Token relay stations: easy to “go global,” hard to “go into the sea.”
In May 2026, a minor but notable piece of gossip emerged in the AI world.
An operator of an AI relay station in Shanghai, who goes by the online name “Guapi,” posted a shutdown statement in a technical community. According to his own account and related retellings, because some of the API sources were suspected of having been obtained through illegal technical means, he was detained for 37 days and subsequently placed under release on bail pending trial. Whether he will later be prosecuted, how he will be convicted and sentenced, and whether restitution, return of illicit gains, or fines will be involved should still be determined by the final handling of the judicial authorities.
Image source: screenshot of the party’s shutdown statement
What is even more painful is that he said in the statement that this business did not make money, and that he was unable to compensate users for their recharge payments.
Once this incident came to light, many relay station operators began shutting down their stations overnight. In the past, everyone thought this was a small business with “low cost, light assets, and profit from price differences.” Now they suddenly realize:This vehicle may not be heading toward financial freedom, but toward the police station.
So-called AI relay stations, plainly put, take interfaces from overseas large models such as GPT, Claude, and Gemini, wrap them in a Chinese-language interface, build a Token recharge system, and then sell them to domestic users by membership, by usage, or by API.
Users find it convenient, station operators find it profitable, agents find it gives them a channel, and communities feel they have found a bargain.
But the problem is that compliance never looks at whether the commercial packaging is clever.
What compliance really asks is: whose things does this business sell, through what methods, bypassing what rules, and to whom.
Applied to AI relay stations, the answer is not pretty: selling overseas large-model services that have not completed domestic compliance, after bypassing regulation through packaging, to the domestic public.
This is not Tokens going overseas. This is Tokens coming ashore.
To put it more bluntly, this is smuggling overseas models back in to sell them.
A boundary must first be drawn here: this is not to say that an individual's use of overseas AI tools is inherently unlawful, nor that all enterprises are barred from calling overseas APIs. What the law actually examines is whether the platform, in its own name, continuously provides generative AI capabilities to unspecified users within the territory for a fee; whether it has obtained the necessary authorization, qualifications and filings; whether it transfers user input and personal information overseas; and whether it has performed security assessments, notice-and-consent, content governance and data protection obligations.
If none of these questions has an answer, then this is not simply a "technical relay"; it is the complete hollowing-out of the entire set of compliance responsibilities that a service provider ought to bear.
I. Why did this business once look so attractive?
Do not rush to condemn it as unlawful.
Any gray-market business can get off the ground, usually not because no one understands the law, but because it genuinely hits a real demand.
Domestic users want to use overseas models, but there are several thresholds: accounts are hard to register, payment is inconvenient, APIs are hard to connect, English documentation is hard to read, and enterprises do not want to bother with too much technical configuration internally.
Relay stations have swallowed all these troubles.
Users only need to open a webpage, top up some money and buy some Tokens, and they can use various overseas models. For ordinary users, it is cheaper, handier and more like a "localized product" than the official route.
What does the site operator earn?
It earns on information asymmetry, on interface price spreads, on account pools and on traffic aggregation.
The most attractive aspect of this business is that it appears asset-light: no model training, no GPU purchases, no burning cash to build large models, and no model iteration costs. As long as there is an API, a server, a payment gateway, and a traffic channel, the business can open.
That is why it was once very popular. But asset-light does not mean risk-light.
In many cases, the risks are simply hidden.Hidden in the source of the API, hidden in user data, hidden in the payment collection path, and hidden in that most dangerous statement: we are only doing relay.
II. The statement "only doing relay" cannot save the platform
The most common self-positioning of an AI relay station is as a technical service provider.
The platform does not produce models; it only relays APIs. The platform does not generate content; it only forwards requests. The platform does not provide large-model services to the public; it only helps users call overseas tools more conveniently.
This account sounds clever, but it does not withstand scrutiny.
-
Does the platform collect money from users?
