"I only sold a few batches of USDT. I neither participated in fraud nor met any victims. Why was my bank card frozen, and why am I even required by public security organs to cooperate with the investigation?"This is the most difficult question for many participants in over-the-counter (OTC) virtual currency transactions to understand when they first encounter criminal risks. From their perspective, they merely exchanged RMB for USDT and earned profits from transaction spreads or fees. However, from the viewpoint of law enforcement agencies, if a transaction objectively facilitates the receipt, conversion, and transfer of funds involved in fraud, the trader may have become a link in the chain of criminal funds.
On July 30, 2026, Guangzhou Daily reported that public security organs at the Zhanjiang and Leizhou levels conducted a cross-regional centralized crackdown, dismantling a gang engaged in "illegal payment-settlement schemes" that used virtual currency transactions to transfer proceeds from telecommunications network fraud. Sixteen gang members were criminally detained in accordance with the law. Police disclosed that the gang had been active since late 2025. Led by the couple He and Zhang, it recruited personnel and aggregated personal bank cards as well as payment accounts such as WeChat Pay and Alipay to receive and circulate fraud-related funds. It then used virtual currency transactions to convert these funds and profited from transaction spreads.
It should be noted that criminal detention is a compulsory measure during the investigation stage and does not mean that the individuals concerned have been found guilty by a court. The term "money laundering" in the police bulletin primarily describes the suspected behavioral pattern of assisting in the transfer and conversion of criminal funds. Whether the conduct ultimately constitutes the crime of aiding information network criminal activities, the crime of concealing or disguising the proceeds of crime, or other offenses still requires separate determination based on each individual's specific role, subjective knowledge, and the evidence.
What are virtual currency "illegal payment-settlement schemes"?
"Illegal Payment-Settlement Schemes"These schemes initially appeared mainly in the context of bank cards and third-party payments. Simply put, certain individuals provide bank cards, WeChat Pay, Alipay, or payment QR codes to help others receive, split, and transfer funds, charging commissions based on the transaction volume. On the surface, this manifests as frequent receipts and payments between different accounts. However, the substantive purpose is not to complete normal consumption or genuine commercial transactions, but to cut off or obscure the link between the funds and upstream crimes by adding layers of accounts.
When this model enters the virtual currency trading scenario, virtual assets such as USDT may become tools for converting RMB funds into on-chain assets. A typical chain involves: fraud syndicates first obtaining RMB funds from victims and arranging for different bank cards or payment accounts to receive them; intermediaries then contact OTC merchants to purchase USDT; after the exchange, the USDT is transferred to designated wallets and continues to circulate through multiple addresses, cross-chain tools,()or other methods.
Therefore, virtual currency "illegal payment-settlement schemes" are not simply about "buying or selling USDT," but rather involve using virtual currency transactions to help convert, transfer, or conceal funds of suspicious origin. In this chain, some individuals are responsible for providing accounts, others for contacting traders, others for receiving RMB, and others for transferring out USDT. Even if participants in different links do not know each other, as long as a stable fund circulation system is formed overall, law enforcement agencies may still review it as a complete criminal chain.
Why do criminal syndicates use USDT for fund conversion?
Criminal syndicates choose USDT not because USDT is inherently an illegal tool, but because over-the-counter (OTC) trading allows for the rapid conversion between different asset forms.Within the traditional banking system, the continuous cross-account flow of RMB funds is likely to trigger anti-money laundering (AML) and anti-fraud risk controls by banks. Once converted into on-chain assets, the funds can continue to circulate independently of the original bank accounts, thereby increasing the difficulty of tracing, freezing, and recovering such assets.
Meanwhile, over-the-counter (OTC) transactions()typically involve identity and payment information verification conducted directly by the buyer and seller. If the seller focuses solely on whether the RMB has been received and whether the on-chain transfer of crypto assets has been successfully executed, without verifying whether the actual payer matches the counterparty to the transaction, situations may arise where “Person A purchases USDT, but Person B makes the payment.” For legitimate merchants, this may appear merely as a third-party payment; however, for criminal syndicates, this mechanism allows victim funds to be paid directly to the USDT seller, who then delivers the USDT to the criminal syndicate.
This explains why some parties involved may state: “I had no contact with the fraud syndicate; I simply accepted an order on the platform.” The issue is that the assessment of criminal liability does not depend solely on whether the parties met in person or whether the transaction was completed through a particular platform. Rather, it depends on who made the payment, to whom the crypto assets were ultimately transferred, whether the transaction method was abnormal, and whether the trader was aware of such abnormalities.
Where lies the boundary between legitimate OTC transactions and high-risk illegal payment-settlement schemes?
