In criminal cases involving Web3 projects, the first question investigating authorities tend to ask is often not "what is your job title,"but "where did you lead users?"
An operations staff member may never have touched the company wallet or set token prices, yet was responsible for publishing project promotional content, maintaining community groups, and directing interested users to customer service; a BD staff member may have had no authority to operate the trading backend, yet received commissions based on new registrations, deposit amounts, or transaction volume; a community administrator may appear to do nothing more than answer questions in a group chat, while the actual work includes explaining the profit model, sending account-opening links, and guiding users to purchase USDT and complete deposits.
When the project is later investigated on suspicion of illegal business operations or other issues, the most common question from these employees is: "The business model was decided by the boss; I was only responsible for promotion and never touched company funds, so why is the public security organ still coming after me?"
The answer is neither "anyone who has done operations work must bear liability" nor "anyone who has not touched the money is absolutely safe."Whether an employee bears criminal liability ultimately depends on whether the employee recognized that the project was engaged in illegal or criminal activities, whether the employee's work advanced the core business, and what role the employee actually played in the process of users entering the project, completing transactions, and paying funds.
The illegality of a project's business does not mean all employees will be found to have committed a crime
In February 2026, the People's Bank of China and seven other departments issued the Notice on Further Preventing and Addressing Risks Relating to Virtual Currencies and Other Matters, expressly providing that conducting virtual currency exchange, token issuance and financing, and providing information intermediation, pricing, and other business activities for virtual currency trading within China constitutes illegal financial activities relating to virtual currencies; internet companies may not provide commercial display, marketing and promotion, paid traffic diversion, or other services for such activities.
On July 23, 2026, the Cyberspace Administration of Shenzhen notified a batch of self-media accounts in violation of rules relating to virtual currencies, including accounts such as "USDT Merchant Exchange Group" and "Weizhi Quick Exchange." The notice showed that the relevant accounts were permanently closed by the platform for providing marketing and promotional information on virtual currency business within China and inducing the public to participate in illegal financial activities involving virtual currencies.
It is particularly important to distinguish, however, thatregulatory rules determining that a certain type of business constitutes illegal financial activity, or a certain account being closed by a platform for non-compliant promotion, does not mean that every employee involved automatically constitutes the crime of illegal business operations.
The crime of illegal business operations requires not only that the conduct violate state regulations, but also that the actor actually carried out a specific illegal business operation or other business conduct seriously disrupting market order, and that the conduct reaches the threshold of "serious circumstances." If an employee is to be assessed as a joint offender, it must also be proven that the employee shared a joint criminal intent with others and participated in or assisted the commission of the crime through specific conduct.
The adjudication rules reflected in Guiding Case No. 97 of the Supreme People's Court also indicate that an administrative violation cannot be directly equated with the crime of illegal business operations. When applying the crime of illegal business operations, it remains necessary to examine whether the relevant conduct has the corresponding social harm, criminal illegality and necessity for criminal punishment.
Therefore, in determining whether a Web3 employee bears criminal liability, one cannot look only at whether the project was ultimately investigated, nor only at whether the employee ever received a salary from the company; rather, one should return to the business chain in which the individual actually participated.
Operations, BD and community user acquisition may move from a "promotional role" into the project's business operations chain
General brand operations primarily involve content drafting, event execution, media dissemination and community maintenance, and such work is not directly equivalent to organizing user transactions. However, in some Web3 projects, there is no genuine separation between brand promotion, user solicitation, account-opening links, asset deposits and transaction conversion.
For example, operations personnel continuously publish promotional content such as "principal-protected returns", "fixed returns", "low-price subscriptions" or "large-amount acceptance"; after users see the content, they are guided to join private-domain groups, where community personnel then send transaction links, wallet addresses or deposit tutorials; BD, in turn, is responsible for liaising with KOLs, agency teams and community channels, and receives commissions based on user registrations, deposit amounts or transaction volume.
