Cross-border e-commerce businesses need to pay for Facebook advertising; companies developing overseas operations need to subscribe to SaaS software; and businesses operating games and AI products need to procure overseas cloud servers.
These seemingly ordinary online payment needs have made VCC virtual credit cardsa commonly used payment tool for many companies expanding overseas. Users apply for a virtual card online and, after topping it up, can use it for overseas spending. There is no physical card, card issuance is convenient, and payment is flexible.
However, a recent case has sounded a warning for the VCC industry.
Source: Mobile Payment Network
On August 27, 2026, the Shanghai police announced a case involving the use of virtual currency to carry out cross-border illegal payment settlement, with an amount involved exceeding RMB 200 million; nine criminal suspects were apprehended, and five of them were approved for arrest on suspicion of the crime of illegal business operations.
According to police disclosures, the team involved set up two platforms: one responsible forcross-border fund exchange, and the other responsible forvirtual credit card issuance and settlement。
In the virtual card business, the platform cooperated with multiple virtual card operators, and users could apply for virtual cards for spending, butTop-ups require the use of virtual currencySubsequently, the platform converts the virtual currency into foreign currency outside the mainland and then, throughsham cross-border foreign-exchange settlementand other means, completes settlement with the virtual card operator.
The case is still under further investigation, and whether the persons involved ultimately constitute a criminal offense remains to be determined in accordance with law.
However, this case reveals an issue that VCC practitioners should seriously consider:
When it comes to helping clients pay advertising fees and software subscription fees, why is it that some platforms merely provide card-issuing services, while others may be suspected of the crime of illegal business operations?
The key to the issue often lies not in the virtual card itself, but in the underlying method of fund flow.
What kind of business is a VCC virtual credit card, exactly?
First, let us clarify what a VCC is.
VCC (Virtual Credit Card) generally refers to a virtual payment card that has no physical card and completes online transactions through information such as the card number, expiry date and security code.
It can rely on Visa、Mastercard and other international card network usage, commonly seen in scenarios such as overseas advertising placement, software subscriptions, cross-border e-commerce and online service procurement.
Although the name contains "credit card," many VCC products on the market in fact adopta prepaid or debit model, requiring top-up before spending, and do not possess the overdraft function of traditional credit cards.
For example.
A domestic cross-border e-commerce company needs to pay fees to an overseas advertising platform every month, but its existing bank cards often fail to complete the deduction. The company therefore approaches a VCC service provider, applies online for a virtual card, tops up in RMB to obtain the corresponding USD spending limit, and then binds the virtual card to the advertising account.
The whole process appears simple:top up RMB—obtain a foreign-currency spending limit—pay using the virtual card.
For the enterprise, the problem is solved. For the VCC platform, however, what truly needs to be explained clearly is another matter:
the user pays in RMB, the overseas merchant receives foreign currency—how exactly do the funds in between move? This is precisely where the legal risks most requiring attention in the VCC business lie.
Why might an RMB top-up involve illegal foreign-exchange conversion?
Assume a VCC platform supports RMB top-up: after the user pays RMB, the platform generates a USD spending limit in the account at a certain exchange rate.
Users only need to see the balance credited to their account and can then use their cards normally. But if the flow of funds is broken down further, the following situation may come to light: the platform collects RMB from users within the mainland and keeps the funds in domestic accounts; at the same time, the platform uses its own controlled offshore US dollar funds to provide spending funds for users' virtual cards.
RMB and US dollars are not exchanged on a transaction-by-transaction basis through formal foreign exchange purchase channels; instead, the platform, throughdomestic and offshore fund arrangements,completes the exchange of value.
This method of completing exchange through domestic and offshore fund pools is commonly referred to as“matched trading (duiqiao)”。
Some may ask: "The RMB has always stayed in China and the US dollars have always stayed abroad, and there is no actual cross-border transfer at all, so why would there still be a problem?"
Because the legal assessment is not merely whether funds have directly crossed the border, but ratherwhether the platform has, without authorization, actually provided users with exchange services between RMB and foreign currencies.
Article 2 of the Interpretation of the Supreme People's Court and the Supreme People's Procuratorate on Several Issues Concerning the Application of Law in the Handling of Criminal Cases of Illegally Engaging in Fund Payment and Settlement Business and Illegally Trading in Foreign Exchange:
Implementing, in violation of state regulations,buying and selling foreign exchange by speculation or disguised trading in foreign exchangeand other conduct that disrupts financial market order and is serious in nature may be convicted and punished forthe crime of illegal business operationsand sentenced accordingly.
Another common business arrangement is to introduce USDTand other virtual currenciesas an intermediate step.
For example, a user purchases USDT with RMB and then uses the USDT to obtain a USD spending limit provided by the platform. If the platform in fact organizes and controls the exchange between RMB and foreign currency and merely uses virtual currencies to complete the transfer, thenthe addition of an extra transaction step in the middle cannot be regarded as circumventing foreign exchange regulation.。
It should be emphasized, however, thatsupporting virtual currency top-ups does not automatically constitute the crime of illegally buying and selling foreign exchange.
