Futu has had all its illegal gains confiscated, reminding cryptocurrency exchanges

Author: Lawyer Liu Honglin

Today, a major news story in the financial industry is worth the cryptocurrency sector's serious attention.
On May 22, it was reported that Futu Holdings announced that the company had received an investigation notice and an administrative penalty pre-notice letter from the China Securities Regulatory Commission (CSRC) and its Shenzhen branch. Certain Futu entities in mainland China and Hong Kong conducted securities business, public fund sales, and futures business without obtaining the required licenses or approvals, violating the Securities Law, the Securities Investment Fund Law, and the Futures and Derivatives Law of the People's Republic of China. The CSRC intends to order the relevant companies to correct or cease such activities, confiscate illegal gains, and impose fines totaling approximately 1.85 billion yuan. Additionally, the CSRC plans to impose a personal fine of 1.25 million yuan on Mr. Li Hua, the company's founder and CEO. Futu Holdings stated that the proposed fines are still subject to further procedures and the CSRC's final decision.

Licenses Are Not Amulets

If this news is viewed solely within the brokerage industry, it can certainly be understood as a crackdown on cross-border securities business. However, when placed within a larger framework of cross-border financial regulation, its significance is not simply "Futu and Tiger were fined." The real signal it sends is that even if foreign financial institutions obtain licenses abroad, as long as they are effectively providing financial services to residents of mainland China, Chinese regulatory authorities may evaluate their actions according to Chinese law.
This logic is what cryptocurrency exchanges should truly be wary of.
Many people's first reaction might be to ask: Futu is a licensed broker in Hong Kong, and Tiger also has foreign licenses; they operate legally abroad, so why can Chinese regulatory authorities still intervene? This question is straightforward but crucial. The answer is not complicated because regulators do not look at where you are registered or where you obtained your license, but rather at who you are providing financial services to and whether your service activities have entered the regulatory order of mainland China.
A Hong Kong license addresses the question of "can you conduct securities business within the scope of Hong Kong regulation," but it does not automatically resolve the question of "can you conduct securities business targeting residents of mainland China." Being compliant in Hong Kong does not mean you are compliant in mainland China; being compliant in Dubai does not mean you are compliant in mainland China either. Financial licenses are not amulets, nor are they global passports. They are essentially a jurisdiction's permission for you to conduct specific financial activities within that jurisdiction.
This is also why this incident easily brings cryptocurrency exchanges to mind. Many cryptocurrency exchanges now claim that they have licenses in Dubai, are registered in Europe, or are applying for or have obtained certain virtual asset-related licenses in Hong Kong. But the question is, if these exchanges continue to provide registration, trading, contracts, wealth management, lending, copy trading, promotional rebates, and other services to residents of mainland China, will Chinese regulatory authorities consider that you have entered the regulatory domain of mainland China?
From a regulatory logic perspective, the answer is likely yes.