Under this model, front-end promotion is no longer merely independent brand work but may become a necessary component of the project's completion of business activities. Investigative authorities typically examine step by step along the user conversion path: where users learned of the project, who established trust, who explained the product and returns, who sent account-opening links, who guided the purchase of USDT, completion of KYC and deposits, who urged users when they hesitated, and who received commissions based on the final transaction amount.
Therefore,whether an employee has operated the company wallet is not the sole criterion for assessing risk.For a project that relies on community customer acquisition and private-domain conversion, continuously and precisely drawing domestic users into the transaction process may itself provide substantive assistance to the project's business operations.
To assess employee risk, four business chains can be reconstructed
Whether operations, BD and community personnel have moved from general auxiliary roles into the project's core business operations can be assessed from four dimensions: the content chain, the customer acquisition chain, the transaction chain and the funds chain.
This table is not a mechanical standard for determining whether a crime is established.Even if an employee has performed one of these tasks, a guilty conclusion cannot be reached directly in isolation from their working hours, scope of authority, subjective knowledge, and the actual model of the project.
However, when high-risk conduct across the four chains continues to accumulate, the employee can already see users moving from promotional content into the community, completing account opening, paying funds, and ultimately forming transactions, and the employee's own returns are directly linked to transaction amounts, the difficulty of explaining all of their conduct on the basis that "I was only responsible for posting content" will increase markedly.
Why might "I did not know the business was illegal" still be subject to review?
In employee cases, the core dispute is usually not whether the employee participated in the work, but whether the employee knew that the project's business carried a risk of illegality or criminality.
As to subjective knowledge, the case-handling authorities will not make a judgment based solely on the employee's own statement that "I did not know" or "the boss did not tell me"; rather, they will conduct a comprehensive review in light of work authority, internal communications, user complaints, compensation models, regulatory prompts, and subsequent conduct.
For example, whether the company internally and explicitly discussed that it could not conduct business directed at domestic users, yet required employees to continue recruiting new users through Chinese-language communities; whether it required words such as "recharge," "transaction," and "returns" to be replaced with code words; whether the project frequently changed domains, communities, and payment-collection accounts; whether the employee received platform bans, bank freezes, user inability to withdraw funds, or risk reminders raised by compliance personnel; and whether, after abnormal circumstances had already emerged in a concentrated manner, the employee still continued to recruit new users and urge users to pay funds.
The existence of any one of these circumstances alone cannot directly prove that the employee has committed a crime. However, if multiple abnormal facts persist and recur over a long period while the employee continues to drive user transactions, these facts may collectively affect the assessment of the employee's subjective knowledge.
Conversely, if the employee had a relatively short tenure, received only a normal fixed salary, did not participate in return promises, transaction guidance, or fund handling, genuinely lacked a comprehensive understanding of the project's overall business model, and promptly stopped the relevant work, raised objections, or voluntarily resigned after discovering abnormalities, then these facts should all be fully examined in the determination of liability.In a case we previously handled, we organized the evidence precisely around the client's tenure, compensation structure, position authority, actual scope of participation, and conduct in response to discovered abnormalities, and submitted complete defense opinions on that basis, ultimately achieving the favorable result of non-prosecution.
Does lacking decision-making authority and merely following the boss's arrangements necessarily mean exemption from liability?
Joint crime under criminal law does not require every person to participate in all stages. In a project, the person in charge may be responsible for designing the business model, technical personnel for building the system, operations and BD for acquiring users, customer service for guiding transactions, and finance for fund settlement. Although the conduct carried out by different positions differs, it may jointly drive the same business operation.
If operations, BD, or community personnel clearly knew that the project's core business was illegal yet still bore responsibility on a long-term and stable basis for user solicitation, transaction conversion, or fund assistance, they may be included in the assessment of joint crime.The fact that an employee did not decide the business model, performed only part of the tasks, or earned less than the project leader does not automatically preclude the establishment of a crime, but it will affect the employee's status in the joint crime and the extent of his or her responsibility.
