Author: Lawyer Hua Fukun
Doing cross-border e-commerce requires paying Facebook advertising fees; developing overseas business requires subscribing to SaaS software; operating games and AI products requires purchasing overseas cloud servers.
These seemingly ordinary online payment needs have made VCC virtual credit cards a commonly used payment tool for many companies going global. Users apply for a virtual card online and, after topping up, can use it for overseas consumption. There is no physical card, card opening is convenient, and payment is flexible.
But a recent case has sounded a warning bell for the VCC industry.
Source: Mobile Payment Network
On August 27, 2026, the Shanghai police announced a case involving the use of virtual currency to carry out cross-border illegal payment and settlement, with an amount involved exceeding 200 million yuan. Nine criminal suspects were arrested, of whom five were approved for arrest on suspicion of the crime of illegal business operations.
According to police disclosures, the team involved built two platforms, one responsible for cross-border fund exchange and the other for virtual credit card issuance and settlement.
In the virtual card business, the platform cooperated with multiple virtual card operators. Users could apply for virtual cards for consumption, but topping up required the use of virtual currency. The platform then exchanged the virtual currency into foreign currency overseas and completed settlement with the virtual card operators through methods such as false cross-border foreign exchange settlement.
The case is still under further investigation, and whether the relevant persons ultimately constitute a crime still needs to be determined in accordance with the law.
However, this case reveals a question worthy of serious consideration by VCC practitioners:
When both are helping customers pay advertising fees and software subscription fees, why is it that some platforms merely provide card-opening services, while others may be suspected of the crime of illegal business operations?
The key to the problem often lies not in the virtual card itself, but in the fund flow arrangement behind it.
What kind of business is the VCC virtual credit card, exactly?
First, let us clarify what VCC is.
VCC (Virtual Credit Card) generally refers to a virtual payment card that has no physical card and completes online transactions through information such as the card number, expiration date, and security code.
It can be used on international card organization networks such as Visa and Mastercard, and is commonly used in scenarios such as overseas advertising placement, software subscriptions, cross-border e-commerce, and online service procurement.
Although the name contains "credit card," many VCC products on the market actually adopt a prepaid or debit model, requiring a top-up before consumption, and do not have the overdraft function of traditional credit cards.
For example.
A domestic cross-border e-commerce company needs to pay fees to an overseas advertising platform every month, but its existing bank cards often cannot complete the deduction. So the company finds a VCC service provider, applies for a virtual card online, tops up RMB to obtain the corresponding USD consumption limit, and then binds the virtual card to the advertising account.
The whole process looks simple: top up RMB—obtain a foreign currency consumption limit—use the virtual card to pay.
For the company, the problem is solved. For the VCC platform, what really needs to be explained clearly is another matter:
The user pays in RMB, and the overseas merchant receives foreign currency. How exactly does the money in between move? This is precisely where the legal risks that most require attention in the VCC business lie.
Why might an RMB top-up involve illegal foreign exchange trading?
Suppose a VCC platform supports RMB top-ups. After the user pays RMB, the platform generates a USD consumption limit in the account at a certain exchange rate.
The user only needs to see the balance arrive and can then use the card normally. But if the fund flow is further broken down, the following situation may be found: the platform collects RMB from users domestically and keeps the funds in domestic accounts; at the same time, the platform uses overseas USD funds under its control to provide consumption funds for the user's virtual card.
The RMB and USD are not exchanged transaction by transaction through formal foreign exchange purchase channels; instead, the platform completes the exchange of value through domestic and overseas fund arrangements.
This method of completing exchange using domestic and overseas fund pools is usually called "matched offset" (duiqiao).
Some may ask: "The RMB has always been in China, and the USD has always been abroad. There is no actual cross-border transfer at all, so why would there still be a problem?"
Because the legal judgment is not only about whether the funds directly crossed the border, but about whether the platform, without permission, actually provided customers with exchange services between RMB and foreign currency.
According to Article 2 of the Interpretation of the Supreme People's Court and the Supreme People's Procuratorate on Several Issues Concerning the Application of Law in the Handling of Criminal Cases of Illegal Engagement in Fund Payment and Settlement Business and Illegal Buying and Selling of Foreign Exchange:
Acts such as buying and selling foreign exchange by speculation, disguised buying and selling of foreign exchange, and other acts in violation of state regulations that disrupt the order of the financial market and are serious in nature may be convicted and punished as the crime of illegal business operations.
There is also another common business arrangement, which is to introduce virtual currencies such as USDT as an intermediate link.
