Futu has had all illegal gains confiscated, reminding cryptocurrency exchanges

Author: Lawyer Liu Honglin

Today, there is a major news story in the financial industry that is worth the cryptocurrency sector's serious attention.

On May 22, it was reported that Futu Holdings announced that the company received an investigation notice and an administrative penalty pre-notice letter from the China Securities Regulatory Commission (CSRC) and its Shenzhen branch. Certain Futu entities in mainland China and Hong Kong conducted securities business, public fund sales, and futures business without obtaining the required licenses or approvals, violating the Securities Law, the Securities Investment Fund Law, and the Futures and Derivatives Law of the People's Republic of China. The CSRC intends to order the relevant companies to correct or cease such activities, confiscate illegal gains, and impose fines, with a proposed total fine of approximately 1.85 billion yuan. Additionally, the CSRC plans to impose a personal fine of 1.25 million yuan on Mr. Li Hua, the company's founder and CEO. Futu Holdings stated that the proposed fines are still subject to further procedures and the CSRC's final decision.

Licenses Are Not Amulets

If this news is viewed solely within the brokerage industry, it can certainly be understood as a crackdown on cross-border securities business. However, when viewed within the larger framework of cross-border financial regulation, its significance goes beyond just "Futu and Tiger being fined." The real signal it sends is that even if foreign financial institutions obtain licenses abroad, as long as they are effectively providing financial services to residents of mainland China, Chinese regulatory authorities may evaluate their actions according to Chinese law.

This logic is what cryptocurrency exchanges should truly be wary of.

Many people's first reaction might be to ask: Futu is a licensed broker in Hong Kong, and Tiger also has licenses abroad; they operate legally overseas, so why can the regulatory authorities in mainland China still intervene? This question is very straightforward but also crucial. The answer is not complicated because regulators do not look at where you are registered or where you obtained your license, but rather at who you are providing financial services to and whether your service activities have entered the regulatory order of mainland China.

A Hong Kong license addresses the question of "can you conduct securities business within the regulatory scope of Hong Kong," but it does not automatically resolve the question of "can you conduct securities business targeting residents of mainland China." Being compliant in Hong Kong does not mean you are compliant in mainland China; being compliant in Dubai does not mean you are compliant in mainland China either. A financial license is not an amulet, nor is it a global passport. It is essentially a permission granted by a judicial jurisdiction to conduct specific financial business within that jurisdiction.

This is also why this incident easily brings to mind cryptocurrency exchanges. Many cryptocurrency exchanges now claim that they have licenses in Dubai, are registered in Europe, or are applying for or have obtained certain virtual asset-related licenses in Hong Kong. But the question is, if these exchanges continue to provide registration, trading, contracts, wealth management, lending, promotion, and other services to residents of mainland China, will the Chinese regulatory authorities consider that they have entered the regulatory realm of mainland China?

From a regulatory logic perspective, the answer is likely yes.

Where the Differences Lie

However, it is important to pay special attention to a legal difference here. Brokerages like Futu, Tiger, and Changqiao were penalized because there is already a mature securities legal system in mainland China. The Securities Law clearly stipulates that securities companies engaging in securities brokerage, securities financing, and other businesses must be approved by the State Council's securities regulatory authority and obtain a securities business license; no other entities or individuals may engage in securities underwriting, sponsorship, brokerage, or financing business. Violating relevant regulations and illegally conducting securities business can result in orders to correct, confiscation of illegal gains, and fines ranging from one to ten times the illegal gains; if there are no illegal gains or if the illegal gains are less than one million yuan, fines of between one million and ten million yuan can still be imposed.

This is a typical case of "having laws, having licenses, having standards for violations, and having bases for penalties." Therefore, the CSRC can say that although you have a Hong Kong license, you do not have a securities business license for mainland China, and providing securities brokerage services to domestic investors violates the Chinese securities legal system. Where do the illegal gains come from? From conducting securities business within the regulatory scope of China without permission. Since illegal gains can be identified, and the law authorizes regulatory authorities to confiscate illegal gains, then the confiscation is legally justified.

