On August 27, while briefing on new types of economic crimes involving virtual assets, the Shanghai police disclosed a case that merits close attention from the Web3 payments industry.
Screenshot of news report | Compiled from public reports
Unlike a traditional underground bank, this case looked more like a FinTech company in terms of product form: the criminal suspects established a technology company and built two platforms on the internet, namely a "cross-border fund exchange" platform and a "virtual credit card issuance and settlement" platform. Users could complete virtual asset top-ups, multi-currency cross-border exchange, virtual credit card applications, and consumption repayments within the platforms, while the platforms profited through transaction fees, consumption service fees, card application fees, and withdrawal fees.
According to the police briefing, nine criminal suspects were apprehended in this case, involving more than RMB 200 million. Five of them have been approved for arrest by the procuratorate on suspicion of the crime of illegal business operations, and criminal coercive measures have been taken against the remaining persons. The case is still under further investigation.
Looking only at the product pages, "USDT top-up," "global consumption," "multi-currency exchange," and "virtual card payment" are all functions very familiar to the Web3 payments industry, and quite a few similar products already exist in overseas markets. Therefore, what truly merits study in this case is not "whether virtual credit cards can be offered," but rather what changes legally in the nature of the business when a payment product adds stablecoins and gradually moves from technical services and card services toward fund exchange and cross-border settlement.
I. The issue is not "whether there is a virtual card," but how many financial steps the platform itself performed
A virtual credit card is not a product that inherently carries criminal attributes.
In the global payments market, the combination of bank card networks and digital assets has already produced a variety of mature models. For example, some Crypto Card products allow users to make payments using crypto assets, but in the actual payment chain, crypto assets usually need to be converted into fiat currency before entering the traditional bank card payment network, and merchants ultimately still receive legal tender. Behind the entire product, multiple distinct steps are often involved, including regulated financial institutions, card issuers, card organizations, KYC, anti-money laundering, sanctions screening, and ongoing transaction monitoring.
This overseas model certainly cannot directly serve as a basis for the legality of business within China, but it can help us understand a very important industry logic: behind "a card that can spend USDT" is not simply a connection between a wallet and a bank card, but rather multiple independent steps such as digital asset conversion, fiat funds, card issuance, clearing, and merchant settlement. Who completes each step and on the basis of what qualifications is precisely what legal review truly cares about.
The reason the case disclosed by the Shanghai police this time merits attention is precisely that the platforms involved did not merely provide a card entry point.
According to the police briefing, on the "cross-border fund exchange" platform, the persons involved collected customers' virtual assets overseas and exchanged them into foreign currency to form a fund pool, and then, by fabricating false grounds for cross-border foreign exchange settlement, achieved the exchange and transfer between virtual assets and RMB. On the other "virtual credit card issuance and settlement" platform, the persons involved cooperated with virtual card operators to provide virtual credit cards to customers; after users made payments, they repaid with virtual assets, and the platform then converted the virtual assets into foreign currency overseas and completed settlement with the virtual card operators through false cross-border foreign exchange settlement.
In other words, what needs to be analyzed in this case is no longer a single "card issuance" act, but an entire closed-loop financial service covering the collection of virtual assets, exchange into foreign currency, organization of cross-border funds, completion of card settlement, and charging fees to users.
II. Once a platform completes “coin-to-fiat conversion” for customers, the nature of its business begins to change
Many Web3 payment products may initially have sought to solve a very simple problem: users hold USDT, but everyday merchants accept only US dollars, Hong Kong dollars or other fiat currencies—can a card make these digital assets more conveniently usable for payment?
What truly warrants vigilance is that, to deliver this experience, the product gradually brings in-house all the capabilities that were originally the responsibility of different licensed entities.
