as a
  civil-dispute leverage tool.

• **Any sale or restructuring of a China entity through a Chinese buyer,
  seller, or offshore Chinese-controlled holding --- the 1 Jul 2026
  Chinese-outbound investment regulation applies to that side of the
  transaction.** Direct foreign-to-foreign exits of a China FIE are
  governed by standard SAFE, tax, and MOFCOM processes, not the new
  outbound regulation. Implementation rules are unissued in either case;
  assume enhanced scrutiny until the rules are published.

13. The next 90 days

Five dated events between August and November 2026, plus one undated
trajectory, will move the CSRS for every operator with China exposure.
Naming them here is a checklist, not a prediction.

• 10 November 2026 --- BIS affiliates-rule suspension expiry. The
  one-year suspension of the September 2024 affiliates rule ends. If not
  extended, any ≥50%-owned affiliate of an Entity List company falls
  under the parent's restrictions overnight. Estimated ~20,000 Chinese
  entities affected ([[Miller
  Canfield]{.underline}](https://www.millercanfield.com/resources-White-House-Suspends-BIS-Affiliates-Rule-for-One-Year.html);
  [CSIS]{.underline}).

• **10 and 27 November 2026 --- China critical-mineral suspension
  expiries.** China's Announcements 70 and 72 pauses on gallium,
  germanium, graphite, antimony, and REE controls expire. Announcement
  18 REEs were never suspended and remain controlled
  ([HKTDC]{.underline};
  [Pillsbury]{.underline}).

• 22 August 2026 --- Section 301 List 2 comment window close. USTR
  is reviewing the continuation of List 2 tariffs. The decision will
  move the applicable duty stack up or down for every HTS heading within
  List 2. 178 exclusions also lapse 10 November 2026
  ([Wiley]{.underline}).

• Q3--Q4 2026 --- MATCH Act progress. The proposed US law
  (April 2026) would end ASML immersion-DUV sales and servicing to SMIC,
  Hua Hong, Huawei, CXMT, and YMTC. Dutch government has objected.
  Progress in either direction will move the semiconductor sub-industry
  ([Reuters]{.underline}).

• EU sanctions escalation trajectory (undated watchpoint). The 21st
  package landed 23 July 2026 with immediate Chinese retaliation. This
  is a trajectory, not a scheduled event: the pattern since the 18th
  package points to more bank-level Chinese designations as the next
  available escalation lever. Any operator with Chinese bank exposure
  should reassess when the next EU package is announced, which is not on
  a public calendar.

• Chinese-outbound investment regulation implementation rules. The 1
  July 2026 regulation is in force but implementation rules --- filing
  thresholds, review procedures, retrospective scope --- are unissued.
  First-mover enforcement cases will define the effective scope for both
  Chinese investors and the foreign counterparties who transact with
  them ([[Morrison
  Foerster]{.underline}](https://www.mofo.com/resources/insights/260604-china-s-odi-rules-just-changed)).

Rescoring any CSRS composite in December 2026 without accounting for
what happens across these six items produces a stale score.

14. What this brief is not

This brief is a rubric for scoring foreign B2B operator exposure to
China's current structural risk profile as of July 25, 2026. It is
deliberately not several other things it could be confused with.

• It is not a political forecast. MAALAT does not predict US
  election outcomes, China policy shifts, or geopolitical events. The
  rubric measures exposure to current conditions, not conditional
  futures.

• It is not a sector-specific playbook. It is sector-agnostic by
  design. Sector nuance goes into how an operator weights the dimensions
  within a choke point, not into the rubric itself.

• It is not a legal opinion. Every operator running this rubric
  should have counsel confirm the specific applicability of the cited
  regulations to their situation. This brief cites the regulations; it
  does not interpret them for a specific matter.

• It is not a China-exit thesis. The rubric can produce a Low score.
  A well-structured, well-monitored China operation in a permitted
  sector still works in 2026. The rubric's job is to force honesty
  about which category the operator is actually in.

