Shanghai Police Crack Down on $200 Million Virtual Currency Payment Platform Case

Article by Gao Mengyang

On August 27, Shanghai police disclosed a case worthy of attention from the Web3 payments industry while reporting on new types of economic crimes involving virtual currencies.

Screenshot of news information | Compiled from publicly available reports

Unlike traditional underground banks, this case resembles a FinTech company in terms of product structure: the suspects established a technology company and launched two online platforms—one for cross-border fund exchange and another for virtual credit card issuance and settlement. Users could deposit virtual currencies, perform multi-currency cross-border exchanges, apply for virtual credit cards, and make consumption repayments on the platforms. The platforms generated revenue through transaction fees, service charges, card issuance fees, and withdrawal fees.

According to police notification, nine suspects have been apprehended in this case, with the involved amount exceeding RMB 200 million. Five of them have been approved for arrest by the procuratorate on suspicion of illegal business operations, while the remaining individuals have been subjected to criminal compulsory measures. The investigation is ongoing.

If you only look at the product page, features such as "USDT deposit," "global spending," "multi-currency exchange," and "virtual card payments" are all well-known in the Web3 payments industry, and similar products already exist in overseas markets. Therefore, what truly merits study in this case is not whether "virtual credit cards can be offered," but rather how the legal nature of a payment product changes when it incorporates stablecoins and evolves from technology and card services toward currency exchange and cross-border settlement.

A virtual credit card is not inherently a criminal product.

From the perspective of the global payments market, the integration of card networks with digital assets has given rise to several mature models. For example, some crypto card products allow users to spend digital assets, but in the actual payment chain, these assets typically need to be converted into fiat currency before entering the traditional card payment network; merchants ultimately receive fiat currency. Behind such products, multiple distinct processes are often involved, including regulated financial institutions, issuing entities, card networks, KYC, anti-money laundering, sanctions screening, and ongoing transaction monitoring.

Of course, this overseas model cannot serve as a direct basis for the legality of business operations within China, but it helps us understand a crucial industry logic: behind a card that can spend USDT, it is not simply a matter of linking a wallet to a bank card—rather, it involves multiple distinct processes, including digital asset conversion, fiat fund handling, card issuance, clearing, and merchant settlement. The real focus of legal scrutiny lies in determining who performs each of these steps and under what qualifications.

The reason this case disclosed by Shanghai police is noteworthy is precisely because the involved platform did not merely provide a card entry point.

According to police notifications, in the "cross-border fund exchange" platform, relevant personnel collected customers' cryptocurrencies overseas, converted them into foreign currencies to form a fund pool, and then facilitated the conversion and transfer between cryptocurrencies and RMB by fabricating false reasons for cross-border settlement. In another platform for "virtual credit card issuance and settlement," relevant personnel partnered with virtual card operators to provide customers with virtual credit cards; after users made purchases, they repaid using cryptocurrencies, and the platform subsequently converted the cryptocurrencies into foreign currencies overseas and settled accounts with the virtual card operators through fraudulent cross-border settlement methods.

In other words, the case requires analysis not of a single "card issuance" act, but of an entire closed-loop financial service encompassing the acceptance of cryptocurrency, currency exchange, organization of cross-border funds, card settlement completion, and charging users.

Many Web3 payment products initially aimed to solve a simple problem: users hold USDT, but everyday merchants only accept USD, HKD, or other fiat currencies—can a card make these digital assets easier to spend?

What truly requires caution is that the product gradually centralizes all capabilities, which were originally managed by different licensed entities, into its own hands.

For example, the user first deposits USDT into their platform account, and the platform calculates the equivalent USD value based on its own exchange rate; the user then requests a virtual card, and the platform loads the converted value onto the card system. After a purchase is made, the platform handles the sale of the cryptocurrency, foreign currency payment, and cross-border settlement—all funding flows, exchange rates, and settlement arrangements are managed uniformly by the platform.

At this stage, the platform offers more than just technical interfaces or card management pages—it may also involve multiple regulated processes, such as cryptocurrency exchange, fund transfers, and cross-border payment settlement.

In February 2026, the People’s Bank of China and seven other departments issued the "Notice on Further Preventing and Handling Risks Related to Virtual Currencies," explicitly stipulating that activities such as exchanging fiat currency for virtual currencies, exchanging one virtual currency for another, acting as a central counterparty in buying or selling virtual currencies, and providing information intermediation or pricing services for virtual currency transactions constitute illegal financial activities and are strictly prohibited. The notice also prohibits overseas entities and individuals from providing any form of virtual currency-related services to domestic entities or individuals.

Meanwhile, engaging in payment activities such as transferring monetary funds based on users' electronic payment instructions within the country requires obtaining the appropriate licenses under current payment regulatory rules. Overseas institutions providing cross-border payment services to users within the country must also consider additional regulatory requirements related to payments, foreign exchange, cross-border RMB, and data.

Therefore, for Web3 payment products targeting users within China, the real question that should be addressed in advance is not “Since our card is issued by an overseas company, are we okay?”, but rather: who handles the subsequent exchange, account management, payments, and settlement after the user deposits their first USDT into the system, and what specific business functions does the domestic team actually perform?

