Alternatives to tokenization after China: how to mitigate risks
How RWA (Real World Asset) Tokenization Projects Can Mitigate Regulatory Risks in the PRC: A Practical Guide
Executive Summary
Problem: The People's Bank of China's warning (December 2023)¹ creates a legal basis for qualifying RWA operations as illegal financial activity. This creates extraterritorial risks for global projects with operational, personnel, or investment ties to mainland China (PRC).
Main Risks: Criminal prosecution of PRC citizens (founders, employees), freezing of accounts of affiliated persons, pressure on counterparties, and significant reputational damage.
Key Actions for Projects:
- Conduct an audit of ties with the PRC: Assess investor concentration, team location, and IT infrastructure.
- Restructure the company: Use an SPV or trust in a neutral jurisdiction (UAE, Cayman Islands, Singapore) for the legal isolation of assets and operations.
- Implement strict compliance: Integrate mandatory verification (KYC/AML) and multi-level geoblocking for users from the PRC.
1. Context: The "Chinese Barrier" and Its Global Consequences
In December 2023, seven PRC agencies, including the People's Bank of China, issued a "Warning on Risks of Illegal Activities Under the Guise of Real World Asset (RWA) Tokenization." The document does not introduce a direct ban but allows regulators to apply existing norms, particularly articles of the PRC Criminal Code regarding the illegal absorption of public deposits (Art. 176) and fundraising fraud (Art. 192)².
Excerpt from the warning¹ (unofficial translation):
"Some platforms... under the guise of RWA... carry out illegal issuance of securities, illegal absorption of public funds, and other unlawful financial activities... Authorities will strictly crack down on such activities in accordance with the law."
The key threat is the extraterritorial application of legislation through indirect mechanisms:
- Pressure on individuals: Criminal prosecution of PRC citizens (employees, founders) upon entering the country or pressure on their families.
- Financial blockades: Freezing the accounts of Chinese partners, investors, or counterparties associated with the project.
- Interaction with platforms: Demands to exchanges and service providers for the delisting of tokens or cessation of service to the project.
Legal status of Hong Kong and Macau: These Special Administrative Regions have their own legal systems (Hong Kong follows Common Law), which are more favorable toward digital assets. However, Beijing's growing political influence and the existence of mutual legal assistance agreements with mainland China mean they are not absolutely safe zones, but rather jurisdictions requiring separate, in-depth legal analysis.
2. Risk Assessment: Probability Matrix and Quantitative Criteria
A project's connection to the PRC is determined based on systemic indicators. For an objective risk assessment, it is recommended to use a "Probability/Impact" matrix.
Risk Probability and Impact Matrix
| Impact / Probability | Low | Medium | High |
|---|---|---|---|
| Critical | – | Pressure on counterparties | Criminal prosecution of founders/employees |
| Significant | – | Blocking of partner accounts | Delisting requests from major exchanges |
| Moderate | Reputational costs | Marketing restrictions | Blocking of website access in the PRC |
Quantitative Criteria for Determining Risk Level
| Risk Level | Quantitative and Qualitative Criteria |
|---|---|
| High | - More than 1 employee or key contractor is physically located in the PRC. <br>- Significant concentration of investors from the PRC (e.g., more than 10% of the total number or volume of investments). This threshold is not legally established but serves as a practical indicator of increased regulatory attention⁴. <br>- Key IT infrastructure (servers, domains) is hosted in the PRC. <br>- Founders or beneficiaries are PRC citizens, even if residing abroad. |
| Medium | - No direct ties, but key counterparties (market makers, auditors) have offices or personnel in the PRC. <br>- Insignificant share of investors from the PRC (less than 10%) or presence of investors from Hong Kong/Macau. <br>- Marketing campaigns in Chinese targeting the PRC audience. |
| Low | - Legal structure is registered in a reliable jurisdiction (UAE, Singapore, Switzerland, Cayman Islands) with confirmed economic substance. <br>- Team, infrastructure, and investors have no obvious ties to the PRC. <br>- Strict KYC/AML and geoblocking are implemented, excluding participation by PRC residents. |
3. Response Matrix: Priorities, Costs, and Effectiveness
| Risk Level | Key Actions (Priority: High) | One-time Costs | Operational Costs | Effectiveness Rating |
|---|---|---|---|---|
| High | 1. Legal restructuring (SPV/trust). 2. IT infrastructure migration and relocation/replacement of PRC-based personnel. 3. Implementation of strict KYC/AML and geoblocking. | $30,000 – $150,000+ | $10,000 – $50,000 / year | High. Reduces fundamental risks. |
| Medium | 1. Counterparty Due Diligence. 2. Implementation of KYC/AML for all new investors. 3. Publication of an official policy refusing to work with PRC residents. | $5,000 – $30,000 | $5,000 – $20,000 / year | Medium. Reduces indirect risks but does not eliminate them entirely. |
| Low | 1. Regular monitoring of legislation. 2. Periodic audit of compliance procedures. 3. Publication of transparency reports. | $0 – $5,000 | $5,000 – $15,000 / year | Supportive. Ensures long-term stability. |
4. Risk Mitigation Strategies
4.1. Legal and Corporate Restructuring
The goal is to create a legal barrier between operations, assets, and the PRC jurisdiction. An effective scheme involves the use of an SPV (Special Purpose Vehicle).