• It is not a substitute for a paid MAALAT engagement. An operator
  using this brief as a self-assessment tool will produce a reasonable
  first-cut CSRS. A paid MAALAT China Structural Risk Review adds
  primary-source verification of every dimension, sector-specific weight
  calibration, and a defended composite the operator can bring to a
  board.

15. Sources

Every quantitative claim and named case in this brief is drawn from the
following sources, all publicly available as of July 25, 2026. Sources
are grouped by choke point.

Choke Point 1 --- Export controls

[[BIS FY2025 Annual
Report]{.underline}](https://www.bis.gov/media/documents/fy2025-bis-annual-report.pdf)
· [[BIS 2022 Statistical
Analysis]{.underline}](https://www.bis.doc.gov/index.php/documents/technology-evaluation/ote-data-portal/country-analysis/3420-2022-statistical-analysis-of-us-trade-with-china/file)
· [[CSIS Entity List
analysis]{.underline}](https://www.csis.org/analysis/entity-list-additions-cool-their-slowest-pace-2008)
· [[Miller Canfield affiliates
rule]{.underline}](https://www.millercanfield.com/resources-White-House-Suspends-BIS-Affiliates-Rule-for-One-Year.html)
· [[Skadden
OISP/COINS]{.underline}](https://www.skadden.com/insights/publications/2026/01/us-treasurys-reverse-cfius-authority)
· [[Wiley tariff
tracker]{.underline}](https://www.wiley.law/trump-administration-tariff-tracker)
· [[Honigman tariff
alert]{.underline}](https://www.honigman.com/alert-3462) ·
[[CustomsValidator
UFLPA]{.underline}](https://www.customsvalidator.com/blog/uflpa-enforcement-2026)
· [[Clark Hill critical
minerals]{.underline}](https://www.clarkhill.com/news-events/news/china-hits-pause-on-rare-earth-export-controls-and-what-it-means-for-supply-chains/)
· [[Mayer Brown
counter-extraterritoriality]{.underline}](https://www.mayerbrown.com/en/insights/publications/2026/05/china-expands-its-playbook-new-industrial-supply-chain-and-counter-extraterritoriality-regulations-create-direct-compliance-conflicts-for-multinationals)
· [[CSET on MOFCOM Notice
2025-61]{.underline}](https://cset.georgetown.edu/publication/mofcom-notice-2025-61/)
· [[HKTDC on Announcements 70 and
72]{.underline}](https://research.hktdc.com/en/article/MjE2NTI4MjQ4NA) ·
[[Pillsbury on
suspension]{.underline}](https://www.pillsburylaw.com/en/news-and-insights/china-suspends-export-controls-certain-critical-minerals-related-items.html)
· [[Al Jazeera on AI chip extraterritorial
reach]{.underline}](https://www.aljazeera.com/economy/2026/6/1/us-says-ban-on-ai-chip-shipments-applies-to-chinese-firms-outside-china)
· [[Chosun Biz on withheld
additions]{.underline}](https://biz.chosun.com/en/en-it/2026/06/17/YP76NTAUFVCYJCFAJ7PX7Y6MOY/)
· [[Reuters on MATCH
Act]{.underline}](https://www.reuters.com/world/china/us-targets-chinese-chipmaking-with-proposed-export-restrictions-asml-others-2026-04-03/)
· [[Reuters on Dutch
objection]{.underline}](https://www.reuters.com/world/asia-pacific/dutch-government-objects-proposed-us-law-restricting-asmls-china-exports-2026-05-14/)
· [[Reuters on China AI export
consideration]{.underline}](https://www.reuters.com/world/asia-pacific/china-considers-tighter-export-controls-ai-models-chips-ft-reports-2026-07-21/)

