In some jurisdictions, including mainland China where we do not have material operations, the cybersecurity, data privacy, data protection, or other data-related laws and regulations are relatively new and evolving, and their interpretation and application may be uncertain. For example, on December 28, 2021, the CAC, the National Development and Reform Commission, or the NDRC, the Ministry of Industry and Information Technology, or the MIIT, and several other PRC government authorities jointly issued the Cybersecurity Review Measures, which took effect on February 15, 2022 and further restates and expands the applicable scope of the cybersecurity review in effect. Pursuant to the Cybersecurity Review Measures, critical information infrastructure operators that procure internet products and services and network platform operators engaging in data processing activities must be subject to the cybersecurity review if their activities affect or may affect national security. The Cybersecurity Review Measures further stipulates that network platform operators holding personal information of over one million users must apply to the Cybersecurity Review Office for a cybersecurity review before a foreign listing. Given that the Cybersecurity Review Measures was recently promulgated, there are substantial uncertainties as to its interpretation, application, and enforcement. On July 30, 2021, the state council promulgated the Regulations on Protection of Critical Information Infrastructure, which became effective on September 1, 2021. Pursuant to the Regulations on Protection of Critical Information Infrastructure, critical information infrastructure shall mean any important network facilities or information systems of the important industry or field such as public communication and information service, energy, transportation, water conservation, finance, public services,
e-government
affairs and national defense science, which may endanger national security, people’s livelihood and public interest in case of damage, function loss or data leakage. In addition, relevant administration departments of each critical industry and sector, or Protection Departments, shall be responsible to formulate eligibility criteria and determine the critical information infrastructure operator in the respective industry or sector. The operators shall be informed about the final determination as to whether they are categorized as critical information infrastructure operators. As of the date of this annual report, no detailed rules or implementation have been issued by any authority and the exact scope of “critical information infrastructure operators” under the current regulatory regime remains unclear, and the PRC government authorities may have wide discretion in the interpretation and enforcement of these laws. On November 14, 2021, the CAC released the Regulations on the Network Data Security (Draft for Comments), or the Draft Data Security Regulations. The Draft Data Security Regulations provide that data processors refer to individuals or organizations that autonomously determine the purpose and the manner of processing data. In accordance with the Draft Data Security Regulations, data processors shall apply for a cybersecurity review for the following activities: (i) merger, reorganization or division of internet platform operators that have acquired a large number of data resources related to national security, economic development or public interests to the extent that affects or may affect national security; (ii) listing abroad of data processors which process over one million users’ personal information; (iii) the listing of data processors in Hong Kong which affects or may affect national security; or (iv) other data processing activities that affect or may affect national security. However, there have been no clarifications from the authorities as of the date of this annual report as to the standards for determining such activities that “affects or may affect national security. There is also no timetable as to when the Draft Data Security Regulations will be enacted. As such, it remains unclear whether the final version adopted in the future will have any further material changes, and it is uncertain how the draft regulations will be enacted, interpreted, or implemented and how they will affect us. It remains uncertain whether future regulatory changes in China would impose additional restrictions on companies like us. We cannot predict the impact of these future regulatory changes, if any, at this stage, and we will closely monitor and assess any development in the rule-making process. If future regulatory updates mandate clearance of cybersecurity review and other specific actions to be completed by companies operating in Hong Kong like us, we face uncertainties as to whether such clearance can be timely obtained, or at all. As of the date of this annual report, we do not have any material operation in mainland China. We have not collected, stored, or managed any personal information in mainland China. In addition, we plan to emphasize Southeast Asia as our core future area of growth. As such, we currently do not expect the Cybersecurity Review Measures, the Draft Data Security Regulations or other recent regulations will have an impact on our business or results of operations, and we believe that we are compliant with the regulations and policies that have been issued by the CAC to date. However, we still face uncertainties regarding the interpretation and implementation of these laws and regulations in the future. Cybersecurity review could result in disruption in our operations, negative publicity with respect to our company, and diversion of our