Web3 and Crypto Compliance Red Lines for China-Linked Projects

China red lines: the prohibition framework#

Since the 2017 policy package and the September 2021 notice on further preventing and disposing of virtual-currency transaction speculation risks, Chinese authorities have treated cryptocurrency exchange services aimed at mainland residents and token fundraising (ICO-style) as prohibited or severely restricted. The September 2021 notice, issued jointly by the People's Bank of China (PBOC) and other agencies, declares virtual-currency-related business activities to be illegal financial activities, bars financial institutions and payment institutions from serving virtual-currency business, and warns that overseas exchanges providing services to mainland residents through the internet are engaged in illegal financial activities. The notice's list of prohibited conduct includes token issuance financing, virtual-currency derivatives, and related marketing and promotion directed at mainland users.

Notice on Further Preventing and Disposing of the Risks of Virtual Currency Transaction Speculation (PBOC and other departments, September 2021): Virtual currency-related business activities are illegal financial activities... Any legal person, unincorporated organisation or natural person investing in virtual currencies and related derivatives that violates public order and good customs shall be liable for the resulting civil losses if the investment violates public order and good customs.

Criminal exposure is the sharpest edge. Where facts support the elements, project operators and promoters have faced prosecution under illegal business operations, illegal fundraising, fraud, and related offences under the Criminal Law of the People's Republic of China. The theory of the case is usually simple: a mainland team markets a token to mainland users, collects RMB, and promises returns — the offshore entity is a fact in the file, not a legal defence.

Offshore entity myths that fail in enforcement#

The most common assumptions we see in China-linked Web3 projects, and why they fail:

• A Cayman or Singapore company does not legalise marketing tokens to mainland users. The corporate seat is a governance fact; the marketing audience is the jurisdictional fact. Enforcement follows the audience, not the entity.
• Overseas domains with China-based promoters remain a China nexus. Promoters in mainland China — developers, community managers, business development staff — are the personnel nexus, and their activities are subject to mainland law even when the company is registered offshore.
• Education or technology covers are tested against substance. A "blockchain education platform" that discusses tokens, pricing, and purchase channels is, in substance, promotion. The label is tested against the content and the audience.
• Underground RMB on/off ramps create separate criminal risk. The personnel who operate informal currency conversion for token purchases face their own exposure under criminal and financial-regulation law, and their activities can implicate the project in the same file.

Host licences, securities tests and AML#

Even a genuinely non-China project — no mainland personnel, no mainland marketing, no mainland infrastructure — still faces the host-market stack. Token classification under the US Securities Act of 1933 and the Securities Exchange Act of 1934 determines whether the token is a security, and the SEC and CFTC enforcement record demonstrates that unregistered offerings, exchange operations, and market manipulation attract federal actions regardless of the project's offshore seat. The EU's Markets in Crypto-Assets Regulation (MiCA, Regulation (EU) 2023/1114) creates a comprehensive licensing framework for crypto-asset service providers, and Hong Kong's VASP licensing regime imposes its own conditions. Money-transmission licences, sanctions screening, and AML/CFT programmes are table stakes in every serious market.

UBO transparency is not optional. Controlling persons must be disclosed truthfully to banks, exchanges, and regulators, and a false beneficial-ownership statement is a compliance event in its own right, separate from the token economics. CRS and tax-residence honesty on controlling persons aligns with the wider cross-border tax framework — see the CRS and FATCA guide for Chinese high-net-worth families — because the tax file and the AML file converge on the same question: who actually controls the structure.

Governing statutes and enforcement precedents#

The China-side prohibition framework rests on a series of PBOC and multi-agency notices, most importantly the September 2021 notice on preventing and disposing of virtual-currency transaction speculation risks, issued jointly by the People's Bank of China and nine other agencies. The notice declares virtual-currency-related business activities to be illegal financial activities, prohibits financial and payment institutions from serving virtual-currency business, and warns overseas exchanges against soliciting mainland residents. The legal consequence is not merely administrative: the criminal-law theories of illegal business operations, illegal fundraising, and fraud have been applied to token projects with mainland connections, and the published criminal cases include convictions against teams whose offshore entities, onshore engineers, and mainland marketing worked together to raise funds from mainland users.