Where the Differences Lie

However, it is important to pay special attention to a legal difference here. Brokerages like Futu, Tiger, and Changqiao were penalized because there is already a mature securities legal system in mainland China. The Securities Law clearly states that securities companies must be approved by the State Council's securities regulatory authority and obtain a securities business license to operate securities brokerage, securities financing, and margin trading services; no unit or individual other than securities companies may engage in securities underwriting, securities sponsorship, securities brokerage, and securities financing and margin trading. Violating relevant regulations and illegally operating securities business may result in orders for correction, confiscation of illegal gains, and fines of more than one to ten times the illegal gains; if there are no illegal gains or if the illegal gains are less than one million yuan, fines of more than one million yuan and less than ten million yuan may still be imposed.
This is a typical case of "there are laws, there are licenses, there are standards for violations, and there are bases for penalties." Therefore, the CSRC can state that although you have a Hong Kong license, you do not have a securities business license for mainland China, and providing securities brokerage services to domestic investors violates the Chinese securities legal system. Where do the illegal gains come from? From the securities business you conducted without permission within the Chinese regulatory scope. Since illegal gains can be identified and the law authorizes regulatory authorities to confiscate illegal gains, then the confiscation is legally valid.
But the situation for cryptocurrency exchanges is more complex.
Currently, there is no "cryptocurrency exchange licensing system" in mainland China. In other words, it is not the case that if you meet certain conditions, you can apply for a virtual currency exchange license in mainland China and then legally provide services to mainland users. On the contrary, China's basic attitude towards virtual currency trading activities is to define virtual currency-related business activities as illegal financial activities through regulatory policies and departmental notices.
In 2013, the People's Bank of China and other departments issued a notice on preventing Bitcoin risks, clearly stating that Bitcoin is not issued by monetary authorities, does not possess monetary attributes such as legal tender and coerciveness, and is not true currency; financial institutions and payment institutions are prohibited from engaging in activities related to Bitcoin. In 2017, seven departments issued a notice on preventing risks of token issuance and financing, halting ICOs and requiring various token financing trading platforms not to engage in exchange services between legal currency and tokens or virtual currencies, not to buy or sell tokens or virtual currencies as a central counterparty, and not to provide pricing, information intermediary, and other services. In 2021, ten departments issued a notice on further preventing and addressing the risks of virtual currency trading speculation, further clarifying that virtual currencies do not have the same legal status as legal tender, and that virtual currency-related business activities are considered illegal financial activities. The People's Bank of China subsequently clarified in response to public comments that virtual currencies cannot be traded domestically and pose legal risks.
Thus, there are similarities and differences between cryptocurrency exchanges and Hong Kong brokerages.
The similarity lies in that they are both foreign entities, or at least through foreign entities, providing services with strong financial attributes to residents of mainland China. One provides securities and futures services such as Hong Kong and U.S. stocks, funds, and margin trading; the other provides trading services such as virtual currency spot, contracts, wealth management, lending, pledging, copy trading, listing coins, and OTC. They both target users within mainland China and charge transaction fees, interest, spreads, platform service fees, or other revenues. From a regulatory intuition perspective, these businesses are not ordinary internet services but services with obvious financial, capital, and investment attributes.
The difference lies in that brokerage business has a complete legal system in China, while cryptocurrency exchanges are not "illegally operating a business that could originally apply for a license," but are continuing to operate in a business space that has been entirely denied by regulatory policies. The former is "you do not have a Chinese securities license, so you cannot conduct securities business"; the latter is closer to "this business is not permitted in mainland China, so you cannot target mainland users."
This also explains why we cannot simply say that since the CSRC can confiscate Futu's illegal gains, Chinese regulatory authorities can certainly confiscate all illegal gains from Binance, OKX, Bybit, and other foreign exchanges tomorrow. Legally, such a rough analogy cannot be made. Because securities business has explicit authorization clauses in the Securities Law and rules for confiscating illegal gains; while in the realm of virtual currency exchanges, more reliance is placed on regulatory notices, departmental regulations, risk disposal policies, and the legal frameworks that may apply in specific cases, such as criminal law, foreign exchange, anti-money laundering, illegal fundraising, gambling, fraud, and aiding information network crime activities.
But precisely because of this, cryptocurrency exchanges should not feel safe; instead, they should be more anxious.
Why? Because at least there is a "compliance path" for securities business. If you want to operate securities business in mainland China, you should apply for the corresponding license, accept the supervision of the CSRC, and enter the statutory financial system. Of course, it is not easy for foreign brokerages to directly obtain a license in mainland China, but at least the securities legal framework itself is clear. Cryptocurrency exchanges, on the other hand, have no compliance path when facing users in mainland China. You cannot say that because I have a license in Hong Kong, I can open contract trading to mainland residents; nor can you say that because I am compliant in Dubai, I can conduct Chinese promotions, KOL rebates, offline activities, community operations, and OTC services in mainland China. Because mainland China does not recognize the legitimate operational space for such services.
From this perspective, the real reminder that the Futu incident gives to cryptocurrency exchanges is not "tomorrow the regulators will certainly confiscate all your illegal gains," but rather three other statements: first, foreign licenses cannot counter Chinese regulatory authorities; second, if the service targets residents of mainland China, it may trigger Chinese regulatory evaluation; third, once regulatory authorities decide to look through the essence of the business, foreign structures, foreign entities, and foreign licenses do not inherently isolate risks.