Choke Point 2 --- Data and personnel

[[Bird & Bird on Ctrip
fine]{.underline}](https://www.twobirds.com/en/insights/2026/china/cac-imposes-hefty-fine-for-data-export-violations)
· [[DLA Piper on Ctrip
case]{.underline}](https://privacymatters.dlapiper.com/2026/06/china-chinas-data-regulator-means-business-the-education-phase-is-over/)
· [[DLA Piper on automotive 2026
Edition]{.underline}](https://privacymatters.dlapiper.com/2026/02/china-new-guidance-on-data-transfer-and-identification-of-important-data-in-the-automotive-sector/)
· [[MoFo on CBDT one year
on]{.underline}](https://www.mofo.com/resources/insights/250609-china-s-new-cbdt-regime-one-year-on)
· [[Arnold & Porter data privacy
annual]{.underline}](https://www.arnoldporter.com/en/perspectives/advisories/2026/02/china-data-privacy-and-cybersecurity-2025-year-in-review)
· [[ANSI on March 2024
Provisions]{.underline}](https://www.ansi.org/standards-news/all-news/4-12-24-china-publishes-new-provisions-on-cross-border-data-flow-administration)
· [[Chambers Tech M&A 2026
China]{.underline}](https://practiceguides.chambers.com/practice-guides/technology-ma-2026/china/trends-and-developments)
· [[Chambers Data Protection 2026
China]{.underline}](https://practiceguides.chambers.com/practice-guides/data-protection-privacy-2026/china/trends-and-developments)
· [[LLYC on US
listings]{.underline}](https://llyc.global/en/ideas/navigating-the-new-era-of-u-s-listings-in-2026/)
· [[SRFC on Nasdaq $25m
floor]{.underline}](https://srfc.law/srfc-client-alert-sec-approves-stringent-new-nasdaq-listing-requirements-for-china-based-companies/)
· [[PwC HK IPO
2025]{.underline}](https://www.pwchk.com/en/press-room/press-releases/pr-050126.html)
· [[PwC HK IPO H1
2026]{.underline}](https://www.pwchk.com/en/press-room/press-releases/pr-020726.html)
· [[A&O Shearman APAC
M&A]{.underline}](https://www.aoshearman.com/en/insights/global-ma-insights/asia-pacific-dealmaking-remains-resilient-despite-energy-supply-vulnerabilities)
· [[Morgan Lewis on ODI
Regulation]{.underline}](https://www.morganlewis.com/pubs/2026/06/regulation-on-outbound-investment-why-chinese-counterparty-compliance-is-now-a-deal-risk)
· [[State Dept China travel
advisory]{.underline}](https://travel.state.gov/en/international-travel/travel-advisories/china.html)
· [[Reuters on Wells Fargo
release]{.underline}](https://www.reuters.com/business/finance/us-wins-release-wells-fargo-banker-barred-leaving-china-sources-say-2025-09-17/)
· [[Caixin on Manus
case]{.underline}](https://www.caixinglobal.com/2026-03-26/china-says-it-has-no-information-on-reported-exit-ban-involving-manus-executives-102427765.html)
· [[FDD on outbound investment
law]{.underline}](https://www.fdd.org/analysis/2026/06/03/china-introduces-new-outbound-investment-laws-to-prevent-u-s-decoupling/)