Criminal law provides that persons who play a secondary or auxiliary role in a joint crime are accessories, and accessories shall, in accordance with law, be given a lighter or mitigated punishment or be exempted from punishment. Therefore, even if an employee has been found to have participated in a joint crime, ordinary executing personnel cannot be assessed in the same way as project initiators, actual controllers and core management personnel.
Typical cases involving foreign-exchange-related illegal and criminal activities jointly released by the Supreme People's Procuratorate and the State Administration of Foreign Exchange also show that platform leaders, ordinary staff, virtual currency traders and account providers within the same business system may bear different responsibilities depending on their specific division of labor, subjective knowledge and participatory conduct. The focus of review in the relevant cases includes chat records, bank statements, transaction records, wallet addresses and the actual division of labor among personnel.
Important work for lawyers in such cases is to separate the company's overall business from the employee's individual conduct, and to clarify when the employee joined, what authority the employee held, which users and transactions the employee actually participated in, what benefits the employee obtained, whether the employee knew the true model of the project, and how much effect the employee's conduct had on the project's operating results.
After a project is investigated, what evidence should employees preserve as a priority?
When the project leader becomes unreachable, the company group chat is suddenly dissolved, or employees receive notice from a public security authority, the least advisable course of action is to immediately delete chat records, withdraw from all groups, or discuss a unified account with colleagues. Such actions may cause the loss of evidence favorable to the employee, and may also be understood as an attempt to evade investigation.
Employees should preserve as a priority their labor contracts, job descriptions, salary records, performance rules, work instructions and actual deliverables, while fully retaining communication records with superiors, clients and other departments. As for wallets, back-end systems and fund accounts to which they have no right of access, they also need to explain, through work authority records, approval processes or internal communications, the boundary between themselves and the relevant links.
If an employee has previously raised objections to project risks, refused to participate in collecting payments through personal accounts, requested the removal of promotional content exaggerating returns, or voluntarily resigned after discovering anomalies, the relevant records in particular need to be preserved promptly.
Conversely, if the employee did in fact participate in user top-ups, fund pooling or trading guidance, it is also inadvisable to explain this only in general terms such as "I am an ordinary employee"; instead, the time of participation, the users involved, the transaction amounts, the specific operations and the source of instructions should be accurately set out.Whether an employee bears responsibility must be established on the basis of complete facts, rather than judged by a job title.
Lawyer Observations
For operations, BD and community work in Web3 projects, the risk often lies not in the job title, but in the way the position connects to business results.
Merely drafting general copy, organizing brand events, or maintaining ordinary community groups does not automatically constitute the crime of illegal business operations. However, once an employee's work has continuously facilitated domestic users in opening accounts, purchasing USDT, making deposits, subscribing, or participating in unlicensed financial business, and the employee's income is directly tied to user deposits or transaction volumes, the relevant risk can no longer be simply understood as 'the company's matter.'
For employees, what truly needs to be preserved is not the statement 'I was just working for someone else,' but complete evidence capable of proving one's scope of work, boundaries of authority, compensation structure, and subjective knowledge. For project parties, all customer solicitation and transaction conversion activities likewise cannot be packaged as 'brand operations'; instead, they should re-examine where the promotional content ultimately directs users, and what function employees actually perform in the customer, transaction, and fund chains.
A project being unlawful does not mean all employees are guilty; and not having touched the company's wallet does not necessarily mean there is no risk.Criminal liability must ultimately be attributed to specific individuals, distinguishing who designed the business, who determined its direction, who drove transactions, who controlled the funds, and who merely completed general work within a limited scope.
/ END.
*This article is an original work of Mankun Law Firm and represents only the personal views of the author. It does not constitute legal consultation or legal advice on any specific matter. For reprinting and legal consultation, please contact our customer service: mankunlawyer.
About the Lawyer