Whether the crime of illegal business operations is involved still requires examination of the transactions in which the platform actually participates, the flow of funds, the exchange arrangements, and whether the circumstances meet the threshold required for criminal prosecution.
Apart from illegal foreign exchange conversion, what other criminal red lines might VCC platforms cross?
- No payment license, yet running a payment institution's business
Many VCC platforms emphasize: "We only provide technical services; the actual card issuer is overseas, and our partners hold financial licenses."
However, cooperating with an overseas licensed institutiondoes not mean that all business the platform conducts domestically is lawful。
For example, where a VCC platform not only provides a card-opening portal but alsodirectly collects users' top-up funds, controls account balances, processes payment instructions, and even arranges fund settlement itself。
it is then necessary to further assess whether the platform has exceeded the scope of ordinary technical services and is in fact engaging in payment business that requires a license under law.
Article 6, paragraph 2 of the Regulations on the Supervision and Administration of Non-Bank Payment Institutions expressly provides:
Without approval in accordance with law, no unit or individual may engage in payment business, or engage in payment business in disguised form, except as otherwise provided by laws, administrative regulations and the State.
At the same time, Article 19, paragraph 2 of the Regulations sets requirements for non-bank payment institutions providing cross-border payment services, namely that they shall comply withcross-border payment, cross-border RMB business, foreign exchange administration and cross-border data flowthe relevant provisions.
It should be noted that Article 19, paragraph 2 directly regulates non-bank payment institutions,and it cannot be relied upon alone to determine that all domestic VCC platforms are unlawful.。
For VCC platforms, what genuinely needs to be examined is:
• Does the platform actually engage in payment business that requires a license?
• Do the cooperating institutions hold the corresponding qualifications, and does the actual business fall within the scope of the license?
• Who collects, controls and settles user funds?
• Does the platform indirectly participate in fund processing through affiliated companies or other entities?
If the platform merely provides card-opening applications, information display and technical interfaces, there is an important distinction between that and actually carrying out payment and settlement business.
However, if the platform, although nominally a technical service provider, in fact operates payment and settlement business itself, it may face administrative penalties, and where the circumstances are serious and the elements of a crime are satisfied, it may also be suspected of the crime of illegal business operations.
A distinction must be drawn here: engaging in payment business without a license cannot be directly equated with constituting the crime of illegal business operations.
The determination of criminal liability also requires consideration, in conjunction withthe Criminal LawArticle 225and the relevant judicial interpretations.
- Providing payment convenience for illegal activities such as gambling and fraud
VCCs can be used not only for normal commercial activities but may also be exploited by criminal groups. For example,overseas gambling websites and fraud groupsmay need to purchase cloud servers in bulk, pay for advertising, or use virtual cards to complete other online transactions.
If a VCC platform discovers obvious anomalies in a customer during its operations yet continues to provide substantial card issuance, top-up and payment support, this may trigger further review of criminal liability.
There is a point here that is easily misunderstood: the fact that a customer uses a VCC to commit a crime does not mean that the platform providing the service necessarily commits a crime.
The key is whether the platformknowinglyengaged in the relevant illegal or criminal activities, whether it provided substantial assistance, and which crime's constituent elements its specific conduct satisfies.
For example, did the platform conduct timely verification after receiving a risk alert? Were thereacts such as assisting customers in circumventing identity verification or concealing transaction information? For clearly abnormal transactions, were necessary handling measures taken?
These details may all affect the determination of liability. Where the corresponding conditions are met, this may involvethe crime of assisting information network criminal activities or the crime of money laundering, or accomplice liability for the relevant predicate offenses.
Therefore, VCC platforms cannot focus only on the number of cards opened and transaction volumes; necessarycustomer identity verification, risk monitoring and handling of abnormal transactionsare equally important.
Why do different operating models carry very different risks in the same VCC business?
For the VCC industry, there is another issue worth discussing:
If a platform does not directly handle funds and only provides card opening and technical services, does that mean there is no risk of illegal business operations?
We can compare two common business arrangements.
Model 1: The platform provides technical services, while a licensed institution handles funds
The platform cooperates with financial institutions and payment institutions holding the requisite qualifications, and primarily providescard application entry points, account information display, statement inquiriesand other services. User funds go directly to the institutions lawfully providing the relevant services, and those institutions complete the receipt and payment of funds, currency conversion and transaction settlement in accordance with applicable law.
The platform does not itself engage in foreign exchange conversion, nor does it actually control customer funds or independently organize payment settlement.
If the above arrangement is genuine and complete, and the qualifications of the counterparties and the fund flow chain also comply with the relevant regulatory requirements, then there is a substantive difference between the platform and an operator that itself carries out foreign exchange and payment settlement business.
However, hereone cannot simply conclude that "providing only technical services is necessarily lawful"。
If the platform collects funds through affiliated companies, or, although it does not directly hold funds, in fact determines the transfer of funds and controls transaction processing and clearing arrangements, its true business nature still requires further examination.
