Two Red Lines for Virtual Credit Cards: the FomePay Regulatory Case and the Shanghai 200-Million-Yuan Crackdown

Sources: PBOC Jiangjin Branch, Typical Cases of Illegal Payment Activities (as reported by mpaypass.com.cn) https://www.mpaypass.com.cn/news/202609/08174029.html ; Shanghai Public Security Bureau press briefing, August 27, 2026 (reported by Eastday and CCTV). This article is a review of public information and is not legal advice.

---

Timeline of the two cases

In July 2026 the Jiangjin Branch of the People's Bank of China disclosed in its Typical Cases of Illegal Payment Activities that a "Company C" operating the FomePay virtual credit card platform was suspected of conducting cross-border payment business without a licence. The platform advertised a US MSB registration and a Hong Kong MSO licence. Mainland users could register with just a phone number and an SMS code, then open a Visa or Mastercard virtual card with a minimum 32 USD top-up and a cardholder name. The platform provided payment QR codes: users scanned them with WeChat or Alipay, the RMB landed in Company C's account disguised as an ordinary consumer transaction, and was then moved offshore through payment-institution channels.

Note the timeline gap: FomePay had already stopped operating in July and August 2024 with user funds lost (this directory marked it inactive with a standing warning at the time), and its website remains unreachable. The 2026 disclosure is the regulator publishing its characterisation of an existing case, not a new enforcement action.

The second case is bigger. In January 2026 Shanghai economic crime investigators found a platform offering mainland users crypto top-up, multi-currency cross-border exchange and virtual card issuance. The takedown came in July, announced on August 27: Li and associates set up a technology company and built two cooperating platforms, one for cross-border funds exchange and one for virtual card issuance and settlement. The first collected customer cryptocurrency offshore, converted it into foreign currency pools, then fabricated cross-border settlement grounds to move the funds. The second issued cards with multiple virtual card operators: customers spent with the virtual cards like ordinary credit cards, repaid in cryptocurrency, and the platform converted that crypto back to fiat offshore to settle with the card side. The whole thing was a closed loop with no external exchanger needed. Nine suspects were caught, five approved for arrest by prosecutors on suspicion of illegal business operations, with over 200 million RMB involved.

---

What regulators actually target

Read together, the two cases send one clear signal: the target is not the virtual credit card as a product but the money chain behind it. A Visa or Mastercard virtual card issued by a licensed offshore institution is no different in nature from a physical card; a company using one for ad spend, cloud servers or SaaS subscriptions is normal commercial activity. What enforcement penetrates is two red lines:

Red line 1: platform-operated RMB top-up channels

The user nominally buys a USD card but actually pays RMB: the platform runs its own WeChat and Alipay collection codes, credits a USD balance at an internal rate, then moves the funds offshore through payment channels. Who collected the RMB, who set the rate and how the onshore and offshore legs match are all answered by the platform itself. The product is called top-up; the substance is cross-border payment or currency conversion. That is exactly the FomePay structure, and the regulator's conclusion was suspected unlicensed cross-border payment business.

Red line 2: crypto-mediated disguised currency exchange

The Shanghai case went further: the platform took RMB or crypto and completed RMB-to-foreign-currency value conversion through matched onshore and offshore pools and offshore crypto sales. Typical cases jointly issued by the Supreme People's Procuratorate and the State Administration of Foreign Exchange already state that using cryptocurrency as a medium to convert value between RMB and foreign currency for profit constitutes disguised FX trading, and serious cases amount to the crime of illegal business operations. One more reminder: under the February 2026 joint notice of eight ministries including the PBOC, all virtual-currency business activity in mainland China is an illegal financial activity, so a platform that only accepts USDT is by definition outside the domestic compliance framework.

Offshore licences do not cover onshore RMB activity

The most direct industry lesson from the FomePay case: an advertised US MSB or Hong Kong MSO licence answers whether particular activities are allowed in those jurisdictions. The moment a business collects RMB onshore, pools user funds, takes payment instructions and moves money across the border, Chinese payment and FX regulation applies on its own terms. An offshore licence is not a shield for onshore business.

---

User view: risk signals when choosing a platform

• Platform-operated WeChat/Alipay QR top-up: this is precisely the structure identified in the FomePay case and the highest-risk signal today. Binding a card to Alipay or WeChat for spending is different from the platform running its own RMB top-up channel; only the latter crosses the line.
• Phone-number-only registration with zero KYC: compliant cross-border payments require identity verification and FX reporting; a fully no-KYC platform is either outside the compliance framework or can vanish at any time.
• Platforms marketing direct RMB top-up as a feature: after these disclosures such marketing is a risk flag rather than an advantage and warrants re-evaluation.
• USDT-only offshore platforms: structurally outside the RMB-channel red line, but domestic crypto activity is itself illegal, and there is no recourse when the platform runs. FomePay balances remain unrecovered to this day.
• Balance discipline: treat every virtual card platform as one that could disappear tomorrow, and keep only what you will spend soon on the card.

---

How this directory handles it

The FomePay entry has stayed inactive with a pinned warning since it shut down, and this directory has now added the PBOC disclosure details. One clarification of our stance: the virtual credit card as a tool is neutral, and platforms with licensed issuance and compliant funding remain usable. But for platforms that rely on direct RMB top-up, regulatory risk has materially risen after these two cases. Going forward, this directory treats the funding-chain structure as an independent risk dimension in listing and review, not just fees and onboarding convenience.