In an era of stringent regulation, Web3 projects must pursue not only technological "coolness" but also operational "stability."
Introduction
On October 28, 2025, the 18th session of the Standing Committee of the 14th National People's Congress voted to adopt the Decision on Amending the Cybersecurity Law of the People's Republic of China. The law will take effect onJanuary 1, 2026came into formal effect.
This amendment is not merely aboutmore penalties; it representsa fundamental shift in the regulatory approach.
Observations on the Regulatory Landscape: Core Trends in the Web3 Sector
Current cybersecurity regulatory logic is undergoing key changes.For Web3 projects, the following directions merit particular attention:
1. Penalties have been significantly strengthened:Under the new rules, if an enterprise fails to perform its cybersecurity obligations and causes especially serious consequences, the maximum fine has been substantially raised from the previous approximatelyRMB 500,000 to RMB 10 millionIn addition, the new ruleshave eliminated the previous flexible approach under which a first violation could result in a warning first,and the regulatory authorities have the power to directly make a fine decision.
2. Artificial intelligence has explicitly come within the regulatory scope:For the first time in a foundational law, the new rulesestablish, with respect to AI, the principle of giving equal weight to "encouraging development" and "safeguarding security."This means thatthe responsibilities and obligations concerning algorithm security, model security and computing power platformshave formally been incorporated into the regulatory framework.
3. Accountability extends to individuals:The maximum fine for directly responsible personnel has beenraised to RMB 1 millionThis adjustment sends a clear signal: while imposing penalties on entities, enforcement authorities will simultaneously pursue individuals, identifying specific responsible subjects for potential subsequent criminal liability.
In legal practice, administrative penalties often serve as the evidentiary foundation for criminal charges. When administrative fines reach the tens of millions, it typically means that the resulting consequences have reached the threshold of "serious circumstances" or "especially serious circumstances" under the Criminal Law.
Caution required: how administrative violations escalate into criminal offenses
Because Web3 projects are characterized bydecentralizationandcross-borderfeatures, in judicial practice they oftenface penetrating reviewOnce a “technical vulnerability” and a “compliance gap” overlap, the project team must be alert to the following two types of criminal risk:
1. Crime of refusing to fulfill obligations for information network security management (Article 286-1 of the Criminal Law)
The core of this crime lies in the project team having the ability to fulfill regulatory requirements yet passively failing to act.
In Web3 scenarios, project teams often assert“technological neutrality”or“the code cannot be modified.”However, judicial authorities conduct a penetrating review:as long as the project team actually controls the front-end interface, operational permissions, governance voting rights or core nodes, the law deems it to possess management capability.
If the regulatory authorities have already issued clear rectification directives regarding issues such as money laundering or illegal information on the platform, and the project team still delays or refuses rectification on technical grounds, this crime may be constituted. The high administrative fines under the new rules may also directly become evidence for criminal conviction.
2. Crime of infringing on citizens' personal information (Article 253-1 of the Criminal Law)
In Web3 projects'KYC verification and real-name node managementandcross-border data transferprocesses, personal information processing is facing stringent penetrating review.
Under the Personal Information Protection Law (PIPL), as connected with the new rules, and the relevant judicial interpretations, collecting sensitive personal information (such as facial recognition data and real-name information) requires "separate consent." The default pre-checked box or broad authorization model commonly used in Web3 may be found to constitute "unlawful acquisition" in criminal law assessment.
The Beijing No. 4 Intermediate People's Court has made clear in a typical case:"Neither the complexity of the technical architecture nor the human and technical costs constitutes a statutory defense to the obligation to protect personal information."This is especially so where KYC data is involved in cross-border transmission: if the statutory security assessment procedure or standard contract filing has not been completed, it is highly likely to be found to constitute "unlawfully providing citizens' personal information to others."
For Web3 entrepreneurs,a lag in compliance awareness is not only the starting point of financial risk, but also a point of contact with criminal red lines.
Practical discussion: how to define liability and prevent personal risk
The new rules substantially raise the upper limit of fines on individuals, and their core purposeIt means piercing the corporate 'veil' to hold the people who actually make the decisions directly accountable.
