China has a substantial pool of engineers with experience in distributed systems, cybersecurity, cryptography, blockchain infrastructure, and digital platforms.
However, hiring this talent requires caution. “Web3” is not a single legal category in mainland China. The regulatory treatment of a business depends on what the company actually builds, who it serves, how it earns revenue, and whether its activities involve virtual currencies, token issuance, financial services, data processing, or other regulated functions.
An Employer of Record in China may provide a compliant employment structure for certain lawful technology roles. It cannot make a prohibited, restricted, or unlicensed business activity legal.
Employers should therefore review both the business model and the employee’s actual duties before making a hire.
The Short Answer
2026 regulatory update: On February 6, 2026, eight Chinese regulators issued Yin Fa [2026] No. 42, reaffirming the prohibition on illegal virtual-currency financial activities and setting out restrictions involving real-world-asset (RWA) tokenisation. The notice replaces the earlier 2021 joint circular. Importantly, the 2026 notice also restricts intermediaries and IT service providers from supporting unauthorized RWA tokenization and virtual-currency-related business activities. An employer should review the actual products, customers and engineering tasks; describing workers as independent software developers does not automatically make technical support for a prohibited activity lawful. Employers should distinguish lawful enterprise blockchain, cybersecurity or software engineering work from prohibited crypto trading, token fundraising, unlicensed financial intermediation and related activity. An EOR does not cure an unlawful business model. The regulators’ official Q&A explains the boundaries.
An EOR may help a foreign company employ China-based workers by becoming their legal employer and handling:
- Local employment contracts
- Monthly payroll in renminbi
- Individual income tax withholding
- Social insurance and housing fund contributions
- Statutory leave and employment records
- Onboarding and offboarding administration
However, an EOR does not provide:
- Authorization to operate a cryptocurrency exchange
- Permission to issue, promote, or sell tokens
- A financial-services licence
- Approval for virtual-currency trading
- Permission to conduct virtual-currency mining
- Internet, data, or telecommunications licences
- Approval for prohibited tokenization activities
- A substitute for a properly registered operating company
Our complete China EOR guide explains the broader legal-employer structure and when it can be used.
“Web3” Is Not One Business Activity
The label “Web3” can cover fundamentally different products and services. Some may involve enterprise software or blockchain research, while others may directly facilitate virtual-currency transactions.
Employers should classify the actual activity rather than relying on a general technology label.
Activities that may be feasible
Depending on the specific product, users, data and operating model, potentially supportable activities may include:
- Enterprise blockchain development
- Supply-chain traceability systems
- Distributed database infrastructure
- Cybersecurity and cryptographic research
- Blockchain testing and quality assurance
- Digital identity technology
- Non-financial smart-contract tooling
- Blockchain security auditing
- Technical standards and interoperability research
- Internal enterprise software built with distributed-ledger technology
Feasibility is not automatic. A detailed review may still be required under China’s rules for data, cybersecurity, internet services, encryption, employment and foreign investment.
China also regulates providers of blockchain information services. Companies whose platforms fall within this category may need to meet filing, security, content-management and technical requirements under the Blockchain Information Service Management Regulations.
High-risk or prohibited activities
Mainland China maintains strict restrictions on virtual-currency activities. Significant warning signs include:
- Operating a virtual-currency exchange
- Facilitating crypto-to-fiat or crypto-to-crypto trading
- Issuing or selling tokens
- Conducting initial coin offerings
- Providing virtual-currency derivatives
- Marketing overseas exchanges to mainland residents
- Supplying technical or payment support to prohibited trading services
- Operating virtual-currency mining projects
- Handling customer crypto assets or private keys
- Promoting unapproved real-world asset tokenization
- Providing pricing or intermediary services for virtual-currency transactions
The People’s Bank of China and other authorities have stated that virtual currencies do not have the same legal status as legal tender and that specified virtual-currency business activities constitute illegal financial activities. The authorities reinforced this approach in updated measures announced in February 2026.
Calling an activity “software development,” “research,” or “Web3 consulting” does not reduce the risk if the workers are actually supporting a prohibited service.
What an EOR Can Do for a Lawful Web3 Business
Where the underlying activity and role are supportable, an EOR can provide the employment layer needed to hire workers in mainland China.
The EOR normally:
- Signs the local employment contract
- Registers the employee for payroll
- Withholds and reports individual income tax
- Administers social insurance and housing fund contributions
- Maintains required employment documentation
- Manages statutory leave and employment changes
- Supports compliant termination procedures
- Provides locally appropriate onboarding and HR administration
The foreign company normally retains responsibility for:
- Selecting the employee
- Assigning daily work
- Managing performance
- Defining technical responsibilities
- Protecting intellectual property
- Controlling system and repository access
- Ensuring that the underlying business is lawful
- Obtaining any required business or regulatory permissions
Employers can review the practical allocation of responsibilities in our guide to Employer of Record risks in China.