Risks Fall on Individuals

In reality, many cryptocurrency exchanges are indeed still targeting users in mainland China through various means. On the surface, they may have already closed registrations for mainland Chinese phone numbers or no longer publicly claim to support Chinese users. But in actual operations, the Chinese interface is still there, Chinese customer service is still there, Chinese communities are still there, Chinese KOL promotions are still there, the rebate system is still there, offline activities are still there, and many exchanges' growth teams, business teams, market teams, and technical teams still have intricate connections with mainland China.
If mainland Chinese users simply access foreign platforms by circumventing the firewall, and the platform does not actively market, does not have Chinese operations, and does not have service arrangements targeting Chinese users, the legal evaluation will be relatively complex. But if the platform publicly states "we do not serve mainland Chinese users" while continuously acquiring customers through agents, KOLs, communities, rebates, lectures, offline activities, Chinese information packages, WeChat groups, and Telegram groups, then regulatory authorities may very well consider this not as passive access but as actively targeting the mainland market.
At this point, the issue is not just whether the platform will have its domain name blocked, its app taken down, or its payment channels cut off. The more realistic risk is that relevant personnel, if they are in mainland China or enter mainland China in the future, may face very specific legal consequences.
Here, it is also important to distinguish between administrative risks and criminal risks. Not all cryptocurrency trading services targeting mainland users will automatically constitute criminal offenses. Criminal liability must be assessed based on specific actions, specific amounts, specific levels of participation, and specific harmful consequences. For example, if an ordinary employee provides some marginal technical support, that is different from the legal risks faced by actual controllers, executives, core operational leaders, fund channel leaders, OTC leaders, contract business leaders, and platform promotion leaders.
However, if a cryptocurrency exchange provides trading services to residents of mainland China in a long-term, large-scale, and organized manner, especially involving contract leverage, fund channels, OTC deposits and withdrawals, agent rebates, and project listings, relevant actual controllers, executives, or core business leaders who are in mainland China may indeed face criminal risks.
Many friends may wonder why. Because under the framework of Chinese criminal law, operating securities, futures, or insurance businesses without approval from the relevant state authorities, or illegally engaging in fund payment and settlement activities, disrupting market order, and in serious cases, may trigger the crime of illegal operation. However, whether cryptocurrency exchanges can be uniformly treated as illegal operations is not a simple conclusion in practice. It depends on whether specific business activities are recognized by judicial authorities as illegal operations of a certain type of financial business, whether there are attributes of payment settlement, securities and futures, and currency exchange, and whether the severity standards are met.
The purpose of writing this article is certainly not to scare people; I want to express that cryptocurrency exchanges have no legitimate operational space in mainland China, and if relevant businesses are conducted targeting residents of mainland China, there is a clear regulatory policy risk; if the business further overlaps with fund pools, leveraged contracts, illegal fundraising, pyramid schemes, money laundering channels, gambling, and fraud, then it may escalate from general regulatory risk to criminal risk. Especially for actual controllers, executives, and core business personnel, if they participate in decision-making, organization, profit-making, and directing operations in mainland China for a long time, their risks are clearly not on the same level as those of ordinary users or ordinary employees.