But the situation for cryptocurrency exchanges is more complex.

Currently, there is no "cryptocurrency exchange licensing system" in mainland China. In other words, it is not the case that if you meet certain conditions, you can apply for a virtual currency exchange license in mainland China and then legally provide services to mainland users. On the contrary, China's basic attitude towards virtual currency trading activities is to define related business activities as illegal financial activities through regulatory policies and departmental notices.

In 2013, the People's Bank of China and other departments issued a notice on preventing Bitcoin risks, clearly stating that Bitcoin is not issued by monetary authorities, does not possess the attributes of legal tender and compulsion, and is not truly a currency; financial institutions and payment institutions are prohibited from engaging in business related to Bitcoin. In 2017, seven departments issued a notice on preventing risks of token issuance financing, halting ICOs and requiring various token financing trading platforms not to engage in exchange services between legal currency and tokens or virtual currencies, not to buy or sell tokens or virtual currencies as a central counterparty, and not to provide pricing, information intermediary, and other services. In 2021, ten departments issued a notice on further preventing and addressing risks of virtual currency trading speculation, further clarifying that virtual currencies do not have the same legal status as legal tender, and that virtual currency-related business activities are illegal financial activities. The People's Bank of China later reiterated this in response to public inquiries, stating that virtual currencies cannot be traded domestically and pose legal risks.

Thus, there are similarities and differences between cryptocurrency exchanges and Hong Kong brokerages.

The similarity lies in that they are both foreign entities, or at least through foreign entities, providing services with strong financial attributes to residents of mainland China. One provides services related to Hong Kong and U.S. stocks, funds, futures, and securities financing; the other provides trading services for virtual currencies, contracts, wealth management, lending, pledging, listing, OTC, etc. They both target users in mainland China and charge transaction fees, interest, spreads, platform service fees, or other revenues. From a regulatory intuition perspective, these businesses are not ordinary internet services but services with obvious financial, capital, and investment attributes.

The difference lies in that brokerage business in China has a complete legal system, while cryptocurrency exchanges are not "illegally operating a business that could originally apply for a license," but are continuing to operate in a business space that is fundamentally denied by regulatory policies. The former is "you do not have a Chinese securities license, so you cannot conduct securities business"; the latter is closer to "this business is not permitted in mainland China, so you cannot target users in mainland China."

This also explains why we cannot simply say that since the CSRC can confiscate Futu's illegal gains, the Chinese regulatory authorities can certainly confiscate all illegal gains from Binance, OKX, Bybit, and other foreign exchanges tomorrow. Legally, such a crude analogy cannot be made. Because securities business has explicit authorization clauses in the Securities Law and rules for confiscating illegal gains; while in the realm of virtual currency exchanges, more reliance is placed on regulatory notices, departmental regulations, risk disposal policies, and the legal frameworks that may apply in specific cases, such as criminal law, foreign exchange, anti-money laundering, illegal fundraising, fraud, and aiding information network crime activities.

But precisely because of this, cryptocurrency exchanges should not feel safe; instead, they should be more anxious.

Why? Because at least there is a "compliance path" for securities business. If you want to operate securities business in mainland China, you should apply for the corresponding license, accept the supervision of the CSRC, and enter the legal financial system. Of course, it is not easy for foreign brokerages to directly obtain a license in mainland China, but at least the securities legal framework itself is clear. Cryptocurrency exchanges, on the other hand, do not even have a compliance path when facing users in mainland China. You cannot say that because I have a license in Hong Kong, I can open contract trading to residents of mainland China; nor can you say that because I am compliant in Dubai, I can conduct Chinese promotions, KOL activities, offline events, community operations, and OTC services in mainland China. Because mainland China does not recognize the legal space for such services.

