A client previously came to us for advice: they wanted to build an AI relay platform for overseas markets, with an offshore entity, offshore servers, and services provided only to overseas customers, but with core team members based mainly in China. They asked whether there would be any business red lines or legal risks.
In fact, within the industry, the mainstream architecture is exactly this: the entity is registered offshore, the API routing gateway is deployed overseas, and unified multi-model API access is provided only to overseas users, positioning itself as a MaaS aggregation platform; core team members rely on remote login to overseas backends for day-to-day operations and maintenance, and high-privilege operations such as key management, routing and scheduling, backend risk management, log auditing, and account maintenance are all controlled from within China.
Today we will break down the red lines and legal risks behind this mainstream architecture.
I. "AI relay station" is a broad label; in the industry there are at least three business models
(1) Account pool resale.
Subscription accounts of overseas large models are registered or acquired in bulk, and the quota of one account is split and resold to a large number of users. A monthly subscription account costing about two hundred US dollars is split into metered API retail, and the profit is the spread between the subscription model and pay-per-use.
There are two risks. First, the manner in which the accounts are obtained: if accounts are obtained illegally through SMS verification bypass, identity impersonation, fraudulent payment, or similar means, this falls within the scope of criminal law assessment. Second, even if the accounts are obtained lawfully, splitting and reselling subscription account access rights without the service provider's permission violates the platform service agreement and creates risks of mass account bans, loss of balances, and civil claims for breach of contract.
(2) Official API resale, referred to as official relay.
The platform itself holds upstream API keys, tops up and stockpiles quota, and sells it externally in split quantities, earning the Token spread. Overseas OpenRouter is often used for comparison, but OpenRouter has distribution agreements with various vendors and constitutes licensed MaaS distribution, whereas most official relays in the industry have not obtained authorization.
In addition to official relay, there is the bring-your-own-key gateway, also known as BYOK: the API key is provided by the user, the platform does not stockpile quota and only charges a tool service fee. Because it does not involve resale, the risk is lighter than official relay, but it remains subject to the vendor's terms. Vendor agreements generally provide that keys are limited to the holder's own business use and may not be entrusted to third-party gateways or have calling channels opened to other external entities, even if the Tokens consumed are within the holder's own account.
(3) Web-version reverse engineering.
Without using official APIs, the platform reverse-engineers the web-version protocol, forges device fingerprints, bypasses authentication and risk management, and directly captures model capabilities for external encapsulation.
The acts of forging fingerprints, breaching platform security safeguards, and bypassing authentication themselves fall within the scope of criminal law assessment. However, private testing without externally exposing API invocation capabilities and stably offering paid API access to external parties have completely different legal consequences. Where invocation is provided to external parties, this generally involves the crime of illegally obtaining computer information system data, or the crime of providing programs or tools for intruding into or illegally controlling computer information systems.
II. Legal Risks Under Different Business Models
Regardless of the model, any resale—whether the upstream source is self-purchased quota or an account pool—will violate the overseas vendor's terms of service and may result in rate limiting, account suspension, or supply cutoff. At present, however, this remains only a civil matter and does not yet constitute a crime.
Official API resale and BYOK supply originate from official interfaces, so criminal liability on the supply side is largely out of the question; the risk points are mainly concentrated in downstream uses, data retention, and settlement flows back.
Computer-related crimes.This is the primary risk arising from the supply source under the account pool and reverse-engineering models. Article 285, Paragraph 2 of the Criminal Law addresses illegally obtaining computer information system data, and the relevant judicial interpretations expressly provide that obtaining more than 500 sets of general identity authentication information, or illegal gains of more than RMB 5,000, constitutes serious circumstances, punishable by fixed-term imprisonment of not more than three years; where the quantity of information obtained reaches more than five times the threshold for serious circumstances, or economic losses of more than RMB 50,000 are caused, this constitutes especially serious circumstances, punishable by fixed-term imprisonment of not less than three years but not more than seven years. The accounts illegally obtained in an account pool are precisely identity authentication information.
If reverse-engineering scripts or packaged cracking interfaces are provided to external parties, this will involve Article 285, Paragraph 3—the crime of providing programs or tools for intruding into or illegally controlling computer information systems. Where a program has the function of cracking or bypassing system security protection mechanisms such as platform API signatures and device fingerprints, providing or selling such program or interface to external parties without authorization may constitute this crime.
Crime of concealing or disguising criminal proceeds.Many accounts in account pool channels originate from credit card fraud; purchasing low-priced keys of unknown origin and reselling them may mean the upstream is linked to a chain for disposing of stolen goods.
Fraud.Where a service is priced as a high-end model but actually invokes a low-cost model, if the price itself is also low and the consideration roughly matches the actual service, this falls within the scope of false advertising and civil fraud; if official prices are charged while the model is secretly substituted and the consideration is seriously disproportionate, this may enter the scope of the crime of fraud.
Crime of assisting information network criminal activities.If a party knows that an API interface is used downstream to generate fraud scripts, gambling referral content, or obscene content, yet still provides forwarding and technical support, it may satisfy the constituent elements of that offense.