For example, users purchase USDT with RMB and then use USDT to obtain the USD consumption limit provided by the platform. If the platform actually organizes and controls the exchange between RMB and foreign currency, merely using virtual currency to complete the intermediary, then it cannot be considered that foreign exchange regulation has been circumvented simply because an additional transaction link has been added in the middle.
But it must be emphasized that supporting virtual currency top-ups does not automatically constitute the crime of illegal buying and selling of foreign exchange.
Whether the crime of illegal business operations is involved still requires examination of the transactions the platform actually participated in, the direction of fund flows, the exchange arrangements, and whether the circumstances required for criminal prosecution have been reached.
Besides illegal foreign exchange trading, what other criminal red lines might VCC platforms cross?
1. Doing the business of a payment institution without a payment license
Many VCC platforms will emphasize: "We are only responsible for technical services; the actual card-issuing institution is overseas, and our partners have financial licenses."
But cooperation with overseas licensed institutions does not mean that all business conducted by the platform domestically is lawful.
For example, a VCC platform not only provides a card-opening portal, but also directly collects users' top-up funds, controls account balances, processes payment instructions, and even arranges fund clearing itself.
At this point, it needs to be further determined whether the platform has exceeded the scope of ordinary technical services and is actually engaging in payment business for which a license is required by law.
Article 6, Paragraph 2 of the Regulations on the Supervision and Administration of Non-bank Payment Institutions clearly provides:
Without approval in accordance with the law, no unit or individual may engage in or disguisedly engage in payment business, except as otherwise provided by laws, administrative regulations, and the state.
At the same time, Article 19, Paragraph 2 of the Regulations sets requirements for non-bank payment institutions to carry out cross-border payment services, namely that they shall comply with the relevant provisions on cross-border payment, cross-border RMB business, foreign exchange management, and cross-border data flow.
It should be noted that Article 19, Paragraph 2 directly regulates non-bank payment institutions, and it cannot be used alone to determine that all domestic VCC platforms are illegal.
For VCC platforms, what truly needs to be examined is:
• Does the platform actually engage in payment business that requires a license?
• Do the cooperating institutions have the corresponding qualifications, and does the actual business fall within the scope of their licenses?
• Who collects, controls, and settles user funds?
• Does the platform indirectly participate in fund processing through affiliated companies or other entities?
If the platform only provides card application, information display, and technical interfaces, there is an important distinction between that and actually carrying out payment and settlement business.
However, if the platform, although nominally a technical service provider, actually operates payment and settlement business itself, it may face administrative penalties, and if the circumstances are serious and meet the constitutive elements of a crime, it may also be suspected of the crime of illegal business operation.
A distinction must be made here: engaging in payment business without a license cannot be directly equated with constituting the crime of illegal business operation.
The determination of criminal liability also requires specific judgment in light of Article 225 of the Criminal Law and the relevant judicial interpretations.
2. Providing payment convenience for gambling, fraud, and other illicit industries
VCCs can be used not only for normal commercial activities but may also be exploited by criminal groups. For example, overseas gambling websites and fraud gangs may need to purchase cloud servers in bulk, pay for advertising, or use virtual cards to complete other online transactions.
If a VCC platform discovers obvious anomalies in its customers during operations but continues to provide large amounts of card issuance, top-up, and payment support, it may trigger further criminal liability review.
There is a point here that is easily misunderstood: the fact that a customer uses a VCC to commit a crime does not mean that the platform providing the service necessarily constitutes a crime.
The key is whether the platform knowingly provided substantial assistance to the relevant illegal or criminal activities, and which crime's constitutive elements the specific conduct meets.
For example, did the platform promptly verify after receiving risk alerts? Were there acts such as assisting customers in evading identity verification or concealing transaction information? Did it take necessary measures to handle obviously abnormal transactions?
These details may all affect the determination of liability. Where the corresponding conditions are met, this may involve the crime of assisting information network criminal activities, the crime of money laundering, or accomplice liability for the relevant upstream crimes.
Therefore, VCC platforms cannot focus only on the number of cards issued and transaction volume; necessary customer identity identification, risk monitoring, and handling of abnormal transactions are equally important.
Why do risk levels differ so much among different operating models in the same VCC business?
For the VCC industry, there is another question worth discussing:
If a platform does not directly touch funds and only provides card issuance and technical services, does that mean there is no risk of illegal business operation?
We can compare two common business arrangements.
Model 1: The platform is responsible for technical services, and a licensed institution is responsible for fund processing
The platform cooperates with financial institutions and payment institutions that have the corresponding qualifications, and mainly provides services such as card application entry, account information display, and statement inquiries. User funds go directly to institutions that lawfully provide the relevant services, and those institutions complete fund collection and payment, currency exchange, and transaction settlement in accordance with applicable laws.