In reality, Crypto Card projects typically do not involve a Chinese tech company applying directly for Visa or Mastercard issuing qualifications; instead, they employ more complex partnership structures, such as overseas licensed institutions providing the cards, BIN sponsors managing the card programs, payment processors handling settlement, and Web3 project teams primarily responsible for wallets, user interfaces, technical development, and customer operations.

This structure is obviously distinct from “building your own platform and handling all financial operations yourself,” but criminal and regulatory analysis cannot stop at the role names listed in the contract.

If the contract states that "the overseas partner is responsible for payment and card issuance," but in actual operations, the China team handles user acquisition within China, provides USDT-to-USD quotes, controls user deposit wallets, determines when to convert assets, arranges withdrawals and refunds, and earns revenue based on deposit volume or conversion amount, then the term "technology service provider" in the contract does not fully reflect its true business role.

Conversely, if the domestic team merely provides software development, API integration, or other technical capabilities—without controlling customer funds, determining exchange rates, participating in cryptocurrency trading or fiat settlement, or directly offering related financial services to domestic users—its activities should be evaluated independently based on its actual conduct. It should not be automatically equated with the entity managing funds simply because the final product is connected to cryptocurrencies and bank cards.

This is why, when designing the business architecture, Web3 payment projects often prioritize the cash flow diagram over the equity structure diagram. While ownership by which company indicates business relationships, it is truly the movement of client USDT—which wallet it enters, who can access it, where the conversion occurs, which account receives fiat currency, who pays the card issuer, and who ultimately receives the fees—that determines what actual business responsibilities each party bears.

If we only discuss stablecoin exchanges and virtual cards, we may easily overlook a more traditional yet legally significant detail in this case.

Police disclosed that, in the platform's cross-border fund transactions, the criminal group engaged in "fabricating false reasons for cross-border foreign exchange settlement"; in the virtual credit card settlement business, the group similarly converted virtual currency into foreign currency overseas and completed settlements with virtual card operators through fraudulent cross-border foreign exchange settlement methods.

This means the case is no longer just about "how to convert USDT to USD," but also involves why cross-border funds can enter formal financial channels under the guise of trade, services, or other名义.

This is particularly important for genuine cross-border payment businesses, as normal international settlements typically require clear justification of the transaction’s background—whether it involves goods trade, software services, advertising fees, technical service fees, or other legitimate commercial activities—and must align with contracts, orders, invoices, or other business documentation. If one artificially creates contracts, fabricates services, or borrows unrelated trade backgrounds solely to repatriate funds from overseas, the legal risks extend beyond cryptocurrency regulation and may further involve foreign exchange controls and other fund-related risks.

Therefore, the most concerning aspect of a stablecoin payment project is not merely a product manager adding a "USDT Deposit" button to the page, but rather the backend increasingly implementing financial arrangements that cannot be justified by genuine business relationships in order to make the funds ultimately flow.

When considering the Shanghai case alongside current regulatory frameworks, teams designing stablecoin payment systems, crypto cards, PayFi, or global payment solutions can first avoid complex legal terminology and instead walk through the full product flow.

First, what assets are users transferring to whom? If domestic users directly transfer USDT to a wallet controlled by the platform, it must be further confirmed whether the platform is merely providing technical custody or has established actual control over the assets.

Secondly, who is responsible for selling the USDT? Is the exchange carried out by regulated overseas financial or crypto institutions in accordance with local regulations, or does the project team independently seek out traders, set unified prices, and complete the payouts?

Third. Whose account receives the fiat currency? If the exchanged funds are deposited into an account controlled by the project itself, and the project then centrally manages payments, its financial role will be significantly greater than merely providing API technical services.

Fourth. Who ultimately issues the card and assumes settlement responsibility? The presence of a brand logo on the card does not replace the need to confirm the actual issuer, BIN sponsor, payment processor, and settlement entity.

Fifth: What is the true service the customer is purchasing? If a user is simply using an overseas payment card, the underlying business need differs from the user directly requesting, "Convert my USDT to USD and pay it overseas on my behalf."

Sixth. How the platform makes money—through software subscription fees, technical service fees, spreads based on exchange amounts, withdrawal fees, and fund settlement fees—carries different implications for the platform’s true business nature.

The RMB 200 million case disclosed by Shanghai police is significant for the Web3 industry because it illustrates a highly typical platformization trend: functions previously scattered among cryptocurrency traders, foreign exchange institutions, payment processors, card issuers, and cross-border settlement providers have been consolidated into a single user interface by internet platforms. While this integration improves user experience, it also significantly increases the financial responsibilities assumed by the platform.

Therefore, discussing the legal risks of Crypto Cards, stablecoin payments, or PayFi projects by simply asking “Is a virtual credit card legal?” often fails to yield truly useful answers. A more effective approach is to trace the flow of funds step by step, breaking down each component—digital asset conversion, control of fiat funds, payment instructions, card issuance, cross-border settlement, and fee structures—and then determining which entity performs each step and under what rules.

The existence of numerous mature Crypto Card products overseas does not mean that the same product structure can be replicated for users within China without adjustment; similarly, using overseas companies, overseas card networks, or offshore partners does not automatically alter the legal nature of the actual implementation activities carried out by the domestic team.

For a Web3 payment project, the true product boundary isn’t about “whether users can swipe cards with USDT,” but rather which financial capabilities—each of which should be separately regulated—the platform has brought in-house to achieve this step.