The host-market baseline is equally unforgiving. In the United States, the SEC applies the Howey test under the Securities Act of 1933 and the Securities Exchange Act of 1934 to token classification, and the SEC and CFTC enforcement record includes actions against issuers, exchanges, and promoters for unregistered offerings, unregistered exchange operations, and market manipulation — with the analysis turning on the economic reality of the token, not its label as a utility token or a governance token. The EU's Markets in Crypto-Assets Regulation (MiCA, Regulation (EU) 2023/1114) creates a comprehensive licensing regime for crypto-asset service providers and issuers, and Hong Kong's VASP licensing regime imposes its own fit-and-proper and AML conditions on virtual-asset service providers. The practical question for a China-linked team is therefore which of these frameworks actually applies — and the honest answer is that the China prohibition applies to the mainland nexus, and the host frameworks apply to the offshore business, simultaneously.

Post-decision discipline: the file that answers the first question#

The red-line review is a decision document, but its value is realised in the ongoing file. When a bank opens a question, an exchange requests UBO documentation, or a regulator asks about mainland connections, the company answers from the file: the personnel register, the audience map, the infrastructure map, the money trace, and the host licences. In our work with China-linked Web3 teams, the teams that pass diligence are the ones whose file is current — the personnel list updated when a developer moves, the infrastructure map updated when a server moves, the licence register updated when a market changes. The teams that fail diligence are the ones whose red-line review was a one-time memo that nothing has touched since. The discipline is simple: any change to people, promotion, infrastructure, or money flows triggers a file update, and the file is reviewed at least quarterly. The gate is not a door that closes once; it is a door that must be closed at every moment the project operates.

Strategic compliance roadmap: the red-line review before any product work#

A China-linked team should run the red-line review before any token, NFT marketplace, or payment product moves from whiteboard to build. The review has five gates. First, the personnel gate: list every person with a mainland connection who would work on the project — developers, community managers, advisors, marketers — and decide whether the role can be performed without creating a mainland nexus; where a role cannot be moved offshore, the project must be restructured or the role eliminated. Second, the audience gate: identify who the product will be marketed to, in which languages, through which channels, and confirm in writing that no mainland-resident solicitation is part of the plan; the marketing plan, not the corporate seat, is what enforcement reads. Third, the infrastructure gate: map every server, domain, payment rail, and on/off ramp, and confirm that no RMB conversion, no mainland-hosted infrastructure, and no mainland-controlled payment channel exists. Fourth, the money gate: trace the token economics — issuance, listing, marketing spend, treasury — and confirm that no mainland person controls or benefits from the fundraising in a way that re-establishes the nexus. Fifth, the host-market gate: for the genuinely offshore remainder, complete the securities classification, the VASP or MiCA licence analysis, the money-transmission review, and the AML/CFT and sanctions-screening programme before any launch.

The five gates are not a checklist to satisfy counsel; they are the factual file that the company would show to a regulator or a prosecutor. In our work with China-linked teams, the projects that survive are the ones that can produce the gate file on demand — the personnel list, the audience map, the infrastructure map, the money trace, and the host licences. The projects that fail are the ones whose gate file exists only as assertions in a pitch deck.

What a London tax file adds to the red-line review#

In my practice the China-linked Web3 engagement usually starts on the tax side — a founder asking whether the token structure, the offshore entity or the payment route changes their UK residence or reporting position — and the first answer is almost always the same: the mainland red-line analysis comes before the tax analysis, because a structure that fails the mainland screen does not get to the tax question. The projects that survive review are the ones that answer the personnel question honestly — who is onshore, what they are doing, who they are talking to — and then shrink the onshore footprint: no mainland development team on the core product, no mainland community managers, no RMB on- and off-ramps. The projects that fail are the ones that keep the mainland growth team for convenience. On the offshore side, the tax file is where the structure becomes real: the token economics must match the entity’s actual activities, the residence and CRS reporting of the founders and the entity must be documented, and the payment route must be one the banks and the tax authorities will both accept. A licensed opinion from an offshore firm does not change the mainland analysis; it changes only the host-market layer, and the two layers must be built together or not at all.

Related guides#

• Going Global Knowledge Centre
• Industry Knowledge Centres
• Games & Short-Video Outbound
• SaaS Outbound
• Web3 Red Lines
• Tea & F&B Franchise
• Manufacturing & Agritech
• Data Transfer Roadmap
• ODI Roadmap
• CRS / Tax Residence
• Apostille Guide
• Export Control Tracker
• Arbitration Forum

Next steps#

Before any token, NFT marketplace, or payment product touches a market, map the personnel, promotion, infrastructure, and money flows, and engage licensed counsel in both the mainland and the target market. The red-line map is the first document; everything else follows.

Request a consultation Find counsel