From this perspective, the real reminder that the Futu incident gives to cryptocurrency exchanges is not "tomorrow the regulators will certainly confiscate all your illegal gains," but rather three other statements: first, foreign licenses cannot counteract regulatory oversight in mainland China; second, if the service target is residents of mainland China, it may trigger regulatory evaluation by Chinese authorities; third, once regulatory authorities decide to look through to the essence of the business, foreign structures, foreign entities, and foreign licenses do not naturally isolate risks.

Risks Fall on Individuals

In reality, many cryptocurrency exchanges are indeed still engaging in various ways to target users in mainland China. On the surface, they may have already closed registrations for mainland Chinese phone numbers or no longer publicly claim to support Chinese users. But in actual business, the Chinese interface is still there, Chinese customer service is still there, Chinese communities are still there, Chinese KOL promotions are still there, rebate systems are still there, offline events are still there, and many exchanges' growth teams, business teams, marketing teams, and technical teams still have intricate connections with mainland China.

If it is merely the case that mainland Chinese users are accessing foreign platforms by circumventing the firewall, and the platform is not actively marketing, does not have Chinese operations, and does not have service arrangements targeting Chinese users, the legal evaluation will be relatively complex. But if the platform publicly states "we do not serve users in mainland China" while actively acquiring customers through agents, KOLs, communities, lectures, offline events, Chinese information packages, WeChat groups, and Telegram groups, then regulatory authorities may very well consider this not as passive access, but as actively targeting the mainland market.

At this point, the issue is not just whether the platform will have its domain name blocked, its app taken down, or its payment channels cut off. The more realistic risk is that relevant personnel, if they are in mainland China or enter mainland China in the future, may face very specific legal consequences.

Here, it is also important to distinguish between administrative risks and criminal risks. Not all cryptocurrency trading services targeting mainland users will automatically constitute criminal offenses. Criminal liability must be judged based on specific actions, specific amounts, specific levels of participation, and specific harmful consequences. For example, if an ordinary employee provides some marginal technical support, the legal risks are certainly not on the same level as those of the actual controllers, executives, core operational leaders, fund channel leaders, OTC leaders, contract business leaders, and platform operation leaders.

However, if a cryptocurrency exchange is providing trading services to residents of mainland China in a long-term, large-scale, organized manner, especially involving contract leverage, fund channels, OTC, agency, and project listing, the relevant actual controllers, executives, or core business leaders, if they are in mainland China, may indeed face criminal risks.

Many friends may wonder why. Because under the framework of Chinese criminal law, operating securities, futures, or insurance businesses without approval from the relevant state authorities, or illegally engaging in fund payment and settlement business, disrupting market order, and being serious in nature, may trigger the crime of illegal operation. However, whether cryptocurrency exchanges can be uniformly treated under the crime of illegal operation is not a simple conclusion in practice. It depends on whether specific business activities are recognized by judicial authorities as illegal operations of a certain type of financial business, whether there are attributes of payment settlement, securities and futures, and whether the severity standard is met.

The writing of this article is certainly not meant to scare people; what I want to express is that cryptocurrency exchanges have no legal space to operate in mainland China, and if related businesses are conducted targeting residents of mainland China, there is first a clear risk of regulatory policy; if the business further overlaps with fund pools, leveraged contracts, illegal fundraising, pyramid schemes, money laundering channels, gambling and fraud-related fund flows, then it may escalate from general regulatory risk to criminal risk. Especially for actual controllers, executives, and core business personnel, if they are involved in decision-making, organization, profit-making, and directing operations in mainland China for a long time, their risks are clearly not on the same level as ordinary users or ordinary employees.

Regulation Will Keep Score

This is also the most valuable insight from the Futu incident for the cryptocurrency industry: regulation may not take action immediately, but that does not mean regulation will not keep score.

Internet brokerages like Futu and Tiger have not only recently attracted regulatory attention. As early as 2021, the CSRC had already expressed its regulatory stance through the media; in November 2021, the CSRC interviewed executives from Futu and Tiger, clearly requiring them to standardize cross-border securities business targeting domestic investors in accordance with the law; in 2022, regulation continued to promote the rectification idea of "effectively curbing incremental growth and orderly resolving existing issues." In other words, this is not a sudden penalty but a process where regulatory attitudes have been repeatedly released, rectification requirements have been continuously advanced, and ultimately entered the stage of administrative penalties.

