"The company is in Singapore, and I work remotely from Shanghai—there shouldn't be any problem, right?"
This is the judgment that many Web3 practitioners most easily arrive at after receiving an offer from an overseas project.
Nowadays, many exchanges, wallets, payment platforms, blockchain games, DeFi projects and crypto infrastructure companies have adopted a globally distributed employment model. The corporate entity may be registered in Singapore, Hong Kong, Dubai or the BVI, management may be based overseas long-term, and servers may be deployed outside the jurisdiction, yet R&D, operations, customer service, business development and even part of the treasury team may work remotely long-term from Shanghai, Shenzhen, Hangzhou and other cities. Employees usually collaborate through Telegram, Slack, Notion and GitHub, and salaries are paid by the overseas company in US dollars, Hong Kong dollars or USDT.
On its face, this is a very typical "overseas job."
But for Web3 remote practitioners, the misconception most easily formedis to understand "overseas company" directly as "overseas legal regulation."In reality, business is often not that simple. A company may be registered in Singapore, its servers may be located outside the jurisdiction, and its team members may be distributed across multiple countries, yet the actual users, operations, technical support and money flows may continue to occur within mainland China.
Therefore, to judge whether this type of work carries risk, one cannot look only at the company's place of registration; one must go on to examine two questions:whom this business actually serves, and which part you yourself actually participated in.
I. A company being overseas does not mean PRC criminal law is necessarily unable to reach it
When judging the risk of a Web3 job, many practitioners first look at the company's place of registration, the location of its servers and the entity that signed the labor contract. If all these elements are overseas, it is easy to conclude that the business has little to do with PRC law.
Criminal law analysis does not simply follow the business license.
Article 6 of the Criminal Law provides that the Criminal Law of China applies to crimes committed within the territory of the People's Republic of China, unless otherwise specially provided by law; where either the act or the result of a crime occurs within the territory of the People's Republic of China, the crime is deemed to have been committed within the territory of the People's Republic of China.
This means that if a person, over a long period, performs customer operations, technical development, back-office management, payment instructions, or other acts alleged to form part of a crime while sitting at home in Hangzhou, then the facts that the company is incorporated in Singapore, its servers are located overseas, and its boss resides in Dubai for long periods cannot by themselves automatically exclude the possibility that Chinese judicial authorities will assess and convict the conduct in question.
A distinction must, however, be drawn here:Having a basis for criminal jurisdiction is not the same thing as ultimately finding a crime established.
Jurisdiction addresses whether Chinese judicial authorities have the power to handle the case in question, whereas whether an employee ultimately bears criminal liability still requires further determination of whether the project itself is suspected of a crime, what acts the employee performed, whether the employee actually participated in the relevant business, and what subjective understanding the employee had of the nature of the project.
Therefore, "the person works remotely from within China" is not in itself a conclusion on criminal liability, nor is "the company is overseas" a conclusion of exemption; both are merely factors in the subsequent case analysis.
II. Compliance of an overseas business in its local jurisdiction does not mean the same services may be provided directly to mainland China
Another common judgment is: "This company holds a license in Dubai, so there should be no problem."
An overseas license is of course important information, but it first addresses whether the relevant entity may conduct the corresponding business locally; it does not naturally lead to the conclusion that the same business may be provided as-is to users in mainland China.
In February 2026, the People's Bank of China and seven other departments issued the Notice on Further Preventing and Addressing Risks Relating to Virtual Currency and Other Matters, which continues to make clear that the following business activities are prohibited within China: exchange between legal tender and virtual currency, exchange between virtual currencies, central counterparty trading, trading information intermediation, and pricing; it also provides that overseas entities and individuals may not, in any form, unlawfully provide virtual-currency-related services to entities within China; and that where domestic entities and individuals, while knowing or being ought to know that an overseas entity is unlawfully providing relevant services within China, still provide assistance to it, the relevant liability shall be pursued in accordance with law, and where the elements of a crime are satisfied, criminal liability shall be further pursued in accordance with law.
This is also why, when assessing the risk of an overseas Web3 company, its operating model and the users it serves deserve more attention than its place of incorporation.
An overseas trading platform that mainly serves local or international users, does not specifically operate Chinese-language communities, and has not designed account opening, deposit, and promotion pathways targeting mainland China is, from the perspective of Chinese law, clearly not the same business structure as another platform that, although likewise incorporated overseas, has long maintained a person in charge of the Chinese market, developed domestic KOLs and agents, operated Chinese-language user groups, and continuously resolved registration, deposit, trading, and withdrawal issues for mainland users.
Likewise, where an overseas technology company provides ordinary blockchain infrastructure to overseas clients, and an onshore team directly assists a platform in completing virtual currency exchange, trading, or fund settlement for mainland users, these situations must also be assessed separately.
Overseas compliance addresses whether an activity can be carried out locally; it cannot substitute for determining whether the service can be provided to users within mainland China.
III. What remote employees truly need to focus on is how close they are to the core high-risk business
Remote work can easily give employees a sense of distance: because there is no office, they have never met the boss in person, and they have no direct contact with users, many people believe they are merely external executors.
However, in a specific case, the place of work and the distance from the business are not the same concept.
An operations staff member responsible for English-language content for overseas markets and an operations staff member who maintains Chinese-language communities over the long term, publishes account-opening links, and has performance calculated based on mainland users' registration and top-up activity do not have the same actual degree of involvement; an engineer responsible for ordinary logging systems, server stability, and general components and an engineer who, in accordance with business requirements, develops features to circumvent regional restrictions, weaken KYC identification, or process anomalous funds cannot simply be classified as the same type of "technical support"; and a customer service representative who only handles password resets and product malfunctions and a customer service representative who over the long term guides mainland users through OTC payments, RMB purchases of coins, and anomalous withdrawals likewise differ markedly in the information they are able to grasp about the true state of the business.
