Company: SOS
Filing Date: 2025-06-25
Form Type: F-3/A
Source: 0001213900-25-057886
Chunk: 51

Company: SOS Ltd
Filing Date: 2025-06-25
Form: F-3/A
Chunk 51
---
 data security assessment
by itself or commission a data security service provider to do so and submit the assessment report for the preceding year to the municipal
cybersecurity department by the end of January each year. As of the date of this prospectus, the Draft Measures for Internet Data Security
has not been formally adopted. However, if the Draft Measures for Internet Data Security were to be enacted in the current form, we, as
an overseas listed company, will be required to conduct an annual data security review and comply with the relevant reporting obligations.
Furthermore, according to the Draft Measures for Internet Data Security, data processors shall, in accordance with relevant state provisions,
apply for cyber security review when carrying out the following activities: (1) the merger, reorganization or separation of internet platform
operators that have acquired a large number of data resources related to national security, economic development or public interests,
which affects or may affect national security, (2) data processors that handle the personal information of more than one million people
intends to be listed abroad, (3) the data processor intends to be listed in Hong Kong, which affects or may affect national security,
and (4) other data processing activities that affect or may affect national security. It remains uncertain whether the requirement of
cybersecurity review applies to follow-on offerings by an overseas-listed online platform operator that possesses personal data of more
than one million users. We completed our initial public offering on November 23, 2018, and the ADSs have been listed on Nasdaq Capital
Market since November 2018. Considering the substantial uncertainties existing with respect to the enactment timetable, final content,
interpretation and implementation of the Draft Measures for Internet Data Security, in particular with respect to the explanation or interpretation
for “affects or may affect national security,” there remain uncertainties as to whether our data processing activities may
be deemed to affect national security, thus subjecting us to a cybersecurity review. As of the date of this prospectus, we have not received
any formal notice from any cybersecurity regulator that we shall be subject to a cybersecurity review.

<div align='center'>26</div>

On December 28, 2021, the CAC and 12 other
government authorities published the Measures for Cybersecurity Review, which took effect on February 15, 2022. The Measures for Cybersecurity
Review provides that certain operators of critical information infrastructure purchasing internet products and services or network platform
operators carrying out data processing activities, which affect or may affect