You can place the save directly into your VC game. As far as I'm aware, they have yet to ban people for doing this kind of save manipulation.
(If anything, they ban the 3DS for a) piracy detected or b) CFW on 3DS detected)
Would I recommend it, no. There's no real point, since any mon as can manipulated via a bunch of glitches, tho I do see that some people feel emotional value and wanna transfer it up.
I mean, it would certainly be better to bring a non-CFW 3DS online, to prevent your CFW 3DS from being banned,
but presently if your CFW (presumably LUMA) is updated, it appears you can bring it online just fine (as long as you don't have piracy and other crazy stuff on it).
I've been using my hacked 3DS for Pokémon Bank, haven't been banned yet.
Well, whatever you choose to do, at your own risk