Virtual asset OTC transactions per se cannot be equated directly with criminal conduct.Legitimate transactions typically involve explainable demands for asset purchases and sales, with transaction prices close to market rates, correspondence between the identities of the payer and the transacting party, and a willingness by both parties to retain records of orders, chat logs, and payment vouchers.
High-risk transactions often present a different pattern: the transacting party refuses to disclose their identity or the purpose of the transaction, yet requests payments split across multiple unfamiliar accounts; the counterparty shows indifference to market prices and is willing to pay premiums significantly above market rates; there is a sudden and substantial increase in transaction frequency and volume, accompanied by frequent changes of payment accounts; the counterparty requests deletion of chat logs or uses software with self-destructing message features; and transactions continue through other accounts even after the account holder has received bank risk alerts or had accounts frozen.
These irregularities alone do not prove that an individual has committed a crime. For instance, occasionally accepting a payment made on behalf of a friend or relative does not necessarily mean the trader “knowingly” dealt with funds derived from fraud. However, when characteristics such as third-party payments, excessive premiums, splitting among multiple payers, frequent changes of bank cards, anonymous communications, and refusal to maintain records occur simultaneously and repeatedly over time, they may form a chain of evidence pointing to subjective knowledge.
Therefore, in assessing whether an OTC transaction is safe, one should not merely ask whether the crypto assets or funds have been received. One must also inquire: Who is the actual payer? Why was payment made by a third party? Why does the price deviate significantly from market rates? Why does the counterparty request rapid transfer of crypto assets? Does this transaction have a verifiable and genuine background?
Why does the claim “I did not know the funds were problematic” not necessarily exempt one from liability?
In cases involving crypto assets, “I did not know” is the most common defense, and it is also the aspect of the case that requires the strongest evidentiary support.
The 2025 Judicial Interpretation on Concealing or Disguising the Proceeds of Crime, jointly issued by the Supreme People’s Court and the Supreme People’s Procuratorate, clarifies that determining whether an actor had “knowledge” shall be based on a comprehensive assessment of factors including the information to which the actor was exposed, the type and amount of property handled, the methods of fund transfer, abnormalities in transactions and accounts, professional experience, relationships with upstream offenders, and the actor’s own statements. Meanwhile, the Supreme People’s Court emphasizes that “knowledge” must be strictly determined in accordance with the law, presumptions should be applied with caution, and it is impermissible to indiscriminately conclude that an actor constitutes the crime of concealing or disguising the proceeds of crime merely because the actor provided bank cards or participated in transfers.
This implies two aspects. On the one hand, an actor cannot rebut all objective evidence with a mere statement of “I did not know.” If a person engaged long-term in over-the-counter (OTC) trading repeatedly accepted payments from unknown third parties, continuously traded at abnormal prices, and continued operations after being warned of risks by the bank, such professional experience and transactional anomalies may constitute important bases for assessing subjective knowledge.
On the other hand, case-handling authorities may not directly conclude that a seller of USDT has committed a crime solely because the funds are “fraud-related” or the account has been frozen. Lawyers must still examine whether the client knew of the specific abnormalities in the funds, actively controlled the flow of funds, maintained stable contacts with upstream actors, derived obviously abnormal profits, and whether the trading behavior constituted an isolated, occasional transaction or the long-term, professional provision of fund-conversion services.
Crime of Aiding Information Network Criminal Activities()How should it be distinguished from the Crime of Concealing or Disguising the Proceeds of Crime?
In its bulletin, the Zhanjiang Public Security Bureau indicated that the relevant individuals may be suspected of committing the Crime of Aiding Information Network Criminal Activities or the Crime of Concealing or Disguising the Proceeds of Crime and the Gains Therefrom.Both offenses commonly arise in downstream fund-related cases involving telecommunications and online fraud, but they cannot be mechanically distinguished simply by the volume of transaction flows or whether bank cards were provided.
The Crime of Aiding Information Network Criminal Activities primarily targets conduct in which an actor, knowing that another person is using an information network to commit crimes, nevertheless provides payment settlement, accounts, technical support, or other assistance. The actor’s awareness of the upstream crime is typically general in nature; for example, knowing that the counterparty is engaged in abnormal online business activities, yet still renting out bank cards, providing payment accounts, or cooperating with verification procedures.
The Crime of Concealing or Disguising the Proceeds of Crime focuses more on situations where, after the criminal proceeds have already been generated, the actor, knowing that the property handled constitutes criminal proceeds, actively assists in their transfer, conversion, or concealment. For instance, if an actor not only provides accounts but also organizes personnel to collect funds over a prolonged period, arranges for the splitting of funds, contacts USDT merchants to exchange for USDT, and transfers virtual assets to designated wallets as instructed, such conduct goes beyond merely providing a tool and directly facilitates the completion of the transfer of illicit funds.