Choke Point 3 --- Structure

[[Norton Rose Fulbright on
VIE]{.underline}](https://www.nortonrosefulbright.com/en/knowledge/publications/60b9aba5/chinas-regulations-on-variable-interest-entity-structure-and-recent-developments)
· [[Caixin on VIE
cooling]{.underline}](https://www.caixinglobal.com/2026-04-21/caixin-explains-why-china-is-cooling-on-vie-structures-102436549.html)
· [[Reuters on HK IPO overseas
restrictions]{.underline}](https://www.reuters.com/sustainability/boards-policy-regulation/china-restricts-overseas-incorporated-firms-hong-kong-ipos-bloomberg-news-2026-03-17/)
· [[China Briefing negative
list]{.underline}](https://www.china-briefing.com/news/chinas-foreign-investment-negative-list-guide/)
· [[SCIO on negative
list]{.underline}](http://english.scio.gov.cn/m/pressroom/2024-02/08/content_116993753_11.htm)
· [[State Dept 2025 Investment Climate
China]{.underline}](https://www.state.gov/reports/2025-investment-climate-statements/china)
· [[Starbucks-Boyu
JV]{.underline}](https://investor.starbucks.com/news/financial-releases/news-details/2026/Starbucks-and-Boyu-Capital-Finalize-Joint-Venture-to-Accelerate-Long-Term-Growth-in-China/default.aspx)
· [[Morningstar on
Nexperia]{.underline}](https://www.morningstar.com/news/dow-jones/20251020875/nexperias-china-unit-tells-staff-to-ignore-instructions-from-dutch-headquarters)
· [[Reuters on Nexperia
dispute]{.underline}](https://www.reuters.com/business/autos-transportation/nexperias-chinese-parent-says-companys-dutch-unit-seeking-permanently-strip-its-2025-11-28/)
· [[Pillsbury on 2024 Company
Law]{.underline}](https://www.pillsburylaw.com/en/news-and-insights/china-amendments-company-law.html)
· [[PwC on dividend
WHT]{.underline}](https://taxsummaries.pwc.com/peoples-republic-of-china/corporate/withholding-taxes)
· [[Business Times on offshore
firms]{.underline}](https://www.businesstimes.com.sg/international/global/beijings-new-red-line-offshore-firms-cant-de-china)
· [[China Briefing on profit
repatriation]{.underline}](https://www.china-briefing.com/news/profit-repatriation-china-compliance-procedures/)
· [[DLA Piper on cash
pooling]{.underline}](https://www.dlapiper.com/en-us/insights/publications/2026/01/official-release-of-the-2025-cross-border-cash-pooling-regulations)
· [[Morrison Foerster on ODI
rules]{.underline}](https://www.mofo.com/resources/insights/260604-china-s-odi-rules-just-changed)
· [[ION Analytics on
red-chip]{.underline}](https://ionanalytics.com/insights/mergermarket/chinese-regulators-tighten-red-chip-ipos-control-to-close-longstanding-loopholes/)
· [[EU Chamber Position Paper
2025-2026]{.underline}](https://beijing.bencham.org/sites/default/files/2026-04/European%20Business%20in%20China%20Position%20Paper%202025-2026.pdf)

Choke Point 4 --- Payment rails

[[CIPS
statistics]{.underline}](https://www.cips.com.cn/kjjqgsyyingw/cipsfw/index.shtml)
· [[China Daily on CIPS
PvP]{.underline}](https://global.chinadaily.com.cn/a/202603/03/WS69a642bea310d6866eb3b485.html)
· [[Trade Treasury Payments on SWIFT June
2026]{.underline}](https://tradetreasurypayments.com/articles/usd-dominates-the-global-currency-and-trade-finance-market-swifts-global-currency-tracker-june-2026)
· [[IMF COFER Q1 2026
brief]{.underline}](https://data.imf.org/en/news/imf%20data%20brief%20july%201)
· [[BOC Cross-border RMB White
Paper]{.underline}](https://pic.bankofchina.com/bocappd/rareport/202606/P020260609657287428574.pdf)
· [OFAC FAQ 1147]{.underline} ·
[[OFAC teapot
alert]{.underline}](https://ofac.treasury.gov/media/935546/download?inline)
· [[Reuters on EU-China Russia
sanctions]{.underline}](https://www.reuters.com/business/aerospace-defense/china-adds-14-eu-entities-export-control-list-over-russia-related-sanctions-2026-07-24/)
· [[Gide on 20th
package]{.underline}](https://www.gide.com/en/news-insights/eu-update-20th-package-of-sanctions-in-reaction-to-russias-invasion-of-ukraine/)
· [[The Next Web on
EU-China]{.underline}](https://thenextweb.com/news/beijing-warns-eu-china-russia-sanctions)
· [[Reuters on Iran-oil
sanctions]{.underline}](https://www.reuters.com/world/americas/us-targets-irans-oil-transportation-infrastructure-with-sanctions-2026-04-15/)
· [[Reuters on Lithuania
banks]{.underline}](https://www.reuters.com/world/china/china-targets-two-eu-banks-retaliating-blocs-russia-sanctions-package-2025-08-13/)
· [[Yahoo Finance on Heihe
halt]{.underline}](https://finance.yahoo.com/news/key-chinese-bank-reportedly-halts-092655214.html)
· [[Al Jazeera on China blocking
order]{.underline}](https://www.aljazeera.com/economy/2026/5/3/china-blocks-us-sanctions-against-five-teapot-refineries)
· [[Reuters on 26 CBETS
institutions]{.underline}](https://www.reuters.com/world/asia-pacific/china-signs-up-26-financial-institutions-digital-yuan-cross-border-payment-2026-06-16/)
· [[ARP Digital on payment
time]{.underline}](https://www.arpdigital.io/en/resources/news-insights/gcc-to-china-payment-time)
· [[Great Handshake on 2026 payments
update]{.underline}](https://greathandshake.com/en/chinas-cross-border-b2b-payment-regulations-a-2026-update/)
· [[Reuters on repatriation
rule]{.underline}](https://www.reuters.com/world/asia-pacific/china-require-repatriation-funds-raised-overseas-under-new-rules-2025-12-26/)

