Compliance Dilemmas: How Nordic Multinationals Cope with a Complex Compliance Environment in China

Nordic multinational companies (MNCs) operating in the People’s Republic of China (PRC) face a structurally complex and increasingly fragmented compliance environment. Companies need to consider the overlapping and sometimes conflicting obligations that arise from Home Country (EU and national), Host Country (PRC) and Third Country (notably US) regulatory regimes, as well as internal Codes of Conduct. “Compliance dilemmas” have become a routine feature of operations rather than an exception. As a result, companies bear significant extra costs and shoulder risks that can have a severe impact on their ability to do business.

Compliance dilemmas are widespread but uneven in terms of their nature, severity of risk and degree of business impact. They vary by sector, supply chain complexity and organisational structure. While some dilemmas, such as sanctions screening, are already highly institutionalised within MNCs, others are ad hoc, context-specific and difficult to systematise.

The prevailing international environment increases the risk posed by compliance dilemmas, as cross-border trade and investment are increasingly seen as potential threats to national security. Data and security legislation – be it Home Country, Host Country or Third Country – is a central and evolving source of compliance dilemmas, and sometimes causes “head-on” norm collisions (referred to as Pure Compliance Dilemmas in this study).

For example, a Nordic MNC that declines business with a sanctioned PRC customer may be charged with an offence under PRC Blocking Rules and related legislation. Nordic MNCs have so far assumed that the enforcement risk in this regard is relatively low, but this assumption will need to be continually assessed and potentially recalibrated as political tensions between the PRC and the rest of the world evolve.  

Compliance dilemmas are a “design feature” of PRC legislation, as seen in the ambiguity inherent for example in laws covering foreign trade, supply chain scrutiny and data. PRC legislation relies on vague or evolving definitions, creating an operating environment that is characterised by extensive grey zones. The PRC authorities have wide discretion when enforcing these laws, which only amplifies uncertainty on the part of companies.

Supply chain compliance is a core pressure point, where extensive foreign due diligence requirements meet practical and legal limitations in the PRC. Companies report that difficulties in verifying supplier information, an overreliance on self-certification and frequent constraints on site access contribute to their compliance challenges. Transparency at a level envisaged by emerging regulations, and often also expected by customers, might be difficult or even impossible to accomplish in practice.

Nordic MNCs have developed pragmatic coping mechanisms, such as:

• heavy investment in compliance programmes and experienced in-country teams to navigate nebulous and rapidly changing compliance demands;
• restructuring and local adaptation of operations, which include “China-for-China” models for data, IT systems and supply chains;
• selective use of legal and operational workarounds to avoid direct conflicts (e.g. commercially framed decisions instead of explicit references to sanctions);
• informal engagement with local authorities in the PRC to maintain operational continuity; and
• limited but targeted policy engagement through business networks.

Implementation of coping mechanisms relies on risk-based judgment by senior officers, and requires pragmatism and adaptability to a changing landscape. This means that companies face difficult decisions that are frequently made in-country, sometimes with limited headquarters oversight, but potentially with global risk management impact. Thus, the strength of relationships and communication channels between in-country staff and HQ are instrumental. Global risk oversight increasingly relies on tailored local implementation in a PRC context, which increases vulnerability to geopolitical tensions between countries.

Despite the extensive requirements imposed by legislation, Nordic MNCs often take on even more stringent operating standards through their own codes of conduct. This adds an additional layer of complexity to questions of labour rights, advocacy work and supply chain or customer scrutiny, but can at the same time be an asset when designing compliance dilemma coping mechanisms. Companies may increasingly point to a code of conduct as the gold standard to which they hold their behaviour.

Compliance work in the PRC should be perceived as a “craft” that requires judgment, relationships and experience, in addition to knowledge of formal rules. Honing this craft could become a competitive edge for Nordic MNCs as geopolitics and supply chain challenges increasingly become normal parts of international business. However, this will require a sober assessment of an extraordinarily complex compliance landscape combined with continued investment in research and training. Nordic MNCs could benefit from their traditionally close and constructive relationships with Home Country governments and academia to make further progress in this regard.

In order to support Nordic industry as it adapts to the compliance dilemmas encountered in the PRC, and to reinforce the coping mechanisms adopted by individual Nordic MNCs in their PRC operations, this study recommends that stakeholders:

• Adjust Nordic MNC corporate risk models as supply chains are increasingly viewed through a national and economic security lens in the PRC, Europe and beyond. A risk-based approach that assumes lax enforcement by PRC government agencies appears increasingly unsustainable.
• Develop a better understanding of hidden compliance risks in relationships between Nordic MNC HQs and in-country operations, for example in relation to global enterprise management software and the siloing of data.
• Renew and intensify dialogue between government and business to unpack the multifaceted challenges of geopolitically impacted corporate compliance. Consider ways to measure returns on investments made in compliance programmes.
• As China-for-China strategies are now being introduced, in part due to the increasing burden of externally imposed compliance dilemmas, consider how future regulation could to a greater extent rely on progressive initiatives in areas such as labour rights and environmental protection that are already under way through the codes of conduct of many Nordic MNCs..
• Map shortcomings in the compliance capabilities of SMEs to avoid disproportionate accumulation of risk among those businesses least able to cope with the growing compliance burden.

About the authors

This report is a joint collaboration between the Swedish National China Centre and the China Office of Finnish Industries.

About the China Office of Finnish Industries

The China Office of Finnish Industries Oy (CoFI) is a nonprofit company established to provide independent analysis on the People’s Republic of China (PRC) to 25 Finnish multinationals with a strategic interest in the PRC. CoFI is a private limited liability company based in Helsinki, Finland, and funded by its shareholders.