Attorney Shao Shiwei | Going Global ≠ Safety: Why Payment Companies Providing Overseas Technical Services Still Face Charges for Aiding Information Network Criminal Activities

Some time ago, the company’s person in charge in this case approached me, stating that the first-instance judgment was imminent and expressing a desire to engage me as counsel for the second instance (relevant details have been modified to protect privacy).

Through communication with the parties involved, I learned that the judicial authorities accused the company of providing payment and settlement services for overseas gambling websites, thereby allegedly committing the crime of aiding information network criminal activities. In this regard, I inquired about several key facts:

After nearly two hours of communication with the client, I concluded that the “chain of evidence” in this case was incomplete, yet the company was still characterized as suspected of committing the crime of aiding information network criminal activities.

To be honest, although I have handled hundreds of cases of varying scales, this case still prompts reflection: an originally lawful overseas business operation evolved into criminal charges due to the subjective presumptions of the judicial authorities.

The offense of aiding information network criminal activities is classified as a minor offense under the Criminal Law, with a maximum sentence of three years. Nevertheless, this case underwent four first-instance hearings and has been under adjudication for nearly a year, which underscores the substantial controversies involved. The company’s operations were brought to an immediate standstill, and the client’s assets dwindled from tens of millions to nothing. From his perspective, each hearing was not only a legal contest but also an ordeal imposing significant physical and mental strain.

Ultimately, based on the client’s core objectives (relevant facts are not disclosed due to privacy considerations), the specific circumstances of the case, and practical considerations regarding the current judicial environment, I provided reasonable recommendations on actions that could be taken at present, but did not recommend filing an appeal. An appeal would entail substantial costs while the likelihood of achieving the client’s objectives would remain extremely low. Guided by the principle of maximizing the client’s interests, I ultimately declined to accept representation.

Yet the significance of this case extends beyond the dispute itself. It serves as a reminder to practitioners at payment companies, gaming companies, Web3 teams, and other entities planning overseas expansion: compliance awareness must be prioritized ex ante; otherwise, once red lines are crossed, individuals may lose their personal liberty, and both the company and individuals may see their assets wiped out overnight.

In the course of providing legal services to practitioners in gaming companies, Web3 projects, payment service providers, and crypto asset trading platforms, Attorney Shao frequently encounters an unavoidable question:

“If our business has already been established overseas, do we still need to worry about domestic legal risks?”

A further question is: “How significant is the difference in risk between serving domestic users and overseas users?”

To answer these questions, it is necessary first to understand two legal concepts: territorial jurisdiction and personal jurisdiction.

Territorial jurisdiction.

Article 6 of the Criminal Law provides: This Law shall apply to all crimes committed within the territory of the People’s Republic of China, except as otherwise specifically provided by law; if either the criminal act or its consequences occur within the territory of the People’s Republic of China, the crime shall be deemed to have been committed within the territory of the People’s Republic of China.

If a company’s business is inherently high-risk within China, even relocating servers overseas will not avoid criminal liability as long as the owners and employees remain within China; such conduct will still be characterized as having the “place of the criminal act” within China, making criminal risk difficult to avoid.

Personal jurisdiction.

Article 7 of the Criminal Law: “Where a citizen of the People’s Republic of China commits an offense prescribed by this Law outside the territory of the People’s Republic of China, this Law shall apply; however, if the maximum penalty prescribed by this Law is fixed-term imprisonment of not more than three years,prosecution may be waived.”。

Even if a company relocates its entire operations overseas and its employees are also abroad, as long as they remain Chinese citizens, they remain subject to Chinese law. The phrase “prosecution may be waived” in the statutory provision is not an exemption clause; judicial authorities retain the discretion to pursue criminal liability. In the case discussed in this article, although the crime of aiding information network criminal activities is a minor offense with a maximum sentence of no more than three years, the party involved was still held criminally liable, thereby confirming this point.

Therefore, with respect to the first question above—“When conducting business overseas, is it still necessary to guard against domestic legal risks?”—the answer is obvious: going global does not equate to safety. Enterprises cannot focus solely on overseas regulation while ignoring the constraints imposed by Chinese law.

With respect to the second question above—“If business is conducted overseas, serving both domestic and overseas users, how do the risk levels differ?”

In addressing this question, whenever I ask consultees whether they conduct business targeting domestic users, the response is often: “We provide services to global users.” In reality, however, such an answer usually indicates that the company primarily serves users in mainland China and generally does not perform KYC (Know Your Customer, i.e., user identity verification), making it impossible to distinguish the proportion of users by jurisdiction.

Under these circumstances, if the company’s business is characterized as high-risk under domestic law (such as involvement in gambling, pornography, or virtual asset trading), the risk level will rise sharply.

So, what is the difference in risk levels for a company between serving only overseas users and serving users without distinguishing between domestic and overseas jurisdictions?

In a legal seminar previously delivered by Attorney Shao to Web3 practitioners, I once presented a diagram:

As shown in the diagram, if ranked by descending risk level, 1 > 2 > 3 > 4. This means that if a business falls within categories expressly defined as criminal offenses under the Criminal Law (taking gambling-related crimes as an example, such as Texas Hold’em gambling, blockchain game gambling, or providing payment and settlement services for gambling platforms), the risk of directly providing services to users in mainland China is necessarily higher than that of providing services to Chinese nationals abroad, because judicial authorities, when cracking down on criminal activities, must also consider practical enforcement issues such as social harm and the difficulties of obtaining evidence extraterritorially. However, lower risk does not mean zero risk. This is precisely why the case discussed in this article became involved in legal proceedings.

It is evident that even if business operations are located overseas, they cannot be completely severed from the reach of Chinese law. This is the key warning drawn from the case discussed in this article. For companies that are planning or have already expanded overseas, it is essential to look beyond business expansion and proactively establish compliance measures to prevent criminal risks.

As a criminal defense lawyer, the majority of the criminal cases I handle involve corporate crimes, most of which stem from criminal legal risks arising from companies’ business operations. However, a common pattern I have observed is that many enterprises do not intentionally violate the law; rather, they consistently believe that their operations are lawful.

In reality, determining the legality of a company’s business operations cannot be achieved merely by reviewing statutory provisions; it requires a deeper analysis grounded in the actual law enforcement practices of judicial authorities. As illustrated by the case discussed in this article, if the company had implemented robust compliance measures during its business operations, such an outcome might have been avoided.

Nevertheless, the reality is that most enterprises struggle to recognize the importance of criminal compliance before risks materialize. While low-probability events may seem distant, their occurrence can lead not only to operational setbacks but also to business suspension and criminal liability for both company executives and employees. In judicial practice, differing interpretations and characterizations of the same facts further exacerbate the unpredictability of enterprises’ situations.

For this reason, proactive prevention is far more valuable than reactive response. This is not an alarmist statement, but a reality repeatedly confirmed by numerous cases.

For gaming companies, Web3 projects, payment service providers, and crypto assets platforms, areas such as cross-border payments, fund flows, and virtual currencies inherently reside in high-regulatory-risk zones. If choosing to expand overseas, it is essential to incorporate criminal compliance into initial planning, treating compliance as a “necessary cost” of business development rather than an optional consideration. Only in this way can enterprises navigate complex and volatile environments with greater stability.