Relevant opinions issued in 2025 by the Supreme People’s Court, the Supreme People’s Procuratorate, and the Ministry of Public Security require that, when distinguishing between the Crime of Aiding Information Network Criminal Activities and the Crime of Concealing or Disguising the Proceeds of Crime, authorities should comprehensively consider factors such as the content and degree of subjective knowledge and the type and manner of assistance provided, avoiding simplistic determinations such as “any transfer constitutes concealment” or “any provision of an account constitutes aiding.”
With respect to the 16 individuals involved in the Zhanjiang case, their hierarchical positions and levels of participation—such as organizers, those responsible for recruiting account holders, those handling specific receipts and payments, and those responsible for USDT exchanges—may clearly differ. Ultimate liability should be determined based on what each individual actually did, what they knew, the amount of profit they gained, and whether they participated in organization or management, rather than applying identical assessments solely because they belonged to the same group.
What risk signals are OTC traders most likely to overlook?
For ordinary traders, the greatest danger is not market price volatility, but rather that the trading pattern has already changed while they still interpret it as "normal arbitrage."
For example, the counterparty requests payments from multiple strangers but cannot explain the relationship between the payers and the trader; offers a quote significantly higher than normal levels and only demands prompt transfer of crypto assets; asks the trader to receive a sum of RMB on their behalf and then transfer part of the funds to other accounts; frequently requests changes to the bank card used for receiving funds, or suggests continuing transactions using family members' accounts after the trader's bank card has been frozen; or, under the pretext of "testing transaction volume," "fabricating transaction volume," or "fund turnover," requests the provision of bank cards, WeChat Pay, Alipay, or real-name wallets.
The common characteristic of these behaviors is that the focus of the transaction is no longer the buying and selling of USDT, but rather obtaining a channel capable of receiving, splitting, or converting RMB funds. Once it is discovered that the counterparty truly requires account access and fund flow capabilities rather than the virtual assets themselves, the transaction should be terminated immediately.
What should one do if their bank card has already been frozen, or if they have received notice from public security organs?
After a bank card is frozen, the least advisable actions are to immediately delete chat records, wipe devices, or coordinate stories with the counterparty.Such actions may not only result in the loss of evidence favorable to the trader, but may also be interpreted by the investigating authorities as an attempt to evade investigation.
A more prudent approach is to fully preserve platform orders, chat records, payment vouchers, bank statements, wallet addresses, and on-chain transaction hashes(), and to organize each transaction chronologically, detailing the actual payer, counterparty, transaction price, crypto asset transfer address, and profits gained. Unfavorable facts, such as third-party payments, abnormal premiums, or account risk warnings, should not be simply concealed; instead, their causes should be explained in the context of the complete transaction background.
If one has already received a summons or been required to travel to another jurisdiction to provide explanations, it is necessary first to confirm the stage of the case, the handling authority, the suspected charges, and one's position within the fund chain. Cases involving crypto assets implicate both bank statements and on-chain records; examining only one chain of evidence often fails to reconstruct the complete facts. Determining whether the conduct constitutes normal trading, aiding information network criminal activities, or concealing or disguising crime-related proceeds requires a combined review of RMB fund flows, virtual asset flows, and communication records.
Legal Observations
This case in Zhanjiang further demonstrates that the criminal risks in over-the-counter (OTC) trading of virtual currencies are no longer as simple as "having one's bank card frozen after purchasing illicit funds."When traders continuously provide accounts, fund reception, and USDT exchange services, their identity may gradually shift from that of an ordinary trading counterparty to that of a professional node within the criminal fund chain.
However, criminal liability cannot be determined solely on the basis that "fraud-related funds flowed into the account." What truly requires scrutiny in such cases is whether the transaction background was genuine, whether the pattern of conduct was abnormal, the extent of the party's awareness of the nature of the funds, and whether the party merely passively completed a transaction or actively assisted in converting and transferring criminal proceeds.
For OTC participants, the key to compliance is not guaranteeing that they will never receive fraud-related funds, but rather preserving sufficient evidence in each transaction to demonstrate the counterparty, purpose, and process of the transaction, and promptly ceasing operations when red flags arise. For parties already involved in an investigation, the most important step is not repeatedly emphasizing "I was just selling USDT," but rather using complete fund-flow records, on-chain data, and communication evidence to clearly explain why the transaction occurred, how it was conducted, and what the party actually knew at the time.
/ END.
*This article is an original work by Mankun Law Firm. It reflects only the personal views of the author and does not constitute legal advice or a legal opinion on any specific matter. For reprint permissions or legal consultations, please contact our customer service at: mankunlawyer.
About Mankun
