Shanghai police case puts Web3 payment platforms’ legal boundary under scrutiny

Shanghai police on Aug. 27 disclosed a virtual-asset-related economic crime case that is drawing attention from the Web3 payments sector. According to the notice, police arrested nine suspects and said the case involves more than 200 million yuan. Five people have been approved for arrest by prosecutors on suspicion of illegal business operations, while the others remain subject to criminal coercive measures. The investigation is still ongoing. At first glance, the scheme looked more like a FinTech product than a traditional underground money service. The suspects set up a technology company and built two online platforms: one for “cross-border funds exchange” and another for “virtual credit card issuance and settlement.” Users could top up with virtual currency, exchange across multiple currencies, apply for virtual cards, and repay spending inside the platforms. Revenue came from transaction fees, consumption service fees, card issuance fees, and withdrawal fees. If one only reads the product pages, features such as USDT top-ups, global spending, multi-currency exchange and virtual card payments are all familiar to the Web3 payments industry. Similar products already exist in overseas markets. The real question here is not whether a virtual card can be offered. It is how the business changes once stablecoins are added and the platform begins handling exchange, card loading and cross-border settlement on its own. The police notice says the “cross-border funds exchange” platform collected users’ virtual currency overseas, converted it into foreign currency to form a pool of funds, and then used false cross-border settlement arrangements to move value between virtual currency and RMB. In the separate “virtual credit card issuance and settlement” platform, the people involved worked with a virtual card operator to provide virtual cards to customers. After users spent through the card, they repaid with virtual currency. The platform then converted the crypto into foreign currency overseas and completed settlement with the card operator through false cross-border settlement arrangements. That means the case is no longer about a single card-issuing function. It is about a closed-loop financial service that covers receiving virtual currency, converting it into foreign currency, moving cross-border funds, settling card transactions and charging users along the way. Many Web3 payment products start with a simple idea: users hold USDT, but merchants in daily life accept USD, HKD or other fiat currencies. Could a card make those digital assets easier to spend? The risk appears when a product starts pulling together functions that are normally split across different licensed entities. A user deposits USDT into a platform account. The platform calculates how much USD that can be converted into. The user then applies for a virtual card, and the platform loads the converted value into the card system. After spending, the platform handles the sale of virtual currency, foreign-currency payment and cross-border settlement, with the funds path, exchange price and settlement arrangement all managed by the same operator. At that point, the platform is no longer just providing a technical interface or a card management page. It may be engaging in virtual currency exchange, money transfer and cross-border payment settlement, all of which are regulated functions. The article cites a February 2026 notice from the People’s Bank of China and seven other agencies, which says activities such as exchanging legal tender for virtual currency, exchanging virtual currencies for each other, acting as a central counterparty in virtual-currency trading, and providing information intermediation and pricing services for virtual-currency transactions are illegal financial activities and strictly prohibited. It also says overseas entities and individuals may not illegally provide virtual-currency-related services to domestic entities in any form. In parallel, payment services that transfer monetary funds based on users’ electronic payment instructions require the relevant licenses under current payment rules in China, while overseas institutions serving domestic users in cross-border payments must also deal with payment, foreign exchange, cross-border RMB and data compliance requirements. For Web3 payment products aimed at users in mainland China, the real question is not whether the card is issued by an overseas company. The question is who handles the exchange, account, payment and settlement steps after the first USDT enters the system, and what role the domestic team actually plays. Real-world Crypto Card projects are usually structured through multiple parties. A licensed offshore institution issues the card, a BIN sponsor runs the card program, a payment institution handles settlement, and the Web3 project focuses on the wallet, user interface, technical development and customer operations. That structure is clearly different from a single company building everything itself. But criminal and regulatory analysis cannot stop at the labels used in contracts. If the contract says an offshore partner is responsible for payments and card issuance, yet the domestic team is acquiring users in China, quoting USDT-to-USD prices, controlling the wallet used for deposits, deciding when assets are exchanged, arranging withdrawals and refunds, and earning revenue based on deposits or exchange volume, then the words “technical service provider” do not fully describe the actual business. On the other hand, if the domestic team truly only provides software development, API integration or other technical capabilities, does not control customer funds, does not set exchange prices, does not participate in virtual currency trading or fiat settlement, and does not directly provide related financial services to domestic users, then its conduct should be judged on that basis alone. A product’s final link to virtual currency and card networks does not automatically make the technical partner the same as the funds operator. That is why money-flow diagrams matter more than equity charts when Web3 payment projects are built. Which company owns the shares only shows the commercial relationship. What really determines each party’s role is where the customer’s USDT goes, who can move it, which entity performs the exchange, which account receives fiat, who pays the issuer, and who ultimately takes the fees. Another key signal in the Shanghai case is “false cross-border settlement.” According to the police notice, the cross-border funds business involved fabricating false reasons for cross-border settlement. In the virtual card settlement business, after converting crypto into foreign currency overseas, the group also used false cross-border settlement arrangements to settle with the virtual card operator. This means the issue is not only how USDT becomes dollars. It also concerns why cross-border funds are able to enter normal financial channels under a trade, service or other label. For genuine cross-border payment companies, that is a major point. Normal international settlement usually requires a verifiable transaction background, whether it is goods trade, software services, advertising, technical services or another real commercial activity, and that background has to match contracts, orders, invoices or other business documents. If money is brought back from overseas by creating fake contracts, inventing services or borrowing a trade background unrelated to the actual business, the legal risk is no longer limited to virtual-asset rules. Foreign exchange control and other funds-related risks may also come into play. The biggest warning sign for a stablecoin payments project is not the appearance of a “USDT top-up” button. It is the back-end process that keeps adding payment arrangements that cannot be explained by a real commercial relationship. For teams building stablecoin payments, Crypto Card, PayFi or global pay-in/pay-out products, the safest starting point is to run the product end to end and ask six questions. First, what asset does the user give to whom? If mainland users send USDT directly to a wallet controlled by the platform, the key issue is whether the platform is merely providing technical custody or has actual control over the asset. Second, who sells the USDT? Is it a regulated offshore financial or crypto institution converting under local rules, or is the project team sourcing counterparties, quoting one price and handling the payout itself? Third, where does the fiat go? If the converted funds land in an account controlled by the project and the project then arranges payment, the money role is much heavier than that of a simple API provider. Fourth, who issues the card and bears settlement responsibility? A logo on the card does not replace confirmation of the actual issuer, BIN sponsor, payment institution and settlement entity. Fifth, what is the customer really buying? Using an overseas payment card is not the same as asking a platform to turn USDT into dollars and pay out abroad on the user’s behalf. Sixth, how does the platform make money? Software subscriptions and technical service fees are different from spreads, withdrawal fees and settlement fees charged on exchange volume. The 200 million yuan case matters because it shows a common platform trend: functions that used to be split across dealers, exchange shops, payment institutions, card issuers and cross-border settlement providers are now gathered behind one user interface. The experience is smoother, but the financial functions handled by the platform are broader. So when people discuss the legal risk of a Crypto Card, stablecoin payment or PayFi project, the useful question is not whether virtual credit cards are legal in the abstract. The useful question is which regulated financial functions the platform has absorbed into its own hands in order to make the product work.