China Enforces Barriers Against Foreign AI and VSaaS Providers

While AI and VSaaS is the future of video surveillance, these are obstructed to foreign firms in China (the PRC), where authorities are tightening implementation of rules, as demonstrated by 2 recent examples of major PRC surveillance companies that IPVM found.

This is in stark contrast to the US and EU, where foreign companies including PRC Hikvision owned Ezviz operate with virtually no restrictions for cloud services. This gives the PRC a massive advantage in the field thanks to its vast protected home market.

In this note, we explore this and more, including:

• Strict Foreign Ownership Caps
• Enforcement Rises
• Face++ Gets ICP License After Operating For Years Without One
• Megvii Rival Also Gets ICP License in 2019
• Expert: 'Beijing Intensifies Its Control Over Network Sector'
• Prior "Uncertainties" Now Clear
• China's Booming AI Surveillance Market
• All Video Surveillance Will Become AI / VSaaS
• Why This Matters For Video Surveillance

Foreign Ownership Caps

The PRC has long required that online services, e.g., SaaS, offered in the PRC for a fee obtain a commercial ICP (Internet Content Provider) license, which is unobtainable by foreign-controlled entities; Face++/FaceID are clearly SaaS, as stated in Megvii's own IPO:

Under PRC regulations, value-added telecommunications/SaaS firms cannot be more than 50% foreign-owned, with narrow exceptions for e-commerce, call centers, and domestic multiparty telecommunications, e.g. British Telecom was recently allowed operate in the PRC for the first time.

Enforcing "Network Sovereignty"

Such PRC government regulations are common. The PRC is a strong proponent of "network sovereignty" (网络主权), the doctrine stating that each country has the right to control all networks (telecoms, internet, etc) within its own borders. This means the PRC not only mandates data is kept on servers in-country but also bars foreign SaaS firms and foreign cloud providers like AWS, as Amazon declared in 2017:

Chinese law forbids non-Chinese companies from owning or operating certain technology for the provision of cloud services

Megvii IPO Example

Top PRC facial recognition provider Megvii stated in its recent IPO filing that its critical Face++ & FaceID solutions in the PRC engage "in the operation of online channels to provide information processing services to customers for fees". Thus, the entity controlling these services is categorized as a value-added telecommunications service (VATS) and required to obtain an Internet Content Provider (ICP) license from the government:

Face++ Gets ICP License After Operating For Years Without One

While this restriction is longstanding and well-known, in its IPO, Megvii disclosed that it had not applied for an ICP license for Face++/FaceID's parent entity until only a few months ago, despite operating since 2015. Megvii had an "interview" with the Beijing Communications Administration (BCA) officials about the topic in June 2019.

In the IPO, Megvii gave a range of reasons for not having obtained the license: that the entity's operations were conducted "on a trial basis before 2018", that their scale was "relatively small", that its solutions were "innovative" and officials had "uncertainties" about how to categorize them, and that there was no "material negative social impact":

However, according to its IPO, Megvii’s revenue from its SaaS personal IoT business was $19m in 2017 and $24m in 2018, certainly not small. IPVM could find no national PRC regulations permitting such operations without an ICP license as long as they were small-scale or on a trial basis - indeed, operating without this license runs the risk of being shut down.

The entity controlling Face++ ended up getting an ICP license less than a month before Megvii's IPO filing on August 25. Because Megvii is a Cayman Islands (and thus technically foreign) firm, equity had to be transferred from the Face++ entity to Megvii's PRC citizen co-founders to allow this. (This is not uncommon in the PRC, for example, Alibaba is also registered as a Cayman company, but clearly is not viewed as 'foreign'.)

Yitu Also Gets ICP License in 2019

Another top PRC facial recognition provider, Yitu, has also recently obtained a commercial ICP license despite having operated for years, according to the PRC Ministry of Industry and Information Technology (MIIT):

Yitu's license number (2019-0650) indicates that, like Megvii, it obtained the license in 2019 (the rest of the numbers have no relation to month/day). Yitu was founded in 2012. Yitu did not respond to IPVM's request for comment.

IPVM could not find the two other PRC surveillance giants Sensetime and Cloudwalk in the MIIT's database, which could be a limitation of the specific database search interface.

Expert: 'Beijing Intensifies Its Control Over Network Sector'

PRC authorities have been tightening their implementation of the longstanding ICP rules since 2018, according to Steve Dickinson, an attorney at international law firm Harris Bricken with extensive China experience.

Avoiding the commercial ICP license requirement means no foreign ownership caps and no costly/time-consuming application process. Dickinson said that prior to 2018, some SaaS firms operated in the PRC without this license, with local regulators turning a blind eye "as long as they got an ordinary registration license" in order to attract business. (Dickinson said it's also possible some local regulations explicitly permitted such operations.) But this has all changed, and now, Beijing is cracking down:

We are being informed that this enforcement of the SaaS/ICP law as written will become more aggressive over time in China: more intense, not less. Looking the other way is becoming impossible for the local regulators in China as Beijing intensifies its control over the network sector.

IPVM asked Megvii whether Face++/FaceID's parent underwent a similar process. Megvii declined to comment for this article.

China's Booming AI Surveillance Market

China's AI surveillance market is massive and growing fast - this market is currently $2 billion and expected to grow to almost $19 billion by 2023 as shown in Megvii's IPO:

While exact projections are hard to make, undoubtedly cloud-based AI is fast growing and a core to where video surveillance technology is moving in the 2020s.

All Video Surveillance Will Become AI / VSaaS

Over the next few years, virtually all video surveillance will have cloud and AI components, something we examined in 'CCTV' Is the Past, Cloud Video Surveillance Is the Future. The advantages of having AI and cloud applied to video surveillance are too great to avoid.

Why This Matters for Foreign Video Surveillance

But so long as the PRC enforces such restrictions against foreign providers, virtually all foreign companies will be undermined or blocked inside of the world's largest video surveillance market.

The longstanding ICP license requirement and the fact that implementation is tightening makes it harder than ever for foreign providers to compete in the PRC. Instead, they must operate through a PRC partner, which adds a host of risks and added costs, including IP theft, splitting profits, and the difficult process of finding a good local partner, to begin with.

This adds to existing challenges of doing business in the PRC, as the PRC has long informally discriminated against foreign firms in its massive government-funded surveillance projects: Megvii itself stated in its IPO that "foreign-owned entities are prohibited or disadvantaged in the relevant City IoT project bidding process in practice", while PRC officials have labeled foreign surveillance equipment "risks to national security" since 2012.

Conclusion: PRC Massive Advantage In AI Video Surveillance

Thanks largely to the PRC government mandating video surveillance across the country, the PRC's AI surveillance market is massive. With the ICP license requirement and tightened implementation, the PRC thus has a massive advantage in the global AI / VSaaS market in a similar way to traditional video surveillance manufacturing.