For the person in charge or the actual controller of a Web3 project, preventing criminal risk cannot rely solely on technical isolation; the key lies in demonstrating that you have fulfilled your compliance obligations at the management level.
1. How do you determine whether it is a 'unit crime' or 'individual liability'?
The key is to assess: was the unlawful conduct a collective decision of the company? Has the person in charge, within the scope of their duties, done their utmost to comply with the rules and prevent risk?
In criminal law determinations, whether you have 'management capacity' does not depend solely on whether you control the code. Judicial authorities will comprehensively examine: where the project's revenues flow, how many users your project has affected, and who substantively drives the development of the project ecosystem. Even if the technical architecture is decentralized, if the boss has decisive influence in commercial operations, the corresponding legal liability cannot be evaded.
2. How can individual risk be effectively isolated?
The key is to demonstrate that the unlawful conduct was not the intent of the company's systems, but rather a violation of the company's existing compliance framework. If an enterprise can do the following, it will be easier for the responsible persons to prove that they'had no criminal intent':
- Conduct regular compliance audits (reference may be made to the first batch of certified audit institutions in this field).
- After receiving a regulatory rectification notice, retain complete execution records, written feedback and evidence of technical improvements.
In this way, effective risk isolation can be established at both the institutional level and the individual subjective level.
Compliance guidance: How Web3 projects should respond to high-pressure cybersecurity regulation
All right, let us explain these four compliance guidelines in plainer language so that everyone can easily understand the logic behind them.
1. Do not decide everything yourself; bring in professional "outside help" to conduct inspections
Do not simply trust your own technical team when it says "there is no problem." You should regularly spend money to engage a nationally recognized professional security company to conduct a comprehensive "health check" of your smart contracts and data protection measures.
This professional health check report is your most important"protective amulet."If a problem arises in the future, it can prove to regulators and courts that you have done your best to implement security measures and have not simply left matters unattended.
2. Break the bad habit of "one-time authorization"
When an App asks you for sensitive data such as your ID card or facial information, there must not be only a single "agree with one click" button.Each item of data to be obtained and the purpose for which it will be used must be clearly listed, so that users can tick their consent item by item.
This both respects users' rights and thoroughly closes the most common loophole that is most easily convicted, namely "illegally obtaining personal information." All consent records must be securely stored and cannot be altered.
3. Respond to regulatory requests "in seconds"; do not pretend not to see them
Designate within the company aA dedicated person responsible for liaising with regulators.After receiving a rectification notice, you must never delay or resist. If a technical measure cannot be implemented for the time being, you must immediately submit a report explaining the difficulties and propose a temporary solution that can be implemented right away.
Thisproactive communication postureis of critical importance. In determining legally whether there is a "refusal to perform," the key factor is your subjective attitude. A proactive response can effectively avoid the most serious criminal liability.
4. Keep the data "safe" domestically, and "file a report" for any outbound transfer
As long as your project hasChinese users,their core data must be stored on servers in China. If the business genuinely requires transferring data abroad, the security assessment or filing procedures with the cyberspace administration authorities must be completed in advance.
Clear rules on data storage and data flowscan keep your business architecture lawful and compliant, and prevent the entire business from being suspended due to cross-border data issues.
Conclusion
In an era of stringent regulation, Web3 projects must pursue not only technological "coolness" but also operational "stability." Use professional audits to demonstrate your efforts, standardized processes to protect users and yourselves, proactive communication to earn regulators' understanding, and a clear structure to safeguard the legal bottom line. This is the path to long-term survival.
For the Web3 industry, the implementation of the new rules in 2026 heralds a profound transformation of the regulatory paradigm. The era of long relying on "technological isolation" to achieve legal circumvention is coming to an end.
Compliance is no longer a marginal cost for enterprises but the foundation for survival in a high-pressure regulatory environment. Practitioners must recognize that technological rationality cannot override the legal order. Only by establishing a compliance framework in advance and building a penetrating legal defense system can technological innovation achieve sustainable evolution within the track of the rule of law.