-
Does the platform open accounts for users?
-
Does the platform charge by Token, membership, or call volume?
-
Does the platform package overseas models into its own product interface?
-
Is the platform open to unspecified users within China?
As long as the answer to all these questions is "yes," such a platform can hardly continue to claim that it is merely an innocent router.
This already amounts to organizing a generative AI service directed at users within China.
Under the framework of the Interim Measures for the Administration of Generative Artificial Intelligence Services, any entity that uses generative artificial intelligence technology to provide text, image, audio, video and other content-generation services to the public within China falls within the scope of generative AI service regulation; and organizations or individuals that "provide services by providing programmable interfaces or other means" may also be identified as service providers.
Image source: Official website of the Office of the Central Cyberspace Affairs Commission
Therefore, a relay station's statement that "the model was not trained by the platform" does not automatically exempt it from liability. Regulators will not look only at who owns the model; they will look at who opens the door to users, who collects the money, who organizes the calls, who controls the interface and billing rules, and who accumulates user data.In terms of legal characterization, service-provider status does not depend on whether the platform is a large-model vendor, but on whether the platform actually supplies this service to users.
What is more troublesome is that the model source, data flows, qualification procedures and allocation of responsibility for this service are often unclear.
This is where the real danger of AI relay stations lies.
It is not a purely technical issue, but a chain issue: the source may lack authorization, the endpoint is directed at the public within China, and user data cross-border transfer sits in between.
Once these three things stack up, it is no longer "small-scale tinkering."
III. How does it actually run? In fact, just three steps
Strip away the fancy rhetoric, and the grey intermediary chain is quite plain.
Step one: exploit access channels.
Some site operators register accounts in bulk, some purchase low-cost quotas, some obtain Keys through proxy channels, and some even bypass platform risk controls, fraudulently use interfaces, or engage in reverse engineering. Ultimately, an "account pool" or "interface pool" is formed.
Step two: build a wrapper.
They set up servers and reverse proxies to package overseas model interfaces as the platform's own API or web product. What users see is a Chinese-language interface, but what is actually called behind it is an overseas model.
Step three: sell Tokens.
They promote through communities, e-commerce, mini-programs, and developer communities, charging by Token, membership, package, or API call volume. The advertising slogans are also familiar: low-cost access to overseas large models, one-stop access to multiple top-tier models, tens of thousands of Tokens for a few yuan.
It sounds like business innovation. But if the source lacks authorization, the service has not completed the required filing, registration, or security assessment procedures, the data handling is unexplained, and the qualifications have not been completed, then it is not innovation—it is circumvention.
From a legal relationship perspective, these three steps place the site operator in three positions: first, he may be the actual user or reseller of overseas model interfaces, and must explain the source of the interfaces and the boundaries of authorization; second, he may be an internet information service operator targeting domestic users, and must explain ICP, value-added telecommunications business license, or filing issues; third, he is also the processor of user input information, usage records, and personal information, and must explain the rules for data collection, storage, forwarding, deletion, and cross-border data transfer.
When a single business simultaneously touches three types of legal relationships, it cannot be explained away as "just an API proxy."
IV. Why did the Ministry of State Security specifically warn about AI relay stations?
This is also a signal that has been very noteworthy recently.
The Ministry of State Security recently issued a dedicated advisory warning against the data security risks of AI relay stations. This advisory deserves a closer look, because it does not simply say "do not use overseas models"; rather, it breaks down the risks of AI relay stations in very specific terms.
Image source: Ministry of State Security WeChat official account, "'AI Relay Stations': Risks Must Be Guarded Against," June 8, 2026
The focus of the Ministry of State Security's advisory is not that "overseas models must not be touched," but that AI relay stations themselves may become a black box for data leakage, model degradation and technical backdoors.
The first category of risk is data exposure.
What users input into a relay station may not be ordinary chit-chat, but contracts, code, client materials, financial data, business plans, internal meeting minutes, and even personal identity information and sensitive information.