Regulators Keep Accounts

This is also the most valuable insight from the Futu incident for the cryptocurrency industry: regulation may not take action immediately, but that does not mean regulators will not keep accounts.
Internet brokerages like Futu and Tiger have not just recently attracted regulatory attention. As early as 2021, the CSRC had already expressed its regulatory stance through the media; in November 2021, the CSRC interviewed executives from Futu and Tiger, clearly requiring them to standardize cross-border securities business targeting domestic investors in accordance with the law; in 2022, regulation continued to promote the rectification idea of "effectively curbing incremental growth and orderly resolving existing issues." In other words, this is not a sudden penalty but a process where regulatory attitudes have been repeatedly released, rectification requirements have been continuously advanced, and ultimately entered the stage of administrative penalties.
Cryptocurrency exchanges are the same. China's regulatory attitude towards virtual currencies has been very clear from 2013, 2017, to 2021. Many exchanges and practitioners are not unaware but choose to ignore. Everyone knows that the mainland Chinese market is large, users are numerous, trading is active, contract demand is strong, and KOL conversion efficiency is high, so they may verbally claim not to serve, but their actions tell a different story. The problem is that regulatory documents do not cease to exist just because you pretend not to see them.
For foreign cryptocurrency exchanges, what they should really do is not to study how to make disclaimers look prettier, but to substantively assess whether they are targeting the mainland market. For example, do they allow users with mainland Chinese identities to register and complete KYC? Is there a Chinese team specifically responsible for the mainland market? Are they acquiring mainland users through KOLs, agents, and rebate systems? Are they organizing offline activities in the mainland? Are there domestic employees participating in promotion, customer service, operations, and trading support? Are they providing OTC deposit and withdrawal conveniences for mainland users? Are they using technical means to evade regulatory identification? If they seriously answer these questions, many platforms will have a clearer understanding.
For mainland users, this incident also serves as a reminder. Many people feel that when using foreign brokerages or exchanges, the platforms are large, have many licenses, have extensive advertising, and KOLs are promoting them, there should be no problems. But the most troublesome aspect of financial services is that platform compliance does not mean your usage path is compliant, and platform safety abroad does not guarantee your safety in the mainland. Especially when it involves fund inflows and outflows, foreign exchange usage, virtual currency trading, bank card freezes, fraud-related fund inflows, and OTC trading counterparty risks, ordinary users are often the weakest link in the risk chain.
Therefore, the title of this article stating "Cryptocurrency Exchanges Are Anxious" does not mean that regulators will tomorrow apply the logic of the Securities Law to confiscate all illegal gains from all exchanges. Rather, it aims to remind everyone that the Futu incident has once again revealed a very realistic regulatory logic: foreign licenses do not mean you can ignore mainland China; businesses abroad do not mean risks are absent in the mainland; if users are in China, regulators may trace back through users, funds, promotions, teams, technical services, and actual profit chains.
In recent years, there has been a popular saying in the cryptocurrency industry: "We are a global platform and do not target Chinese users." If this statement is true, it can certainly be part of the compliance boundary. But if it is merely a disclaimer on the official website while actual business still revolves around Chinese users, then its firewall effect is very limited. Regulators look at facts, not slogans; they look at business flows, capital flows, user flows, and promotional flows, not what you write on your website.
From a lawyer's perspective, in the future, all cross-border financial services targeting mainland Chinese users, whether securities, funds, futures, or virtual currencies, stablecoins, RWA, on-chain wealth management, and crypto payments, will increasingly find it difficult to explain with a simple "I am legal abroad." The essence of financial regulation is the management of funds, risks, and investors. As long as your service targets residents of mainland China, and as long as your business substantially affects China's financial order, foreign exchange management, anti-money laundering, personal information protection, and social stability, you cannot completely stand outside of Chinese regulation.
The cryptocurrency industry certainly has its technological and commercial value, and directions like stablecoins, on-chain payments, global asset flows, and RWA may indeed represent part of future financial infrastructure. But the more future-oriented the industry is, the less it can be built on regulatory gray areas and a mindset of luck. A truly mature industry is one where everyone begins to understand where the boundaries lie, knows which money cannot be earned, which users cannot be touched, and which businesses cannot be conducted in the wrong places.
This statement is understood by traditional brokerages, and cryptocurrency exchanges should understand it as well.