Alternatives to tokenization after China: how to mitigate risks
How RWA (Real World Asset) Tokenization Projects Can Mitigate Regulatory Risks in the PRC: A Practical Guide
Executive Summary
Problem: The People's Bank of China's warning (December 2023)¹ creates a legal basis for qualifying RWA operations as illegal financial activity. This creates extraterritorial risks for global projects with operational, personnel, or investment ties to mainland China (PRC).
Main Risks: Criminal prosecution of PRC citizens (founders, employees), freezing of accounts of affiliated persons, pressure on counterparties, and significant reputational damage.
Key Actions for Projects:
Conduct an audit of ties with the PRC: Assess investor concentration, team location, and IT infrastructure.
Restructure the company: Use an SPV or trust in a neutral jurisdiction (UAE, Cayman Islands, Singapore) for the legal isolation of assets and operations.
Implement strict compliance: Integrate mandatory verification (KYC/AML) and multi-level geoblocking for users from the PRC.
1. Context: The "Chinese Barrier" and Its Global Consequences
In December 2023, seven PRC agencies, including the People's Bank of China, issued a "Warning on Risks of Illegal Activities Under the Guise of Real World Asset (RWA) Tokenization." The document does not introduce a direct ban but allows regulators to apply existing norms, particularly articles of the PRC Criminal Code regarding the illegal absorption of public deposits (Art. 176) and fundraising fraud (Art. 192)².
p>Excerpt from the warning¹ (unofficial translation):
"Some platforms... under the guise of RWA... carry out illegal issuance of securities, illegal absorption of public funds, and other unlawful financial activities... Authorities will strictly crack down on such activities in accordance with the law."/p>
The key threat is the extraterritorial application of legislation through indirect mechanisms:
Pressure on individuals: Criminal prosecution of PRC citizens (employees, founders) upon entering the country or pressure on their families.
Financial blockades: Freezing the accounts of Chinese partners, investors, or counterparties associated with the project.
Interaction with platforms: Demands to exchanges and service providers for the delisting of tokens or cessation of service to the project.
Legal status of Hong Kong and Macau: These Special Administrative Regions have their own legal systems (Hong Kong follows Common Law), which are more favorable toward digital assets. However, Beijing's growing political influence and the existence of mutual legal assistance agreements with mainland China mean they are not absolutely safe zones, but rather jurisdictions requiring separate, in-depth legal analysis.
2. Risk Assessment: Probability Matrix and Quantitative Criteria
A project's connection to the PRC is determined based on systemic indicators. For an objective risk assessment, it is recommended to use a "Probability/Impact" matrix.
Risk Probability and Impact Matrix
Quantitative Criteria for Determining Risk Level
3. Response Matrix: Priorities, Costs, and Effectiveness
4. Risk Mitigation Strategies
4.1. Legal and Corporate Restructuring
The goal is to create a legal barrier between operations, assets, and the PRC jurisdiction. An effective scheme involves the use of an SPV (Special Purpose Vehicle).
Structure Example:[Underlying Asset] → owned by [SPV in Cayman Islands or BVI] → income rights are licensed to [Operating Company in UAE (ADGM/DIFC) or Singapore] → company issues tokens.
Key Aspects:
Substance (Real Economic Presence): In the operating company's jurisdiction (e.g., UAE), it is necessary to provide a real office, employees, and management decision-making.
Taxation: Analysis of withholding tax, corporate tax, and capital gains tax in each jurisdiction is required.
4.2. Technological and Operational Adaptation
KYC/AML: Implement mandatory verification using providers that comply with FATF recommendations³ (e.g., Sumsub, Chainalysis, Elliptic).
Geoblocking: Use a multi-layered approach:
ul>
li>IP Blocking: Restricting access for IP addresses from the PRC.
KYC Data Analysis: Refusal of service based on citizenship or residency.
Technical Analysis: Checking browser language, time zone, and WebRTC leaks to identify users using VPNs.
IT Infrastructure Analysis: Check the location of servers, domains, and CDN providers using whois, traceroute, and network response analysis tools. Eliminate hosting and data processing in the PRC.