Therefore, when assessing individual responsibility, job titles are usually of limited reference value; what truly needs to be reconstructed is what tasks the employee actually completed each day, which customer and fund information the employee could access, whether the employee was aware of anomalies in the project's operations, and what connection exists between that work and the core business under investigation.
Particularly for technical, operations, business, and customer service personnel, risk does not disappear because of remote work, nor does it automatically arise because a person holds a certain position; the key still lies in the specific content of the work.
IV. Telegram, USDT salaries, and overseas contracts are merely evidentiary facts, not criminal labels
Another feature of Web3 remote work is that many of the formalities of a traditional employment relationship have changed.
An employee may have no domestic employment contract and may have signed only a Consulting Agreement with a Hong Kong or Singapore company; wages are not paid through a domestic bank on the company's behalf, but are paid monthly in USDT from the company's wallet; work tasks are not assigned through OA approvals, but are issued directly in Telegram groups, Slack channels, and GitHub Issues, and some bonuses may even be calculated directly based on Tokens or project revenue.
These phenomena are themselves very common and cannot simply be understood as evidence of illegality.
Using Telegram does not amount to criminal intent, receiving USDT as salary does not directly prove that an employee participated in virtual-asset crime, and signing a consultancy agreement with an overseas company certainly does not automatically change the criminal character of the work.
What truly merits attention is that, after a case arises, these materials may be used to reconstruct a person's actual working situation.
Chat records can show what requirements an employee received, GitHub commit records can show what functions the employee specifically developed, backend permissions can show which user and transaction data the employee could see, and fixed salary, token rewards and business commissions may further explain the relationship between the individual's interests and the platform's core business.
Therefore, for remote workers, keeping a normal work trail is very important, including contracts, job descriptions, requirement records, code commits, business emails, meeting minutes, compliance communications and salary records. These materials are first of all part of normal project management, and if a dispute arises in the future, they can also help explain what a person was actually responsible for, the extent of that person's permissions, and whether the boundaries of the work ever changed.
V. When a project exhibits these changes, employees should reassess their own work
The risks of a Web3 project are often not fully exposed on the first day of employment; rather, they gradually change in the course of operations. Therefore, checking a company's background only once before accepting an offer is not sufficient to cover the entire work cycle.
A wallet project that was originally normal may gradually onboard a large number of high-risk merchants of unknown origin and require the technical team to lower risk-control standards; a trading platform may begin to visibly develop agents in mainland China and use Chinese-language communities to guide domestic users to circumvent regional restrictions; a blockchain game may gradually build its main revenue on user top-ups, random betting and fund returns; and a so-called investment project may begin to require its operations team to promote fixed annualized returns, principal-guaranteed returns or multi-level recruitment commissions.
For employees, what truly matters about these changes is that they continuously alter the information an individual can access.
If customer service frequently receives tickets involving fraud, gambling, freezes and complaints, the technical team is repeatedly asked to disable certain risk-identification rules, operations visibly begin promoting to domestic users, and finance and business staff continuously come into contact with abnormal funds of unexplained origin, then when the employee continues to participate in the business thereafter, the judicial authorities' assessment of the employee's subjective knowledge may be markedly different from that at the initial stage of employment.
Therefore, assessing whether a Web3 job is safe is a dynamic judgment that must be reassessed as the environment and business stage change.
The project changes, and employees' understanding of the project changes accordingly.
VI. After a project is investigated, individual responsibility cannot be explained merely by saying that "the company is overseas"
If a project later becomes subject to a criminal investigation, the explanations employees most readily resort to are usually:
The company is abroad, and I have never been to the office; the boss is also a foreign national; all the servers are overseas; I never touched clients' money; my salary was only a fixed monthly amount.
These facts are of course all worth analyzing, but none of them, taken alone, is sufficient to account for the full extent of individual liability.
A specific case usually requires reconstructing when the employee joined the project, which modules they were responsible for, what back-end permissions they held, what user and fund information they could see, whether they were in contact with business within mainland China, whether they participated in account and fund arrangements, when they began to notice anomalies, and what tasks they continued to complete after those anomalies arose.
Among employees of the same overseas project, one person may have participated only briefly in ordinary technical development with almost no exposure to the core business; another may have long been responsible for domestic clients, RMB deposits, or key fund channels; and another, despite holding a relatively junior position, may have been able to participate directly in the core business and earn returns based on transaction volume. The actual position of such persons within the project plainly cannot be assessed uniformly on the basis that "they are all remote employees."
Therefore, in a criminal case, what truly merits examination is the individual's time of participation, permissions, conduct, knowledge, and gains, rather than the job title on the labor contract or where the project's official website states it is located.
Lawyer's Observations
Remote work has become a very common organizational model in the Web3 industry. Therefore, "working from within China for an overseas project" should not in itself be treated as an unusual career choice. However, such work does readily create a sense of distance, leading practitioners to mistakenly believe that once the company, the boss, and the servers are all overseas, their daily work is naturally far removed from PRC law.
In reality, the risks of a remote job usually need to be assessed at three levels simultaneously: what business the project itself actually operates, which users and funds that business actually serves, and what work the employee personally completed within mainland China.
The company's place of registration, the contracting entity, the currency in which wages are paid, and the manner of working may all form part of the factual assessment, but none of them can replace an analysis of the actual business.
For Web3 workers, what is truly worth clarifying before joining is not "whether this company is an overseas company," but "what exactly am I helping this company accomplish every day while sitting at a computer in China."
