Launching in China? Clear These Three Filings First: ICP, PSB, and App Registration SOP

If you build indie products outside China, "launching" means buying a server, pointing a domain, and posting on Product Hunt. But the moment your users are in mainland China, three administrative gates stand in front of "launch": ICP filing, PSB (public security) filing, and App filing. Skip them and the mild outcome is your domain's DNS resolution getting cut off; the severe outcome is your app delisted from app stores plus a rectification notice.

This isn't scaremongering. Domestic data centers run a domain whitelist: domains without a filing number that resolve to mainland server IPs get blocked outright. And since MIIT launched App filing in 2023, mini-programs, quick apps, and native apps are all covered — distribution platforms are explicitly forbidden from listing unfiled apps.

This article is the "three-gate map" for Chinese-speaking vibe coders: whether you need to file, where to file, and what to do when you're rejected — all in one place. One disclaimer: filing policies do change; the MIIT (miit.gov.cn) and your access provider's official docs are the final authority. What follows is the SOP framework plus hands-on experience that still holds in 2026.

1. First, Understand: What Each Gate Controls

People conflate the three gates, but they're three different authorities with three different purposes:

	ICP Filing	PSB Filing	App Filing
Authority	MIIT → provincial Communications Administrations	Ministry of Public Security → local cyber-security units	MIIT (2023 rules)
Controls	Domain + server: prove "who you are" before serving websites domestically	Within 30 days of launching, report to police that "this site is live"	App (native/mini-program/quick app) organizer identity before distribution
Trigger	Server in mainland China + domain resolving to it for web services	After ICP approval	App/mini-program distributed or listed domestically
Where to file	Via your access provider (Alibaba Cloud / Tencent Cloud filing systems)	National PSB website security management platform (beian.gov.cn)	Via access/cloud provider or mini-program platform
Typical duration	Provider review 1–3 days + authority review 5–20 days	Online submission, ~3–10 business days	~5–20 business days
If you skip it	Domain blocked, site unreachable	Warning, ordered rectification	Stores refuse listing / delist published apps

The key insight: the three gates are sequential — ICP is the entry ticket; without it the other two can't start. PSB filing is a statutory duty after ICP; App filing is the separate mobile gate. So your schedule should be: start ICP the day you buy the server and domain — not "after the site is done."

/media/content-media/a56f3ccd-38fe-490f-a5d3-6edb6bc228d5/2026/10/f769f661-3902-4a48-b527-5c89a862de78.jpg

The screenshot above shows Alibaba Cloud's domain console — filing step zero is always "real-name verified domain + provider account." If your domain isn't real-name verified, you can't even enter the filing system.

2. "Do I Need to File?" Self-Check

Walk this table. Any "yes" means go through the process:

Scenario	File?	Which gate
Server with Alibaba/Tencent Cloud (mainland region), domain pointed at it for a website	Mandatory	ICP + PSB
Server overseas (Hong Kong / Singapore / US), domain resolving overseas	No ICP needed	But mainland access is slow, and most domestic SMS/payment APIs won't fully work — an architecture tradeoff, not a compliance shortcut
Site only on Vercel/Cloudflare overseas nodes, nothing resolving domestically	No ICP needed	Same as above; note some overseas CDNs' mainland stability has declined since 2025
Published a WeChat mini-program	Mandatory	Mini-program filing (via the WeChat Official Accounts Platform guide) + more if commercial
App listing on domestic Android stores / China App Store region	Mandatory	App filing (stores verify the filing number)
Site integrates WeChat Pay / Alipay	The payment APIs themselves require entity credentials	Individual filers basically can't get domestic payments — the real-world force pushing you toward enterprise filing
Pure static blog on GitHub Pages	No	But a custom domain + domestic CDN acceleration may require the accelerated domain to be filed

The most common misconception is "launch first, file when we're big." Reality: domestic cloud servers won't open ports 80/443 for unfiled domains — it's not "blocked when caught," it's "never allowed to run in the first place." "Launch first" is technically nonexistent on mainland infrastructure.