The same goes for cryptocurrency exchanges. China's regulatory attitude towards virtual currencies has been very clear from 2013, 2017, to 2021. Many exchanges and practitioners are not unaware but choose to selectively ignore it. Everyone knows that the mainland Chinese market is large, with many users, active trading, strong demand for contracts, and high KOL conversion efficiency, so they may verbally claim not to serve, but their actions tell a different story. The problem is that regulatory documents do not cease to exist just because you pretend not to see them.

For foreign cryptocurrency exchanges, what they should really do is not to study how to make disclaimers look prettier, but to substantively judge whether they are targeting the mainland market. For example, do they allow users with mainland Chinese identities to register and complete KYC? Is there a Chinese team specifically responsible for the mainland market? Are they acquiring mainland users through KOLs and agency systems? Are they organizing offline events in mainland China? Are there domestic employees involved in promotion, customer service, operations, and trading support? Are they providing OTC convenience for mainland users? Are they using technical means to evade regulatory identification? If they carefully answer these questions, many platforms will have a clearer understanding.

For mainland users, this incident also serves as a reminder. Many people naturally feel that when using foreign brokerages or exchanges, the platform is large, has many licenses, extensive advertising, and KOLs promoting it, there should be no issues. But the most troublesome aspect of financial services is that platform compliance does not mean your usage path is compliant, and a platform being safe abroad does not mean you are necessarily safe in mainland China. Especially when it involves fund inflows and outflows, foreign exchange usage, virtual currency trading, bank card freezes, fraudulent fund inflows, and OTC trading counterparty risks, ordinary users are often the weakest link in the risk chain. Platforms can change domain names, change entities, change countries, but users' bank cards, identity information, and fund flows are all within mainland China.

Therefore, the title of this article stating "Cryptocurrency Exchanges Are Anxious" does not mean that regulators will tomorrow simply apply the logic of the Securities Law to confiscate all illegal gains from all exchanges. Rather, it aims to remind everyone that the Futu incident has once again revealed a very realistic regulatory logic for cryptocurrency exchanges: holding a foreign license does not mean you can ignore mainland China; conducting business abroad does not mean risks do not exist domestically; if users are in China, regulators may trace back through users, funds, promotions, teams, technical services, and actual profit chains.

In recent years, there has been a popular saying in the cryptocurrency industry: "We are a global platform and do not target Chinese users." If this statement is true, it can certainly be part of the compliance boundary. But if it is merely a disclaimer on the official website while actual business still revolves around Chinese users, then its firewall effect is very limited. Regulators look at facts, not slogans; they look at business flows, capital flows, user flows, and promotional flows, not what you write on your official website.

From a lawyer's perspective, in the future, all cross-border financial services targeting mainland Chinese users, whether securities, funds, futures, or virtual currencies, stablecoins, RWAs, on-chain wealth management, and crypto payments, will increasingly find it difficult to explain with just "I am legal abroad." The essence of financial regulation is the management of funds, risks, and investors. As long as your service target is residents of mainland China, and as long as your business essentially impacts China's financial order, foreign exchange management, anti-money laundering, personal information protection, and social stability, it is impossible to completely stand outside of Chinese regulation.

The cryptocurrency industry certainly has its technological and commercial value; stablecoins, on-chain payments, global asset flows, and RWAs may indeed represent part of the future financial infrastructure. But the more forward-looking the industry, the less it can be built on regulatory gray areas and a mindset of luck. A truly mature industry is one where everyone begins to know where the boundaries are, understands which money cannot be made, which users cannot be touched, and which businesses cannot be conducted in the wrong places. This is a message that traditional brokerages understand, and cryptocurrency exchanges should understand it too.