What an EOR Cannot Fix
An EOR arrangement is not a regulatory shield.
It does not transform an illegal or restricted virtual-currency business into a lawful one. It also does not give a foreign company unrestricted authority to operate, sell services, invoice customers, market financial products, or process data in China.
An EOR cannot replace:
- A required financial licence
- An internet content or telecommunications licence
- Regulatory approval for a blockchain platform
- Data-transfer or cybersecurity compliance
- A commercial entity needed for local operations
- Tax and permanent-establishment analysis
- Product-specific legal review
- Approval for token issuance or exchange activity
A reputable EOR may refuse a role if the employee would support prohibited virtual-currency activity or expose the legal employer to unacceptable regulatory risk.
The EOR therefore needs an accurate description of the company, its products and the employee’s duties. Concealing the true nature of a role can jeopardize the entire arrangement.
Which Web3 Roles May Be Suitable?
Potentially supportable roles can include:
- Enterprise blockchain engineer
- Distributed-systems engineer
- Cybersecurity engineer
- Quality assurance engineer
- Blockchain security researcher
- Product manager
- Technical support specialist
- Compliance analyst
- Solutions architect
- Software documentation specialist
The job title alone is not decisive.
For example, a “blockchain engineer” developing an internal supply-chain verification system presents a different risk profile from an engineer maintaining transaction infrastructure for an overseas exchange serving mainland users.
Before approving a role, review:
- The employee’s daily responsibilities
- The product or platform they will support
- Where the users are located
- Whether tokens or virtual currencies are involved
- Whether the employee will access customer funds or private keys
- How the business generates revenue
- Whether services are offered to mainland residents
- Whether the employee will market or promote the platform
- Where code, personal information and operational data are stored
Employment Contracts and Documentation
Web3 roles often involve sensitive code, valuable intellectual property and privileged infrastructure access. Generic employment documents may not provide sufficient protection.
The employment package should clearly address:
- Job title and duties
- Work location
- Working hours and overtime
- Salary and permitted incentives
- Confidentiality obligations
- Intellectual-property ownership
- Source-code and repository access
- Open-source software responsibilities
- Information-security rules
- Personal information handling
- Device and remote-working policies
- Return of company property
- Access removal upon termination
Our China HR documentation guide explains the employment records foreign companies should prepare and maintain.
These documents should be coordinated with the EOR before the employee starts work. Important restrictions should not be introduced through an overseas policy that conflicts with the local employment contract.
Payroll and Token-Based Compensation
Salary for an employee in mainland China should normally be processed through local payroll in renminbi, with the correct individual income tax and statutory contributions.
Employers should not assume that wages, bonuses or commissions can be paid in cryptocurrency or tokens. Token-based compensation can create serious issues involving:
- Virtual-currency restrictions
- Payroll reporting
- Tax valuation
- Exchange controls
- Wage-payment compliance
- Employee disputes
- Regulatory exposure for the EOR
Any equity, token, offshore bonus or digital-asset incentive should receive specific legal and tax review before it is offered.
For an overview of the regular payroll process, see the China payroll guide.
Data and Cybersecurity Responsibilities
Web3 and blockchain employees may have access to source code, transaction records, user information, security credentials and other sensitive datasets.
Before hiring, the company should map:
- What data the employee can access
- Whether personal information is involved
- Where the data is stored
- Whether data will leave mainland China
- Who controls encryption keys
- Whether the employee has production access
- How access will be logged and reviewed
- How security incidents must be reported
- What happens to access when employment ends
China’s Personal Information Protection Law may apply when employees process identifiable personal information. Additional cybersecurity and data-security requirements may also apply depending on the system, organization and data involved.
The EOR generally manages employment-related personal information. The client remains responsible for the security and legality of its product, customer and operational data.
Intellectual Property and Access Control
A well-drafted IP clause is important, but contractual language alone is not sufficient.
Employers should also implement practical controls:
- Use company-controlled code repositories
- Provide access according to role
- Separate development and production permissions
- Maintain code-review records
- Establish an open-source approval process
- Restrict access to private keys and credentials
- Record ownership of inventions and technical documents
- Remove access immediately during offboarding
- Recover company devices and stored information
The China employee onboarding guide provides a broader checklist for bringing new workers into the organization.
Foreign Employees and Remote Teams
Foreign nationals working physically in mainland China usually need the appropriate work authorization. Being hired through an EOR does not automatically create eligibility for a work permit or visa.
Employers should check immigration feasibility before confirming the start date. See our China work permit and visa guide for the main process and documentation requirements.