3. Gate One — ICP Filing: Materials & Process

Materials checklist (individual filing):

• ID card (both sides), a real-name-verified mobile number in your own name, email
• Domain certificate (download from your registrar); domain must be real-name verified
• Facial verification (via the provider's app — replaces the old photo-with-curtain ritual)
• Electronically signed "Website Filing Information Authenticity Verification Form"

Materials checklist (enterprise filing — everything above plus):

• Business license, legal representative's ID, legal rep's mobile number
• Website person-in-charge info (can be the legal rep; needs an authorization letter otherwise)
• For commercial operations: an ICP license (a "license" is a different thing from a "filing" — don't confuse them)

The four-step process: fill in the provider's system → provider pre-review (where most supplementary-material rejections happen) → authority review → filing number issued (verifiable at icp.miit.gov.cn). After receiving the number you must display it in the site footer with a link to MIIT's site — not displaying it counts as incomplete, and spot checks will flag you. Note the form's first step is "verify filing type" — individual vs enterprise, new vs amendment. Picking the wrong type is a top rejection cause, so decide before you start typing.

4. Gate Two — PSB Filing: The 30-Day Countdown

After ICP approval, you have 30 days to complete PSB filing at beian.gov.cn. This is the gate most people miss — they think ICP means "done," then get a call from cyber-security asking about the other filing.

The process is simpler than ICP: register → manage your organizer profile (link your ICP number) → new website application → fill in site info (launch date, service type, any pre-approvals needed) → submit for local review. Approval yields a PSB filing number, which also goes in the footer ("JingGongWangAnBei xxxxxxxxxxxx" style — the PSB filing number format), next to the ICP number.

The biggest difference from ICP: PSB filing cares more about site content — interactive sections (forums, comments, user-generated posts) get extra scrutiny, and "do you have a content moderation process" is a guaranteed question. If your vibe project has UGC (comments, community posts), prepare a "review-before-publish" explanation in advance, or expect supplementary-material requests.

5. Gate Three — App Filing: The Post-2023 World

In July 2023, MIIT issued the "Notice on Launching Mobile Internet Application Filing," changing the game: organizers providing internet information services via apps in China must complete filing; distribution platforms and device makers may not distribute or pre-install unfiled apps. Routine enforcement began April 2024.

Key things to internalize:

• Mini-programs count. WeChat, Alipay, and Douyin mini-programs all need filing, handled through each platform's filing guide (WeChat mini-programs file via the Official Accounts Platform). "Not on an app store" doesn't exempt you.
• Who files: the app organizer (individual or enterprise), submitted via access/cloud provider or distribution platform. Individuals can file, but commercial apps (with payments, e-commerce) effectively require an enterprise entity.
• Electronic signatures and commitment letters are standard materials, plus an installable/preview build for verification and a privacy-policy link (must be findable inside the app).

/media/content-media/a56f3ccd-38fe-490f-a5d3-6edb6bc228d5/2026/10/c32e2c3b-5b59-41f1-960b-2d4c70d65912.jpg

The diagram above walks through App filing in detail. Note the "application materials" and "review flow" columns — getting materials right the first time matters more than anything; each missing item means one rejection and one more round of queuing.

/media/content-media/a56f3ccd-38fe-490f-a5d3-6edb6bc228d5/2026/10/7355d3dc-fb97-4e3b-8f9d-e7fff134782b.jpg

And the cost of skipping it looks like the cartoon above: MIIT delisting notices. Note how often the cited reason is "infringing user rights" — missing privacy policies and over-collection of personal data are focal points in both filing review and routine spot checks. Filing is the entry ticket; compliance is the ongoing obligation.

6. Top Rejection Reasons & How to Fix Them

Rejection is normal; passing first try is luck. The most frequent causes and fixes:

Rejection reason	What it really means	Fix
Website name non-compliant	Used "China/Chinese/National" wording, pure English/numeric name, or a name implying commerce ("XX Mall" on an individual filing)	Individuals: "XX's personal blog" / "XX's tech space" format; enterprises: license name or brand term
Organizer ID non-compliant	Expired ID, blurry photo, not the actual person	Retake; make sure the ID is valid and facial verification is done by the person themselves
Content doesn't match filing nature	Individual filing but the site has checkout / paid membership	Two options: remove commercial features and refile, or switch to enterprise filing
Domain certificate issue	Domain not real-name verified, or certificate holder ≠ filing entity	Complete real-name verification at your registrar first; holder must match the filing entity
Pre-approval required	Covers news, publishing, pharmaceuticals, medical, education/training	Get the pre-approval document first; if you can't, cut the section — this is a red line, don't force it
Info doesn't match reality	Spot check found site content ≠ declared "service description"	Declare honestly; build the site to match the declaration before submitting
Phone number not in your name	Using a family member's / friend's number	Switch to your own real-name number — the authority really does call the emergency contact