For example, a user first deposits USDT into a platform account, and the platform calculates, at its own price, how many US dollars the deposit can be exchanged for; the user then applies for a virtual card, and the platform loads the converted value into the card system; after a purchase occurs, the platform is also responsible for handling the sale of virtual currency, foreign-currency payment and cross-border settlement, so that ultimately all fund paths, conversion prices and settlement arrangements are completed uniformly by the platform.
At this stage, what the platform provides is no longer merely a technical interface or a card management page, but may simultaneously involve multiple regulated links, including virtual currency exchange, monetary fund transfer and cross-border payment settlement.
In February 2026, the People's Bank of China and seven other departments issued the Notice on Further Preventing and Handling Risks Relating to Virtual Currency and Other Matters, which expressly provides that conducting, within the territory, business activities such as the exchange between fiat currency and virtual currency, exchange between virtual currencies, buying and selling virtual currency as a central counterparty, and providing information intermediation and pricing services for virtual currency transactions, constitutes illegal financial activity and is strictly prohibited, and further provides that overseas entities and individuals may not, in any form, unlawfully provide virtual-currency-related services to entities within the territory.
At the same time, engaging within the territory in payment business such as transferring monetary funds according to users' electronic payment instructions requires obtaining the corresponding licence under the prevailing payment regulatory rules, and overseas institutions providing cross-border payment services to users within the territory also need to further consider the different regulatory requirements relating to payment, foreign exchange, cross-border RMB and data.
Therefore, for Web3 payment products targeting users within China, what should truly be answered in advance is not “our card is issued by an overseas company, so is there no problem?”, but rather, starting from the moment a user hands the first USDT into the system, who completes the subsequent conversion, account, payment and settlement respectively, and what business functions the domestic team actually performs in that process.
III. “Cooperating with an overseas licensed institution” matters, but one cannot look only at who is stated in the contract to be responsible
In reality, Crypto Card projects are usually not structured with a Chinese technology company itself applying for Visa or Mastercard issuing qualifications; instead, more complex cooperation structures are used—for example, an overseas licensed institution provides the card, a BIN Sponsor is responsible for the card programme, another payment institution is responsible for settlement, and the Web3 project party mainly undertakes the wallet, user interface, technical development and customer operations.
Such a structure is of course materially different from “building a platform oneself and completing all fund business oneself”, but criminal and regulatory analysis still cannot stop at the role names in the contract.
Suppose the contract states that “the overseas counterparty is responsible for payment and card issuing”, but in actual operations the Chinese team is responsible for soliciting users within the territory, quoting USDT-to-USD prices, controlling the users' deposit wallets, deciding when assets are converted, arranging withdrawals and refunds, and at the same time earning income based on deposit volume or conversion amounts—then the label “technical service provider” in the contract cannot fully explain its true business.
Conversely, if the domestic team genuinely provides only software development, API integration or other technical capabilities, does not control client funds, does not determine exchange prices, does not participate in virtual currency trading or fiat settlement, and does not directly provide relevant financial services to domestic users, then it should be assessed independently based on its actual conduct, and the technical partner must not be treated as the same actor as the fund-operating entity merely because the product ultimately becomes connected with virtual currency and bank cards.
This is also why, when Web3 payment projects design their business architecture, the fund-flow diagram is often more important than the equity-structure diagram. Which company holds shares in the project can illustrate commercial relationships, but which wallet the client's USDT enters, who can move it, at which entity the exchange occurs, into which account fiat currency enters, who pays the card issuer, and who ultimately receives the fees are what truly determine what business each entity actually undertakes.
IV. Another noteworthy signal in the Shanghai case is "fictitious cross-border foreign-exchange settlement"
If one discusses only stablecoin exchange and virtual cards, it is easy to overlook a more traditional but legally highly significant detail in this case.
Police disclosed that, in the cross-border fund business of the relevant platform, the criminal group engaged in "cross-border foreign-exchange settlement based on fabricated grounds"; in the virtual credit card settlement business, the group likewise, after exchanging virtual currency into foreign currency overseas, completed settlement with the virtual card operator by means of fictitious cross-border foreign-exchange settlement.