Model 2: The platform collects funds and itself organizes conversion and overseas settlement
Another model is different.
The platform directly receives users' top-up payments, generates corresponding foreign-currency credit limits in its back office, and then, throughoffshore liquidity pools, virtual currency transactions or other means,completes payment to its partner card providers.
In this process, the platform not only provides card-issuing services but may also actually participate in currency exchange and payment settlement. Even if the platform labels the relevant revenue as "technical service fees", "card-issuing fees" or "top-up service fees", such labels alonecannot be relied upon to establish that its business is lawful。
and judicial authorities may stilllook beyond the contracts and platform pagesto examine the actual flow of funds and the transaction arrangements. It is worth noting that some platforms also seek to explain the compliance of their business by reference to“offshore RMB settlement" or "overseas licensed cooperation. However, regardless of the cooperation structure adopted,the fact that an overseas institution holds the relevant qualifications does not of itself mean that a domestic platform may collect RMB on its own account, carry out currency exchange or engage in payment settlement business.
Whether a cooperation arrangement is compliant must ultimately be assessed by reference to the specifictransaction parties, applicable jurisdictions, scope of licensing and flow of funds. Therefore, the difference in legal risk between the two models cannot be determined solely by whether the platform has its own APP or whether it acts as an agent for overseas card issuers.
What truly needs to be examined is four things: who receives the money? Who performs the foreign exchange conversion? Who controls the funds? Who is responsible for settlement?
V. Five questions that VCC platform operators are advised to clarify in advance
VCC does address certain payment pain points for companies expanding overseas, but the fact that a business operates normally does not mean there is no risk in the underlying flow of funds.
For companies that already operate VCC platforms or are preparing to enter this sector, it is advisable to focus on verifying the following matters.
First, who is the actual card issuer?
Can the true card-issuing entity, the layers of cooperation and its business qualifications be clearly identified? Do the business activities that the relevant institution is licensed to conduct cover the services actually provided?
Second, where does the money recharged by users go?
Do the funds go directly to a licensed institution, or to the accounts of the platform or affiliated companies? Are there issues such as receipt of funds into personal accounts or opaque fund pools?
Third, how are foreign currency spending limits generated?
Is the exchange completed lawfully by an institution with the appropriate qualifications, or does the platform quote prices itself and arrange matching of domestic and overseas funds, or use virtual currency to effect value conversion?
Fourth, what business functions does the platform actually perform?
Beyond information display and technical services, does it also participate in the collection and payment of funds, processing of payment instructions, allocation of funds, and transaction clearing? Do these functions involve financial licenses that must be obtained in accordance with the law?
Fifth, how are abnormal customers and transactions handled?
Does it have customer identification, transaction monitoring, risk handling and record retention mechanisms commensurate with its business risks? When abnormal transactions occur, can the platform explain what measures it took?
These five questions not only bear on whether an enterprise can continue operating, but may also, in the event of a criminal investigation, become important bases for determining the true nature of the platform's business and the legal liability of the relevant personnel.
Conclusion: VCC is not inherently wrongful; the key is what the platform actually does
As a payment instrument, VCC itself has genuine commercial application value. However, conducting business around VCC does not mean that all card issuance, top-up, exchange and settlement models are inherently lawful. Even where virtual card services are provided alike, some platforms are responsible only for technical integration, while others may simultaneously operate fund exchange, cross-border payment settlement and other businesses.
The products the two appear to offer are similar, yet their legal nature may be entirely different. For VCC operating platforms, what truly merits attention is not merely whether cards can be issued, whether funds can be topped up, and whether overseas payments can succeed.
More importantly:
Is the platform merely providing technical services, or has it in fact been operating businesses that require financial licenses?
Where domestic and overseas regulatory rules intersect and payment chains grow increasingly complex, mapping out the business model and fund flows in advance is far more important than explaining the nature of the business after accounts are frozen and the platform is investigated.
For enterprises currently operating or planning to establish a VCC business, it is recommended to conduct a dedicated compliance review focusing onthe qualifications of partner institutions, fund collection and payment, foreign exchange conversion, payment settlement, and customer risk management, so as to clearly define the legal boundaries while pursuing business development.
References:
- Shanghai Municipal Public Security Bureau, "Severing the Criminal Chain of Virtual Currency Crimes to Safeguard the City's Economic and Financial Security," August 31, 2026
https://www.shanghai.gov.cn/nw31406/20260902/cc3438b24fbd4c7f80342c11f581fdc4.html
- Regulations on the Supervision and Administration of Non-Bank Payment Institutions (State Council Order No. 768)
https://www.pbc.gov.cn/tiaofasi/144941/144953/5174993/index.html
- Interpretation of the Supreme People's Court and the Supreme People's Procuratorate on Several Issues Concerning the Application of Law in the Handling of Criminal Cases of Illegally Engaging in Fund Payment and Settlement Business and Illegally Trading in Foreign Exchange
https://www.court.gov.cn/zixun/xiangqing/141542.html