The crime of infringing on citizens' personal information.Without valid user consent, packaging and selling retained downstream conversation logs, or providing or exchanging them free of charge to third parties for model training or data annotation; collecting identity identifiers such as users' mobile phone numbers, email addresses, device fingerprints, and payment information and transferring them externally; pushing conversation records containing personal information to third parties such as risk management and data analytics by default; undertaking OCR, medical consultation, and identity verification call scenarios, retaining highly sensitive materials such as identity documents, medical records, and credit reports and then leaking them, and so on.
III. Offshore structures do not bar criminal jurisdiction
"Serving only overseas users"This promotional statement requires supporting evidence.
Whether access from domestic IP addresses is restricted, whether domestic payment channels are opened, whether Chinese-language interfaces, Chinese-language customer service, and promotional activities directed at the domestic market are configured, and whether paid orders from domestic users are actually accepted must all be examined; a further distinction must be drawn between active solicitation and mere technical accessibility, as a domestic user occasionally accessing via a self-set-up VPN is entirely different from a platform actively acquiring customers in the domestic market.
Even if relevant evidence can support that the service genuinely serves only overseas users, an offshore structure cannot resolve criminal jurisdiction.
Under Article 6 of the Criminal Law on territorial jurisdiction, if either the act or the result of a crime occurs within the territory of the People's Republic of China, the crime is deemed to have been committed within the territory of the People's Republic of China; where code is written and iterated domestically, servers are remotely logged into and maintained by a domestic team, account pool scheduling and renewals are operated domestically, and business decisions and fund allocation are made domestically, any one of these four actions is sufficient to establish that the place of conduct is domestic.
Where core team members are Chinese citizens, jurisdiction under Article 7 of the Criminal Law on personal jurisdiction is likewise established; even if the entire team relocates overseas, offenses with a statutory maximum penalty of three years or more shall still be prosecuted.
IV. Business self-inspection path
An offshore entity and overseas data centers cannot isolate the entity from the constraints of overseas vendors' terms of service, nor can they eliminate the legal risks arising from operations by domestic personnel, data flows, and fund chains.
Practitioners may conduct self-assessments across five dimensions: source of supply, scope of services, data permissions, settlement, and downstream risk management.
(1) Source-of-supply chain management.
Eliminate web-scraped accounts, account-pool accounts of unknown origin, and API keys of unclear provenance; under the official-transfer model, the upstream invocation credentials held by the platform should come from the manufacturer's legitimate contracted channels; under the BYOK (bring-your-own-key) model, the platform must not procure keys on behalf of downstream users, and the gateway backend is strictly prohibited from mixing in reverse-engineered interfaces or account-pool-type gray-market sources; in the procurement process, retain complete contracting, top-up, and procurement records to the extent possible, and remain highly vigilant regarding accounts and keys priced significantly below the official publicly listed price.(2) Document the factual evidence that services are provided "only to overseas users."
Do not rely solely on page-level marketing; implement practicable technical and institutional measures, including access-layer IP restrictions, closure of domestic payment channels, cessation of customer-acquisition promotion targeting domestic communities and Chinese-language channels, and retention of access policies and risk-management logs, so as to fix relevant evidence of the scope of service recipients to the extent possible.
(3) Tighten log and data permissions.
A gateway can inherently capture the full content of downstream requests, and such conversation content is highly likely to contain citizens' personal information. Accordingly, adhere to the principle of minimum necessity for logs, retain only fields necessary for billing and troubleshooting, and set automatic expiration and deletion of logs; exporting, sharing, or selling conversation logs without user consent is prohibited; strictly manage the permissions of domestic operations personnel, implement the principle of least privilege, limit the scope of personnel who can download logs in bulk, and reduce opportunities for sensitive data to flow back to domestic devices.
(4) Isolate the fund-settlement chain.
To the extent possible, maintain a complete overseas collection loop for overseas entities and reduce the repatriation of funds to the mainland through underground banks, offsetting transactions, virtual assets, or other means; where overseas collections need to be repatriated to the mainland, use formal foreign-exchange settlement channels, avoid collection-and-payment on behalf of others, multi-layer fund circulation, and other operations that circumvent foreign-exchange regulation, and guard against criminal risks relating to illegal foreign-exchange trading.(5) Conduct risk-management audits of downstream invocations.Perform basic access verification for downstream users, and add alerting and rate-limiting mechanisms for high-frequency and highly sensitive invocation behavior; upon discovering that downstream parties are using the interface to commit fraud or generate obscene, gambling, or other unlawful content, intercept and handle the matter promptly and retain records.
The above measures are merely risk-mitigation tools that can reduce the probability of risk occurrence and increase the room for defense after a case arises.
"Disclaimer: The content of this article is provided solely for general legal education and does not constitute any legal advice or legal consultation. Reading or forwarding this article does not create any attorney-client relationship. Individual legal issues are highly fact-specific; you are advised to obtain professional legal advice from a licensed attorney regarding your specific circumstances."
