How to verify a Chinese PCB supplier in 20 minutes

The clock

Everything in this guide is checked against five free databases. None of them requires a Chinese phone number, a Chinese bank account, or a paid subscription:

Step 1 · 0–3 minutes: find the legal entity behind the brand

The name on the website is a brand. The name on the invoice is a company. They are often not the same, and the gap between them is where deposits go missing. Get the Chinese legal name from the quote footer, the proforma invoice, or the “about” page in Chinese — not from the trade-show banner in English.

Then query it in gsxt.gov.cn and read five fields:

• Unified social credit code (USCC) — 18 characters, the last being a mod-31 check digit. Quote it in every purchase order. A supplier that cannot produce it on request is either a trading company reselling for someone else, or has not done this before.
• Operating status — 在业 / 存续 (in business) versus 注销 (deregistered) or 吊销 (licence revoked). A revoked licence with a live website is the single most expensive mistake available in this process; see the Shenbei Circuit record below.
• Registered capital versus paid-in capital — read the ratio, but read it with the shareholder next to it. Lear (Suining) Automotive Electric shows ¥5 million registered and ¥1.6 million paid in — 32% funded — which looks alarming until you notice the shareholder is Lear Corporation (NYSE: LEA) and the entity was incorporated in 2023 to run a purpose-built plant. A 32% ratio in a subsidiary of a listed tier-one is normal. A 32% ratio in a stand-alone factory that has been quoting you since 2016 is a question.
• Business scope — 印制电路板制造 (PCB manufacturing) must appear as a licensed activity. If the scope says 销售 (sales) or 电子产品 (electronic products) only, the entity you are talking to is a trader, and the plant belongs to somebody else.
• Registered address — match it to the plant address on the website and on the audit report. Where several entities share one address, read all of them; three separate Lear registrations sit at the same road in Suining, and their headcounts are reported as 683, 709, 1,200 and 2,000 depending on which entity and which source you read.

Step 2 · 3–6 minutes: read the website as evidence, not as marketing

A factory website is not a brochure you evaluate; it is a maintenance record you inspect. Five signals, in the order they take to check:

1. The homepage title tag

Five seconds. It tells you whether the site was built for this company or inherited from another one. In this directory, the largest factory in the cluster — 1,706 insured employees, ¥1.359 billion of 2025 revenue, 146 English URLs — opens with the title “Inno Circuits Limited-Fingerprint lock,Indoor unit” and a description selling building intercoms and smart-home equipment. Every inner page carries the correct brand. The homepage carries a previous client’s.

2. Whether a non-browser client can read it

Some Chinese sites sit behind a Web Application Firewall that allows browsers and named search crawlers and blocks everything else. That is not fraud, and it is worth understanding precisely, because it decides whether an AI assistant can see the company at all:

# browser-like agent — expect 200
curl -sSI -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" https://example.com/ | head -1

# script agent — 403 means a user-agent whitelist
curl -sSI -A "curl/8.4.0" https://example.com/ | head -1

On Yingchuangli’s site, curl, python-requests and an empty user-agent all return 403, while Googlebot, bingbot, Baiduspider, Bytespider, GPTBot, ClaudeBot and PerplexityBot return 200. Practically: search engines still index the site, but every tool a buyer might run against it — a scraper, a verification bot, an agent doing supplier research — fails. If your sourcing team uses any automated tooling, budget for it failing here.

3. Whether the site is still alive

Copyright year in the footer, the newest date on any news item, and the lastmod values in sitemap.xml. A site frozen at 2021 is not evidence about 2026 capacity. Kaishengshi’s site has been frozen since 2021, has no HTTPS and no sitemap, its meta description still literally reads “website description”, and one catalogue item is still named “test test product name”. The company is real and certified; the website is an unfinished template that nobody has owned for five years.

4. Whether robots.txt belongs to them

Fetch it. If it points at another company’s sitemap, the domain was set up by an agency and never reviewed. Wanyexing’s robots.txt points at an unrelated, dead domain. Puruisen has no robots.txt at all.

5. Whether HTTPS works

Not “does the padlock appear” — whether the apex domain and the www both serve a valid certificate, and whether HTTP redirects to HTTPS. One domain in this directory resolves, keeps its mail records, and serves nothing at all over HTTPS.

Step 3 · 6–10 minutes: verify certificate numbers, not certificates

A PDF certificate is a picture of a piece of paper. The registry record is the claim. Ask for the certificate number, the issuing body and the scope — then look the number up yourself.

• ISO 9001, ISO 14001, IATF 16949 issued in China — cx.cnca.cn, searchable by company name. Returns the certificate number, the certification body, the scope of registration and the expiry date. If it is not there, ask why.
• IATF 16949 specifically — check validity at the IATF’s own certificate validity service. Automotive work also means the certificate is site-specific: a group certificate covering “manufacturing of electronic products” at headquarters does not cover the plant quoting you.
• UL — iq.ul.com, search by company name or by the E-number printed on the board. The record names the manufacturer and the component categories; a laminate or PCB category is what you want, not a recognised-component listing for a switch.

