Company: XHG
Filing Date: 2025-10-29
Form Type: F-3/A
Source: 0001213900-25-103499
Chunk: 49

Company: XChange TEC.INC
Filing Date: 2025-10-29
Form: F-3/A
Chunk 49
---
 value
of our securities, or could significantly limit or completely hinder our ability to offer securities to investors in the future and cause
the value of such securities to significantly decline or become worthless.

The PRC government may exert, at any time, substantial
intervention and influence over the manner of our operations. Recently, the PRC government initiated a series of regulatory actions and
statements to regulate business operations in China with little advance notice, including cracking down on illegal activities in the securities
market, enhancing supervision over China-based companies listed overseas, adopting new measures to extend the scope of cybersecurity reviews
and new laws and regulations related to data security, and expanding the efforts in anti-monopoly enforcement.

The regulatory framework for the collection, use,
safeguarding, sharing, transfer and other processing of personal information and important data worldwide is rapidly evolving in PRC and
is likely to remain uncertain for the foreseeable future. Regulatory authorities in China have implemented and are considering a number
of legislative and regulatory proposals concerning data protection. For example, the PRC Cybersecurity Law, which became effective in
June 2017, established China’s first national-level data protection for “network operators,” which may include all organizations
in China that connect to or provide services over the internet or other information network. The PRC Data Security Law, which was promulgated
by the Standing Committee of PRC National People’s Congress, or the SCNPC, on June 10, 2021 and became effective on September 1,
2021, outlines the main system framework of data security protection.

<div align='center'>23</div>

In December 2021, the Cyberspace Administration
of China (the “CAC”) promulgated the amended Measures of Cybersecurity Review which require cyberspace operators with personal
information of more than one million users to file for cybersecurity review with the Cybersecurity Review Office (“CRO”),
in the event such operators plan for an overseas listing. The amended Measures of Cybersecurity Review provide that, among others, an
application for cybersecurity review must be made by an issuer that is a “critical information infrastructure operator” or
a “data processing operator” as defined therein before such issuer’s securities become listed in a foreign country,
if the issuer possesses personal information of more than one million users, and that the relevant governmental authorities in the PRC
may initiate cybersecurity review if such governmental authorities determine an operator’s cyber products or services, data processing
or potential listing in a foreign country affect or may