Such content first passes through the relay station and is then forwarded to overseas models. The question is: who operates the relay station? Where are the servers located? Is the data encrypted? Will it be retained? Will it be used for training? Will it be resold? Many users simply do not know.
The Ministry of State Security's advisory notes that some AI relay station operators lack the requisite qualifications, have weak security safeguards, and that user privacy leaks and data resale occur from time to time. Put plainly:Users think they are using models cheaply, but in reality they may be exposing their own data to strangers.
The legal issues here are very specific. When users input contracts, résumés, ID card information, client materials, code comments and chat records into a relay station, if such content contains personal information, the relay station is not simply "passing messages"; it is processing personal information. If such content is forwarded to overseas model servers, it may constitute providing personal information or data to overseas recipients.
At this point, at least several compliance questions must be answered: has the user been clearly informed of who the overseas recipient is, what the purpose of processing is, what the processing method is, and which categories of personal information are involved; has separate consent of the individual been obtained; has a personal information protection impact assessment been conducted; and where the scale reaches the statutory threshold, is it necessary to go through the security assessment for cross-border data transfer, the standard contract for cross-border transfer of personal information, or the certification path?
The biggest problem with many relay stations is not that they give wrong answers, but that they are simply incapable of answering.
The second category of risk is model degradation.
Many relay stations sell services under the banner of "access to top-tier models," but the model version users actually invoke may not be the one advertised.
To cut costs, some platforms may pass off lower-specification models as high-end ones, or reduce computing power supply and disable verification functions. Users believe they are making decisions with high-performance models, but what they receive are answers from a degraded version.
For ordinary chat, this may only mean a poor experience; but if used for legal, medical, financial, coding, or corporate decision-making purposes, it is not an experience issue but a risk of misleading.
The third category of risk is technical backdoors.
In more extreme cases, some relay stations are themselves compromised. They may lack proper data encryption mechanisms, may conceal malicious programs, or may even take the opportunity to steal accounts, keys, and cloud credentials from users' devices.
This is no longer a question of whether an "AI tool is easy to use," but a cybersecurity issue.
Therefore, the reminder from the Ministry of State Security truly exposes one thing:AI relay stations are not a simple "cheap entry point," but a highly opaque third-party black box.
When users hand over their data, they may not know who it passes through, where it flows, who stores it, or who reuses it.
This is especially dangerous for corporate users. When an employee, in order to save a few yuan, throws client contracts, source code, investment and financing materials, or internal plans into a relay station, what ultimately leaks may not be his chat records, but the company's core assets.
V. Why is this not the same as compliant overseas expansion?
Many people confuse two concepts: Token going overseas and Token coming in from overseas.
Token going global means selling domestic AI capabilities to overseas customers. For example, domestic models, AI applications, computing resources, and industry solutions charge overseas customers through tokens or API call quotas.
This path of course also raises compliance issues: model sourcing, cross-border data transfer, target markets, overseas payment collection, and fund repatriation all have to be handled. But at least its direction is sound:capabilities going out.
Token coming in is exactly the reverse.
It packages overseas model services and sells them back into the domestic market; the service recipients are domestic users, the source of capabilities is overseas models, and the intermediary layer is a gray transit platform. The former can be structured for compliance; the latter stands in the shadow of regulation from the very beginning.
VI. A Lawyer's Perspective: Why Might This Be Illegal?
The most troublesome aspect of an AI transit station is that it does not cross just one line. From a lawyer's perspective, assessing why it may be illegal requires a layered analysis, rather than concluding simply from the statement "it uses overseas models."
It is like a car driving forward while pressing on four red lines at the same time.
The first is generative AI regulation.
As long as generative AI services are provided to the domestic public, the platform cannot pretend to have nothing to do with generative AI regulation. The Interim Measures for the Administration of Generative Artificial Intelligence Services focus not on whether the platform has trained a foundation model, but on whether the platform uses generative AI technology to provide content-generation services to the domestic public. They also expressly bring services provided through APIs and other means within the understanding of "providers."