Structure Example:
[Underlying Asset] → owned by [SPV in Cayman Islands or BVI] → income rights are licensed to [Operating Company in UAE (ADGM/DIFC) or Singapore] → company issues tokens.
Key Aspects:
- Substance (Real Economic Presence): In the operating company's jurisdiction (e.g., UAE), it is necessary to provide a real office, employees, and management decision-making.
- Taxation: Analysis of withholding tax, corporate tax, and capital gains tax in each jurisdiction is required.
4.2. Technological and Operational Adaptation
- KYC/AML: Implement mandatory verification using providers that comply with FATF recommendations³ (e.g., Sumsub, Chainalysis, Elliptic).
- Geoblocking: Use a multi-layered approach:
- IP Blocking: Restricting access for IP addresses from the PRC.
- KYC Data Analysis: Refusal of service based on citizenship or residency.
- Technical Analysis: Checking browser language, time zone, and WebRTC leaks to identify users using VPNs.
- IT Infrastructure Analysis: Check the location of servers, domains, and CDN providers using
whois,traceroute, and network response analysis tools. Eliminate hosting and data processing in the PRC. - Data Interaction (GDPR and Local Laws): The collection of IP addresses and geodata falls under GDPR⁵ and other data protection laws. It is necessary to:
- Have a lawful basis for processing (e.g., compliance with legal AML obligations).
- Clearly state data collection purposes in the Privacy Policy.
- Ensure secure storage and minimization of collected data.
4.3. Documentation and Templates
-
Contractual Clauses (for employees and contractors):
Sample Wording:
"The Contractor confirms and warrants that they are not a resident of mainland China (PRC) and will provide the Services while being physically located outside the territory of the PRC throughout the term of the Agreement. Violation of this clause is a material breach of the Agreement and gives the Client the right to its immediate termination." -
Wording for White Paper / Terms of Service:
Example:
"Tokens are not offered for sale and are not intended for residents and citizens of mainland China (PRC), as well as other jurisdictions where such operations are prohibited or restricted. The platform uses geoblocking and KYC procedures to ensure compliance with these restrictions." -
Legal Opinion Template: Request a conclusion from lawyers that confirms:
- Compliance of the token with the laws of the company's registration jurisdiction (it is not a security).
- Adequacy and functionality of the implemented KYC/AML and geoblocking procedures.
- Absence of legal ties between operations and the PRC.
5. Continuous Monitoring and Compliance
Implement a regular control system to maintain a low risk level.
- Responsible Roles: Appoint a Compliance Officer or an external consultant.
- Frequency: Conduct risk reviews quarterly.
- Key Performance Indicators (KPIs):
- Share of investors and users from the PRC (target — 0%).
- Number of blocked access attempts from PRC IP addresses.
- Percentage of KYC rejections due to PRC residency.
6. Hypothetical Risk Scenarios
- Scenario 1: "Detention of a Key Employee"
- Situation: A lead developer (PRC citizen) enters China.
- Consequences: Detention, interrogation, seizure of equipment, possible initiation of a criminal case. The project loses an employee and receives a direct signal of government attention.
- Scenario 2: "Delisting Request"
- Situation: PRC authorities send an official request to a crypto exchange to stop trading the project's token, citing its connection to Chinese investors.
- Consequences: The exchange carries out the delisting to minimize its own risks. The token price drops, and investor confidence is undermined.
7. Investor Checklist
- Jurisdiction: Request registration documents and a Legal Opinion. Is the asset ownership structure transparent?
- Team and Infrastructure: Where are key employees and servers physically located? (Use
whois,traceroute). - Compliance: Does the project require KYC? Is there a direct refusal to work with PRC residents in the White Paper?
- Tokenholder Analysis: Use blockchain analytics (Nansen, Arkham) to assess token concentration in addresses potentially linked to the PRC.
8. Limitations of Analysis
This article does not constitute legal or tax advice. The analysis does not cover regulatory specifics in Hong Kong and Macau, nor detailed tax consequences of the proposed structures. Projects should seek consultation from qualified lawyers and tax advisors.
9. Conclusion
Regulatory pressure from the PRC is a global marker of the RWA market's maturity, increasing compliance requirements. Projects that ignore these risks will be forced out of the market. Sustainable growth and access to institutional capital will be achieved by those who proactively build transparent legal structures, implement strict compliance, and ensure technological isolation from high-risk jurisdictions. For investors, this means that in-depth Due Diligence becomes a mandatory condition for capital preservation.
¹ Source: Joint warning of seven PRC departments dated 12/20/2023.
http://www.pbc.gov.cn/goutongjiaoliu/113456/113469/5185732/index.html
² Source: Criminal Code of the People's Republic of China.
http://www.npc.gov.cn/zgrdw/npc/xinwen/202012/26/content_234657.htm
³ Source: FATF (2021), Updated Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers.
https://www.fatf-gafi.org/en/publications/fatfrecommendations/Updated-Guidance-for-a-Risk-Based-Approach-to-Virtual-Assets-and-VASPs.html
⁴ Opinion: The 10% threshold is often used in compliance practice as an indicator of significant concentration requiring additional analysis, although it is not legislatively fixed in this context.
⁵ Source: Regulation (EU) 2016/679 (General Data Protection Regulation).
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32016R0679