Appendix --- Dimension anchor scales

The following anchor scales tell an operator how to convert observed
evidence into a 0.0--5.0 score for each of the 30 dimensions across the
four choke points. The scale is designed so that a 0 is defensibly
benign, a 2.5 is the point at which a rational operator starts building
mitigations, and a 5 is on its own disqualifying.

----------- ----------------------- ---------------------------------------
SCORE MEANING EXAMPLE PROFILE

0.0 -- Negligible exposure** The dimension does not apply to this
0.9** operator, or all indicators cleanly
test benign.

1.0 -- Named but managed** Exposure exists, is documented, and is
1.9** fully mitigated by an active control.
Rescore annually.

2.0 -- Material --- build Exposure is real and could plausibly
2.9** mitigations** bite. Current controls are partial.
Building alternatives is now the right
posture.

3.0 -- Live risk** The exposure has bitten similar
3.9** operators or would bite this one under
a plausible near-term scenario.
Programme-level response required.

4.0 -- Disqualifying on its The exposure, unmitigated, is enough to
5.0** own** close the engagement or produce a
regulator action. Exit or ring-fence.
----------- ----------------------- ---------------------------------------

The same 0.0--5.0 scale applies to every dimension in every choke point.
This intentional constraint keeps the rubric operator-usable rather than
academic. A dimension that cannot be scored on this scale is either
poorly defined or does not belong in the rubric.

Confidence tagging

Every dimension score should carry a confidence tag: High (multiple
named sources), Moderate (one named source), Indicative (reasoned
estimate consistent with cited evidence), or N/A (dimension structurally
does not apply and is renormalised out of the composite). A composite
with more than three Indicative dimensions in the same choke point is
not defendable and must be reworked before it enters the CSRS
calculation.

N/A treatment and renormalisation

A dimension is N/A only when it structurally cannot apply to the
operator --- for example, CP2 dimension 6 (offshore-migration legality)
for an operator that has never had an offshore migration structure in
scope. "Zero exposure" is not N/A; it is a 0. When a dimension is
marked N/A, its weight is removed and the remaining dimension weights
within the same choke point are multiplied by 100 / (100 minus the
removed weight) so they resum to 100%. Example: CP2 with dimension 6
(10% weight) removed --- the remaining seven dimensions have their
weights multiplied by 100/90 = 1.111. The choke-point composite is then
computed on the renormalised weights. Document any N/A calls in the
scoring worksheet with the structural reason.

End of Brief #04.