This means that if a transit station packages overseas models into its own webpage, membership, or API products and opens them to the domestic public for a fee, it may be required to assume the responsibilities of a generative AI service provider, including content security, protection of user inputs and usage records, complaints and reports, handling of illegal content, cooperation with regulators, and, in specific circumstances such as having public opinion attributes or social mobilization capability, obligations such as security assessments and algorithm filing.
The legal risk lies not in the fact that it is "not enough like a large-model company," but in the fact that it already operates like a large-model service provider without complying with the rules applicable to service providers.
Second, telecommunications business qualifications.
The platform has an account system, top-ups, API access, online services, data processing, and continuous operations. Whether it only requires ordinary ICP filing or must obtain an ICP license, and whether it is merely an information service business or, due to arrangements such as top-ups, transactions, settlement, and platform processing, further touches upon an EDI license, must be determined specifically in light of the platform's functions, transaction structure, fee recipients, settlement methods, and service content.
But one point can be established first:A token is merely a unit of account, not a tool for legal characterization.Replacing "paying RMB for services" with "topping up to buy tokens and then consuming them" does not change the essential nature of continuously operating internet services for domestic users.
Therefore, when a relay station explains its business as "not AI services, but token quotas," this defense is not legally robust. Regulators are generally not misled by pricing packaging; they return to substance: what exactly does the user obtain after paying? What exactly does the platform provide? What business conduct do the flow of funds and the flow of services actually correspond to?
Third, data security and personal information.
What users input to AI may be contracts, code, customer materials, financial data, trade secrets, or personal information. It passes through the relay station and then flows to overseas models.
Do users know? Has the platform explained clearly? Who stores the data? For how long? Will it be used for training? Can it be deleted? Who is responsible in the event of a leak? These are not product-experience issues, but personal information protection and data security issues.
Under personal information protection rules, processing personal information requires lawful, legitimate, and necessary purposes, public disclosure of processing rules, and necessary measures to ensure security; providing personal information overseas also requires fulfilling obligations such as notification and obtaining separate individual consent, and determining, based on data type, volume, subject identity, and scenario, whether a security assessment, standard contract, or certification is required. The 2024 Provisions on Promoting and Regulating Cross-Border Data Flows relaxed the outbound transfer mechanism requirements in certain scenarios, but did not exempt the basic obligations of notification, separate consent, impact assessment, and security protection. Moreover, the Regulations on the Administration of Network Data Security, effective as of January 1, 2025, have set out the security protection obligations for network data processing activities in greater detail. As long as a relay station processes user data within China, it cannot describe its business as a "channel" without responsibility.
The biggest data compliance flaw of gray-market relay stations is that they often can neither clearly explain what data is forwarded nor control how overseas recipients process such data.
Fourth, criminal risk.
Criminal risk must be addressed more cautiously: not every administrative violation will directly become a crime, and not every AI relay station will necessarily constitute a criminal case. Criminal law looks at the specific conduct, subjective intent, illegal gains, scale of operations, harmful consequences and the chain of evidence.
However, if the interfaces come from cracking, fraudulent use of payment credentials, circumvention of technical measures, or unlawful acquisition of accounts or keys, this may give rise to computer crime risks such as the crime of unlawfully obtaining computer information system data and the crime of unlawfully controlling a computer information system; only where there is also deletion, modification or addition of, or interference with, system functions, data or applications and serious consequences are caused does the discussion further extend to the crime of destroying a computer information system. If a relay station knows that the source of the interfaces is abnormal yet continues to organize sales, this will also aggravate the assessment of subjective culpability.