Mindset for fixes: the rejection notice states the reason — fix it literally, don't overthink. Your provider's filing support line (both Alibaba and Tencent Cloud have phone support) is more patient than you'd expect — one call asking "what exactly does this rejection mean" usually clears it up. A solo developer's scarcest resource is time; one phone call saves three days.

7. Individual vs Enterprise Filing: Where the Red Lines Are

The most agonized choice for Chinese indie developers, settled in one table:

	Individual	Enterprise (sole proprietorship / company)
What you can run	Blogs, portfolios, tool sites (non-commercial)	Anything, including e-commerce and paid SaaS
Can you take payments	Basically no (WeChat Pay/Alipay require enterprise credentials)	Yes
Can you run ads / sponsorships	No (ads = commercial)	Yes
Paperwork burden	Low — ID + face scan	High — license + legal-rep info
Ongoing maintenance	Update filing promptly on info changes (new phone, new domain)	Same, plus license anomalies cascade into the filing

Three red lines — don't try to tough them out on an individual filing:

1. Any money movement means no individual filing. Memberships, paid downloads, tip payouts — any funds flowing to you can't be covered by an individual filing. Get caught and the mild outcome is filing cancellation (site goes dark); the severe one is unlicensed-operation treatment.
2. A sole proprietorship is the value king. Cheap to register (free or a few hundred RMB via agents in many places), can open a business bank account, can take payments, can file as an enterprise. For solo devs who haven't formed a company but want revenue, it's the standard answer.
3. Filing entity must match the money entity. Site filed under company A, money landing in company B's account — payment platforms and tax authorities will both come knocking. Decide "who files, who collects, who signs" as one consistent entity from day one.

8. Alibaba Cloud vs Tencent Cloud: Entry Points & Timelines

	Alibaba Cloud	Tencent Cloud
Entry	Console → ICP filing	Console → website/domain filing
Pre-review speed	Usually 1–2 days	Usually 1–3 days
Authority review	5–20 business days by province (Guangdong/Jiangsu faster, some slower)	Same (authority speed is provider-independent)
Facial verification	Alibaba Cloud app	Tencent Cloud assistant mini-program/app
App/mini-program filing	Submit via the filing system guide	Submit via the filing system guide

Which to pick depends on where your server lives — filing follows the access provider: server on Alibaba Cloud, file with Alibaba Cloud. If you later migrate servers to Tencent Cloud, you need an "additional provider" filing (adding the new access provider), or the original filing gets cancelled. A classic pitfall: migrating servers feels great until the filing cancellation hits.

9. The Real Cost of "Launch First, File Later"

Final accounting, for anyone still tempted to ask forgiveness instead of permission:

• Websites: mainland server + unfiled domain = ports 80/443 never open for you. Your "launch" technically doesn't exist. Workarounds (overseas CDN in front, odd ports) each cost you UX or stability — and can be cut at any time.
• Mini-programs: no filing, no production release — experience (trial) versions only. Your product is permanently "in beta."
• Apps: stores reject outright; a delisting notice on a published app damages the brand far more than two weeks of filing ever could.
• The time math: ICP takes 1–4 weeks end to end, PSB 1–2 weeks, App filing 1–3 weeks. Start filing the week you start coding and the numbers land around when the product is done — filing was never about "waiting"; it's about parallelizing.

So the correct schedule: start the filing process the day you buy the domain and server; code while the authority reviews; have App filing materials ready two weeks before store submission. Treat filing as a stage in your CI pipeline, not a TODO you remember the night before launch.

Once the three gates are cleared, your project truly "exists" in China. It's annoying — but it's the actual terrain for Chinese indie developers. Map it early, and you'll never be woken up at night by "the site won't load."