The platform does not itself operate foreign exchange exchange, nor does it actually control customer funds or independently organize payment and settlement.
If the above arrangements are genuine and complete, and the qualifications of the cooperating parties and the fund chain also comply with the relevant regulatory requirements, then there is a substantive difference between the platform and operators that themselves carry out foreign exchange and payment settlement business.
However, it cannot simply be concluded that "doing only technical services is necessarily lawful."
If the platform collects funds through affiliated companies, or although it does not directly hold funds, it actually decides fund transfers and controls transaction processing and clearing arrangements, the true nature of its business still needs to be further examined.
Model 2: The platform collects funds and organizes exchange and overseas settlement itself
Another model is different.
The platform directly receives user top-up payments, generates corresponding foreign currency quotas in the backend, and then completes payment to cooperating card providers through overseas fund pools, virtual currency transactions, or other means.
In this process, the platform not only undertakes card issuance services but may also actually participate in currency exchange and payment settlement. Even if the platform calls the relevant income "technical service fees," "card issuance fees," or "top-up service fees," the lawfulness of its business cannot be determined based on these names alone.
Judicial authorities may still look through contracts and platform pages to examine the true fund chain and transaction arrangements. It is worth noting that some platforms also explain the compliance of their business through methods such as "offshore RMB settlement" and "overseas licensed cooperation." However, regardless of the cooperation structure adopted, the fact that an overseas institution has the relevant qualifications does not automatically mean that a domestic platform may itself collect RMB, handle foreign exchange, or engage in payment and settlement business.
Whether a cooperation arrangement is compliant should ultimately still be judged by returning to the specific transaction entities, applicable jurisdictions, scope of licenses, and flow of funds. Therefore, the difference in legal risk between the two models cannot be judged merely by whether the platform has its own APP or whether it acts as an agent for overseas card providers.
What really needs to be examined is four things: Who receives the money? Who exchanges the currency? Who controls the funds? Who is responsible for settlement?
V. VCC platform operators are advised to clarify these five issues in advance
VCCs do solve payment pain points for some enterprises expanding overseas, but the fact that a business can operate normally does not mean there are no risks in the fund chain behind it.
For enterprises that already operate VCC platforms or are preparing to enter this track, it is advisable to focus on verifying the following matters.
First, who is the actual card issuing institution?
Can the true card issuing entity, the cooperation hierarchy, and its business qualifications be clearly identified? Do the businesses that the relevant institutions are approved to carry out cover the services actually provided?
Second, where does the money users top up go?
Do the funds go directly to licensed institutions, or to accounts of the platform or affiliated companies? Are there issues such as collection through personal accounts or opaque fund pools?
Third, how are foreign currency spending quotas generated?
Are they exchanged lawfully by institutions with the corresponding qualifications, or does the platform set its own quotes, arrange domestic and overseas fund matching, or use virtual currency for value conversion?
Fourth, what business functions does the platform actually undertake?
In addition to information display and technical services, does it also participate in fund collection and payment, processing of payment instructions, fund allocation, and transaction clearing? Do these functions involve financial licenses that must be obtained in accordance with the law?
Fifth, how are abnormal customers and transactions handled?
Are there customer identity identification, transaction monitoring, risk handling, and record retention mechanisms commensurate with business risks? When abnormal transactions occur, can the platform explain what measures it took?
These five questions not only concern whether an enterprise can continue to operate, but may also become important bases in a criminal investigation for determining the true nature of the platform's business and the legal liability of the relevant personnel.
Conclusion: VCC is not inherently wrongful; the key is what the platform actually does
As a payment tool, VCC itself has genuine commercial application value. However, conducting business around VCCs does not mean that all card issuance, top-up, exchange, and settlement models are inherently lawful. Among platforms providing virtual card services, some are only responsible for technical integration, while others may simultaneously operate currency exchange, cross-border payment settlement, and other businesses.
The products offered on the surface may appear similar, but the legal nature behind them can be entirely different. For VCC operating platforms, what truly deserves attention is not merely whether cards can be issued, whether funds can be loaded, or whether overseas payments can be successfully processed.
More importantly:
Is the platform actually providing technical services, or has it already effectively engaged in business activities that require financial licenses?
In a context where domestic and foreign regulatory rules are intertwined and payment chains are increasingly complex, clarifying the business model and fund flows in advance is far more important than explaining the nature of the business after account freezes or platform investigations occur.
For enterprises currently operating or planning to establish a VCC business, it is recommended to conduct specialized compliance reviews focusing on the qualifications of partner institutions, fund collection and payment, foreign exchange conversion, payment settlement, and customer risk management, so as to clearly define legal boundaries while pursuing business development.