If, in violation of state regulations, a party fails to obtain a telecommunications or internet service license that it is required by law to obtain, and then operates on a scale by charging domestic users, disrupting the relevant market order and reaching the threshold of "serious circumstances", only then may it fall within the scope of discussion for the crime of illegal business operations. A mere "lack of official authorization" more often corresponds first to breach of contract, infringement, unfair competition or leads for computer crimes, and cannot directly jump to the crime of illegal business operations. If a platform also accumulates, resells or unlawfully provides users' personal information, it may further touch upon the crime of infringing citizens' personal information.
This is also why the relevant incidents cannot be understood merely as an "upgraded version of a platform account ban". Once a case enters criminal proceedings, public security authorities will look not only at the platform's terms of service, but also at the source of the interfaces, fund flows, user scale, illegal gains, data flows and subjective knowledge.
The most frightening thing about an AI relay station is not "being banned by the platform", but that one day the people knocking at the door are not the platform's risk management team, but law enforcement authorities.
Legal conclusion:
VII. Closing remarks: do not mistake grey quick money for a shortcut to going global
What is most misleading about Token going overseas is that it appears very close to AI Token going overseas.
Both have Tokens, both have APIs, both have model calls, both have cross-border elements, and both have commercialization.
But their nature is completely different.
Compliant going global means selling domestic AI capabilities to overseas customers and then collecting the money back in a compliant manner. It is difficult, but the difficulty lies in building capabilities, designing the architecture and completing the formalities.
Selling gray-market access into China means routing overseas model services to the domestic public through indirect channels. It is fast, but its speed comes from skipping authorization, skipping filing, skipping qualifications, and skipping data compliance.
What is saved is not cost, but risk. And it is risk that accrues interest.
For companies that genuinely want to commercialize AI Tokens, what is worth betting on is not "how to sell overseas models back into China," but "how to sell one's own AI services overseas."
The former earns a burst of quick money. Only the latter can grow into a real business.
AI Tokens can be a metering tool for going global, but they should not be a gray-market ticket for coming into China.
This article is an industry compliance observation, compiled from public reports and currently effective laws and regulations, and does not constitute legal advice on any individual case; the facts, charges, and legal liability of a specific case should be subject to the final determination of the competent authorities.
Author of this article
Shao Jiadai,Partner at Mankun (Shenzhen) Law Firm. A graduate of the National University of Singapore, he has served as a lawyer, head of compliance and risk management, and vice president of legal affairs at institutions including a Red Circle law firm, a central state-owned enterprise's cross-border investment platform, and a hundred-billion-yuan fund of funds. He focuses on new economy sectors such as Web3.0 and is adept at creatively providing clients with one-stop solutions to legal and compliance needs including global architecture setup for Web3 projects, license applications, project financing, real-world assets (RWA), and the establishment of crypto funds.
About Mankun
Mankun Law Firm was founded in 2015 and is a boutique law firm focused on serving Web3.0, the next-generation internet, and deeply engaged in new economy sectors such as blockchain, artificial intelligence, and technology finance.
The firm is headquartered in Shanghai and has branches in Hong Kong, Shenzhen, Silicon Valley, and other locations. Its core members come from well-known law firms, judicial authorities, technology companies, and digital asset institutions. With a distinctive multi-dimensional perspective of "law, industry, and regulation," the firm provides clients with high-quality legal services that combine depth in China with global breadth.
Drawing on a deep understanding of the new economy, sustained research and monitoring of regulatory policy, and extensive practical experience, the Mankun team is adept at providing comprehensive legal services from the perspectives of business models and legal practice to clients in new economy sectors such as Web3.0 blockchain, artificial intelligence (AI), crypto payment (PayFi), decentralized finance (DeFi), real-world assets (RWA) tokenization, NFT digital collectibles, and crypto funds. These services include business architecture design, project investment and financing, operational compliance, commercial disputes, anti-money laundering (AML) compliance system development, cooperation with global law enforcement investigations, digital asset tracing and loss recovery, criminal risk prevention and control, and criminal defense.