Remote-working arrangements also need clear controls covering:
- Approved work location
- Equipment ownership
- Working hours
- Overtime authorization
- Network and repository access
- Data storage
- Security incident reporting
- Travel between jurisdictions
A worker should not be treated as an offshore freelancer merely because the company has no entity in China. If the actual relationship resembles employment, contractor classification can create labor, tax and compliance risk.
Pre-Hire Web3 Compliance Checklist
Before engaging an EOR or issuing an offer, complete the following review.
1. Classify the business
Describe what the company actually builds, sells and operates. Do not rely only on labels such as “Web3,” “fintech” or “blockchain.”
2. Identify the users
Determine whether the product is available to mainland residents, Chinese companies or users in other jurisdictions.
3. Review token and payment functions
Confirm whether the product involves virtual currencies, token issuance, exchanges, trading, custody, mining, derivatives, payments or asset tokenization.
4. Map the employee’s duties
Document the systems, customers, data and business processes the employee will support.
5. Identify required permissions
Check whether the operation requires a local entity, regulatory licence, filing, data assessment or another authorization.
6. Review payroll and incentives
Use locally compliant payroll and obtain advice before offering tokens, cryptocurrency or complex offshore incentives.
7. Assess data and security exposure
Map personal information, repositories, production access, cross-border transfers and security credentials.
8. Obtain EOR approval
Give the EOR a complete and accurate description of the business and proposed role before making commitments to the candidate.
9. Prepare the employment documents
Coordinate the employment contract, confidentiality terms, IP provisions, policies and onboarding records.
10. Establish an exit plan
Consider when growth, licensing, revenue generation or operational activity will require the company to establish its own entity.
Warning Signs Employers Should Not Ignore
Pause the hiring process if the proposed arrangement involves:
- Marketing an overseas crypto exchange to mainland users
- Selling or promoting tokens
- Paying regular compensation in cryptocurrency
- Supporting virtual-currency mining
- Handling customer digital assets or private keys
- Describing trading infrastructure as general software research
- Hiding the actual business activity from the EOR
- Assuming a Hong Kong entity automatically authorizes mainland activity
- Using an EOR as a substitute for required operating licences
- Conducting unapproved real-world asset tokenization
Hong Kong and mainland China have separate legal and regulatory systems. Authorization in Hong Kong does not automatically permit the same activity in mainland China.
When Is an EOR the Right Model?
An EOR may be appropriate when:
- The underlying business activity is lawful
- The company needs a limited number of employees
- The roles have been reviewed and clearly defined
- The company is testing the talent market
- Local customer invoicing is not required
- The EOR accepts the business and role
- The company does not yet need a full operating entity
A company may need its own entity, licences or another market-entry structure when it plans to:
- Conduct substantial local commercial operations
- Enter contracts with customers in China
- Invoice locally
- Operate a regulated platform
- Employ a large permanent team
- Hold specialised licences
- Process regulated data at scale
- Carry out activities beyond the EOR employment arrangement
Our China market-entry guide compares broader options for establishing and expanding operations.
Frequently Asked Questions
Can an EOR legally hire blockchain developers in China?
Potentially, yes. The answer depends on the company’s actual business, the developer’s responsibilities, the product’s users, and whether the work touches prohibited or regulated activities.
Can an EOR hire employees for a cryptocurrency exchange?
This presents severe regulatory risk, particularly when the exchange serves or targets mainland residents. An EOR does not legalize the underlying exchange or related support activity.
Can employees be paid in cryptocurrency?
Regular wages should generally be processed through compliant local payroll in renminbi. Cryptocurrency or token compensation requires specialist legal and tax review and may not be supportable.
Does an EOR provide a Web3 or financial-services licence?
No. An EOR supplies an employment structure. It does not authorize financial, exchange, token, internet or other regulated business activities.
Can a Hong Kong Web3 company hire developers in mainland China?
Possibly, but the company’s Hong Kong status does not remove mainland restrictions. The activities performed by the China-based employees must be reviewed separately.
Final Takeaway
Web3 hiring in China must begin with the business model, not the job title.
An EOR can be useful for employing talent who support lawful blockchain, distributed-systems and enterprise-technology activities. It cannot legalize virtual-currency trading, token issuance, mining, unlicensed financial services or other prohibited operations.
Before hiring, foreign companies should:
- Review the underlying product and revenue model
- Identify the users and jurisdictions involved
- Define each employee’s actual duties
- Assess data, payroll, IP and access risks
- Confirm the EOR’s willingness to support the role
- Obtain specialist advice where regulated activity may be involved
To assess whether your roles are suitable for an EOR structure, contact HROne.
This article provides general information and does not constitute legal, tax, financial or regulatory advice. Web3, data and virtual-currency rules are complex and may change. Obtain advice for the specific business model and proposed roles before hiring.