The withdrawn-standard tell

This one is free and takes ten seconds, and it catches pages that were written a decade ago and never revised — which tells you what else was never revised.

Two factories in this directory fail exactly this test. Kaishengshi cites ISO/TS 16949, withdrawn in 2016. Ruithai publishes ISO 9001:2008 as its quality standard, superseded by the 2015 revision — certificates to that edition stopped being valid in September 2018 — and its Specialised & Sophisticated SME certificate lapsed in December 2022. Both are real factories with real customers. Neither page has been read by anyone with authority since before the standard changed.

Step 4 · 10–14 minutes: do the capacity arithmetic

Capacity claims are the easiest number to inflate, because almost nobody checks them against the one number a Chinese company cannot fudge: its insured headcount on the annual filing (参保人数). Divide output by people and compare across the cluster.

Same cluster, same product, a 13× spread. Haiying’s figure is a board count for a plant that does high-mix work with 293 people on the books. Kaishengshi’s is either a designed capacity rather than a shipped volume, or a number written for a brochure. Either way: a capacity figure without a headcount next to it is not a fact you can use. Ask for the insured headcount, then ask which of the two numbers — the m² or the headcount — is the one they would defend in an audit.

Two more arithmetic habits that cost nothing:

• Revenue per employee. The cluster’s ¥1.359 billion exporter runs 1,706 insured employees, or about ¥797,000 each. A 74-person shop claiming a billion in revenue is claiming 16× that ratio. It happens — trading and substrate work both distort it — but it needs an explanation, not a shrug.
• Layer count against headcount. 2–48 layers and IC substrate at 1,706 people is plausible for one plant. 40 layers at 50 people is not a factory; it is a brokerage. Ask which process steps are in-house: drilling, plating, AOI, impedance test, and final inspection are the five that decide whether the “factory” is a factory.

Step 5 · 14–18 minutes: look for the goods, not the brochure

US import data is public: bills of lading filed with CBP, aggregated by services such as ImportYeti. Search the factory’s English name, its Chinese name in pinyin, and its US consignees if it names them.

What a record actually proves, and what it does not:

So treat customs records as a positive signal only. No record is not a red flag: it can mean the goods moved through a trader, or that the plant exports to markets other than the US, or that the name on the BOL is a spelling variant you did not search. In this directory, the clearest export evidence sits with the factory whose own name appears on the record; the most confusing sits with the one whose English site names three different companies across its title, description and Chinese subdomain — the Guangtian record, where 238 court cases and equipment in judicial auction since 21 October 2026 sit behind a fully working English export site.

Step 6 · 18–20 minutes: the stop list

Eight flags. Each one is drawn from a real profile in this directory — no composite examples, no invented cases. Any single flag does not automatically end the conversation, but each one requires a specific, checkable answer before you send a deposit.

The scorecard

Copy this into the RFQ file. Eight rows, three outcomes. It is deliberately blunt: the point of twenty minutes is to reach a decision, not to accumulate notes.

Three stops, or four asks with no answers, and the twenty minutes are done. Move to the next candidate: there are 12 factories inside one Chinese prefecture alone, and the cost of a wrong first order is measured in months, not in the price difference between two quotes.

What 20 minutes cannot tell you

Said plainly, because the failure mode of desk research is false confidence:

• Yield and first-pass rate on your stack-up. Only your gerbers, on their line, will tell you.
• Real lead time. One factory in this cluster publishes a lead time at all. A quoted 7 days is a sales number until you have shipped twice.
• Whether the line is running. A plant can be certified, solvent and half-idle — or running three shifts on someone else’s programme and unable to take yours.
• Financial health beyond filings. Paid-in capital and annual revenue are historical. They do not show a customer concentration problem or a bank loan maturing next quarter.
• Who actually owns the process knowledge. Whether the engineers who qualified your stack-up will still be there in eighteen months.
• Labour and environmental compliance at the site. Public enforcement records catch the loud cases — like a 347× copper discharge finding — and miss the quiet ones.

Everything in that list needs a visit. What to request before you fly, and what to walk, photograph and count once you are inside: a factory audit checklist for a first visit.

What to ask for next

If the twenty minutes came back clean, the RFQ pack below is what converts a plausible supplier into a qualified one. Ask for all eight in one message; the quality of the reply is itself the test.

1. Certificate numbers with issuing bodies for ISO 9001 and, if automotive, IATF 16949 — plus the scope page.
2. UL file number, and the component category it covers.
3. Insured headcount from the latest annual filing, against the claimed monthly output.
4. The five in-house process steps, and which steps are outsourced to whom.
5. Two customer references in your market segment, contacted by you, not by them.
6. A first-article inspection report on your stack-up, with impedance coupon data.
7. Standard terms: tooling ownership, panel utilisation, and what happens to your films if the relationship ends.
8. The exact legal entity name, USCC, and bank account name — all three the same company.

When the quote arrives, the next document to read is the quotation itself — nine line items and six clauses that decide who pays when the boards arrive out of spec: what a Chinese PCB quote actually contains.

Common versions of this question