On May 22, Futu Holdings disclosed receipt of an investigation notice and administrative penalty pre-notice from the China Securities Regulatory Commission (CSRC) and its Shenzhen branch. The regulator determined that specific Futu entities in mainland China and Hong Kong conducted securities business, public fund sales, and futures trading without requisite licenses, violating the Securities Law, Securities Investment Fund Law, and Futures and Derivatives Law. The CSRC intends to order cessation of these activities, confiscate illegal gains, and impose fines totaling approximately 1.85 billion yuan.

Additionally, a personal fine of 1.25 million yuan is proposed for founder and CEO Li Hua, pending final procedural approval. Data compiled by Woofun AI indicates this penalty represents one of the largest administrative fines in the sector's history, marking a decisive shift in cross-border financial enforcement.

The core regulatory logic extends beyond a simple crackdown on brokerage firms; it establishes that foreign licenses do not function as global passports for serving mainland Chinese residents. While Futu and similar entities hold valid licenses in Hong Kong or other jurisdictions, the CSRC evaluates operations based on whether financial services effectively enter the mainland regulatory order. A license in Hong Kong permits securities business within that jurisdiction but does not authorize targeting mainland residents. This distinction is critical for cryptocurrency exchanges like Binance, OKX, and Bybit, which often cite licenses in Dubai, Europe, or Hong Kong to assert compliance.

However, providing registration, trading, wealth management, or rebate services to mainland users triggers Chinese regulatory evaluation regardless of foreign registration status.

A fundamental legal divergence exists between the securities and cryptocurrency sectors regarding enforcement mechanisms. Brokerages were penalized under a mature legal framework where the Securities Law explicitly mandates licensing for securities brokerage and margin trading, allowing regulators to confiscate illegal gains with clear statutory backing. Conversely, mainland China lacks a cryptocurrency exchange licensing system; instead, regulatory policies from 2013, 2017, and 2021 define virtual currency-related activities as illegal financial operations. Woofun AI notes that while securities violations allow for direct confiscation under specific laws, crypto enforcement relies on a broader matrix of criminal law, anti-money laundering statutes, and risk disposal policies rather than a single licensing violation clause.

Despite the absence of a specific crypto licensing framework, the risk profile for exchanges remains severe due to the lack of any compliance path for mainland operations. Unlike securities firms that can theoretically apply for mainland licenses, crypto exchanges face a total prohibition on serving domestic users. The regulatory stance clarifies that possessing a foreign license does not legitimize contract trading, OTC services, or promotional activities targeting China. This creates a scenario where exchanges cannot claim a "compliance gap" but rather operate in a space entirely denied by policy, making foreign structures ineffective at isolating risks when business flows target mainland residents.

Operational realities suggest many exchanges continue to target the mainland market despite public disclaimers. While some platforms may restrict phone number registrations, the persistence of Chinese interfaces, customer service, KOL promotions, rebate systems, and offline activities indicates active market targeting. If platforms claim non-service while utilizing agents, WeChat groups, and Telegram channels to acquire users, regulators may classify this as active targeting rather than passive access. Woofun AI analysis suggests that such operational behaviors significantly increase the likelihood of regulatory intervention, moving beyond domain blocking to potential legal consequences for personnel.

The legal risks extend from administrative penalties to criminal liability for key personnel. Under Chinese criminal law, operating financial businesses without approval, disrupting market order, or engaging in illegal fund settlement can constitute the crime of illegal operation. While ordinary employees face lower risks, actual controllers, executives, and core business leaders involved in decision-making, fund channels, and promotion within mainland China face substantial criminal exposure. This risk escalates if operations involve leveraged contracts, illegal fundraising, or money laundering channels, transforming regulatory friction into direct criminal prosecution.

The Futu case underscores that regulators maintain long-term oversight rather than reacting impulsively. Regulatory warnings regarding cross-border securities business began as early as 2021, with interviews and rectification requirements preceding the final penalty. Similarly, crypto regulatory documents from 2013 to 2021 have consistently prohibited virtual currency trading, yet many exchanges continue to operate in the gray zone. The lesson is clear: regulatory silence does not imply tolerance, and the accumulation of evidence regarding user flows, capital flows, and promotional activities can lead to retrospective enforcement.

Ultimately, the industry must recognize that foreign compliance does not equate to domestic safety. The essence of financial regulation lies in managing funds, risks, and investors within a specific jurisdiction. As long as services target mainland residents and impact financial order, foreign entities cannot stand outside Chinese regulation. A mature approach requires acknowledging boundaries, understanding which markets are off-limits, and ceasing operations that rely on regulatory arbitrage rather than genuine compliance.