Data Interaction (GDPR and Local Laws): The collection of IP addresses and geodata falls under GDPR⁵ and other data protection laws. It is necessary to:
ul>
li>Have a lawful basis for processing (e.g., compliance with legal AML obligations).
Clearly state data collection purposes in the Privacy Policy.
Ensure secure storage and minimization of collected data.
4.3. Documentation and Templates
p>Contractual Clauses (for employees and contractors):/p>
blockquote>
p>Sample Wording:
"The Contractor confirms and warrants that they are not a resident of mainland China (PRC) and will provide the Services while being physically located outside the territory of the PRC throughout the term of the Agreement. Violation of this clause is a material breach of the Agreement and gives the Client the right to its immediate termination."/p>
/blockquote>
p>Wording for White Paper / Terms of Service:/p>
blockquote>
p>Example:
"Tokens are not offered for sale and are not intended for residents and citizens of mainland China (PRC), as well as other jurisdictions where such operations are prohibited or restricted. The platform uses geoblocking and KYC procedures to ensure compliance with these restrictions."/p>
/blockquote>
p>Legal Opinion Template: Request a conclusion from lawyers that confirms:/p>
ul>
li>Compliance of the token with the laws of the company's registration jurisdiction (it is not a security).
Adequacy and functionality of the implemented KYC/AML and geoblocking procedures.
Absence of legal ties between operations and the PRC.
5. Continuous Monitoring and Compliance
Implement a regular control system to maintain a low risk level.
Responsible Roles: Appoint a Compliance Officer or an external consultant.
Frequency: Conduct risk reviews quarterly.
Key Performance Indicators (KPIs):
ul>
li>Share of investors and users from the PRC (target — 0%).
Number of blocked access attempts from PRC IP addresses.
Percentage of KYC rejections due to PRC residency.
6. Hypothetical Risk Scenarios
Scenario 1: "Detention of a Key Employee"
ul>
li>Situation: A lead developer (PRC citizen) enters China.
Consequences: Detention, interrogation, seizure of equipment, possible initiation of a criminal case. The project loses an employee and receives a direct signal of government attention.
Situation: PRC authorities send an official request to a crypto exchange to stop trading the project's token, citing its connection to Chinese investors.
Consequences: The exchange carries out the delisting to minimize its own risks. The token price drops, and investor confidence is undermined.
7. Investor Checklist
Jurisdiction: Request registration documents and a Legal Opinion. Is the asset ownership structure transparent?
Team and Infrastructure: Where are key employees and servers physically located? (Use whois, traceroute).
Compliance: Does the project require KYC? Is there a direct refusal to work with PRC residents in the White Paper?
Tokenholder Analysis: Use blockchain analytics (Nansen, Arkham) to assess token concentration in addresses potentially linked to the PRC.
8. Limitations of Analysis
This article does not constitute legal or tax advice. The analysis does not cover regulatory specifics in Hong Kong and Macau, nor detailed tax consequences of the proposed structures. Projects should seek consultation from qualified lawyers and tax advisors.
9. Conclusion
Regulatory pressure from the PRC is a global marker of the RWA market's maturity, increasing compliance requirements. Projects that ignore these risks will be forced out of the market. Sustainable growth and access to institutional capital will be achieved by those who proactively build transparent legal structures, implement strict compliance, and ensure technological isolation from high-risk jurisdictions. For investors, this means that in-depth Due Diligence becomes a mandatory condition for capital preservation.
¹ Source: Joint warning of seven PRC departments dated 12/20/2023.
http://www.pbc.gov.cn/goutongjiaoliu/113456/113469/5185732/index.html
² Source: Criminal Code of the People's Republic of China.
http://www.npc.gov.cn/zgrdw/npc/xinwen/202012/26/content_234657.htm
³ Source: FATF (2021), Updated Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers.
https://www.fatf-gafi.org/en/publications/fatfrecommendations/Updated-Guidance-for-a-Risk-Based-Approach-to-Virtual-Assets-and-VASPs.html
⁴ Opinion: The 10% threshold is often used in compliance practice as an indicator of significant concentration requiring additional analysis, although it is not legislatively fixed in this context.
⁵ Source: Regulation (EU) 2016/679 (General Data Protection Regulation).
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32016R0679