This means the case is no longer merely a question of "how USDT is exchanged into US dollars"; it also concerns why cross-border funds are able to enter formal financial channels under some trade, service or other designation.
For genuine cross-border payment enterprises, this point deserves particular attention, because normal international settlement often requires the transaction background to be explainable—whether it is trade in goods, software services, advertising fees, technical service fees or other genuine commercial transactions, it needs to correspond to contracts, orders, invoices or other business materials; if, in order to settle funds from overseas back into the mainland, contracts are artificially created, services are fabricated, or trade backgrounds unrelated to the genuine business are borrowed, then the legal issues facing the product are no longer limited to virtual currency regulation and may further involve foreign-exchange administration and other fund-business risks.
Therefore, what warrants the most vigilance in stablecoin payment projects is not a product manager adding a "USDT top-up" button to a page, but the backend, in order to make the money ultimately flow through, beginning to continuously add fund arrangements that cannot be explained by genuine commercial relationships.
V. To judge whether a Web3 payment product has crossed a boundary, one may first examine six fund relationships
If the Shanghai case and the current regulatory rules are considered together, teams currently designing stablecoin payment, Crypto Card, PayFi or global collection and payment products may, without first discussing complex legal terminology, run through the product in its entirety.
First
What asset the user actually delivers, and to whom. If domestic users directly deliver USDT to a wallet controlled by the platform, it is necessary to further confirm whether the platform merely provides technical custody or has already formed actual asset control.
Second
Who was responsible for selling the USDT? Was the exchange completed by a regulated offshore financial or crypto institution in accordance with local rules, or did the project team itself seek out crypto dealers, set a uniform quote, and complete the settlement?
Third
Whose account does the fiat currency enter? If the converted funds enter an account controlled by the project itself and the project then arranges payment in a centralized manner, the financial role it assumes will be significantly heavier than merely providing API technical services.
Fourth
Who ultimately issues the card and bears settlement responsibility? The appearance of a certain brand logo on the card cannot substitute for confirming the actual issuer, BIN sponsor, payment institution, and settlement entity.
Fifth
What is the actual service the customer is purchasing? If the user is merely using an overseas payment card, compared with the user directly requesting "exchange my USDT into US dollars and pay on my behalf to an overseas recipient," the underlying business needs are not the same.
Sixth
How does the platform make money? Software subscription fees and technical service fees, as compared with charging a spread, withdrawal fees, and fund settlement fees based on the exchange amount, have different explanatory significance for the true nature of the platform's business.
Lawyer's Observation
The reason the RMB 200 million case disclosed this time by the Shanghai police is worthy of attention from the Web3 industry is that it demonstrates a very typical platformization trend: functions originally dispersed among crypto dealers, currency exchange institutions, payment institutions, card-issuing institutions, and cross-border settlement institutions have been integrated by an internet platform into a single user entry point. The user experience has indeed become smoother, but the financial functions assumed by the platform have also increased accordingly.
Therefore, when discussing the legal risks of Crypto Card, stablecoin payment or PayFi projects, asking only whether a virtual credit card is lawful often yields no genuinely useful answer. A more effective approach is to trace the funds backward transaction by transaction, separating digital asset conversion, control of monetary funds, payment instructions, card issuance, cross-border settlement and fee models, and then determining, for each stage, which entity completes it and under which rules.
The fact that a large number of mature Crypto Card products already exist overseas does not mean that the same product structure can be replicated for users in mainland China without adjustment; likewise, a project's use of an overseas company, an overseas card network or an overseas partner does not automatically change the legal nature of the conduct actually carried out by the domestic team.
For Web3 payment projects, the real product boundary lies not in whether users can be enabled to pay with USDT via a card, but in which financial capabilities that should each be subject to separate regulation the platform has brought within its own hands in order to achieve that step.
