Company: XHG
Filing Date: 2025-10-29
Form Type: F-3/A
Source: 0001213900-25-103499
Chunk: 54

Company: XChange TEC.INC
Filing Date: 2025-10-29
Form: F-3/A
Chunk 54
---
 and improve rules on confidentiality and archives administration. Where the domestic entities provide with or publicly
disclose documents, materials or other items related to the state secrets and government work secrets to the relevant securities companies,
securities service institutions, overseas regulatory authorities, or other entities or individuals, the companies shall apply for approval
of competent departments with the authority of examination and approval in accordance with law and report the matter to the secrecy administrative
departments at the same level for record filing. Where there is unclear or controversial whether or not the concerned materials are related
to state secrets, the materials shall be reported to the relevant secrecy administrative departments for determination. However, the Draft
Provisions on Confidentiality and Archives Administration have not yet been settled or become effective, and there remain uncertainties
regarding the further interpretation and implementation of the Draft Provisions on Confidentiality and Archives Administration.

<div align='center'>25</div>

Further, the CAC issued the Measures for the Security
Assessment of Outbound Data Transfer (the “Measures”) on July 7, 2022, which will take effect on September 1, 2022. The Measures
shall apply to the security assessment of data processors’ provision of important data and personal information collected and generated
in their operations within the territory of the PRC to overseas recipients. The Measures require relevant data processors to submit a
data security assessment to the CAC for review prior to the outbound data transfer activities in order to prevent illegal data transfer
activities.

As there are still uncertainties regarding these
new laws and regulations as well as the amendment, interpretation and implementation of the existing laws and regulations related to cybersecurity
and data protection, We cannot assure you that we will be able to comply with these laws and regulations in all respects. The regulatory
authorities may deem our activities or services non-compliant and therefore require us to suspend or terminate its business. We may also
be subject to fines, legal or administrative sanctions and other adverse consequences, and may not be able to become in compliance with
relevant laws and regulations in a timely manner, or at all. These may materially and adversely affect its business, financial condition,
results of operations and reputation.

Since these statements and regulatory actions
are new, it is highly uncertain how soon legislative or administrative regulation making bodies will respond and what existing or new
laws or regulations or detailed implementations and interpretations will be modified or promulgated, if any, and the potential impact
such modified or new laws and regulations will have on our daily business operation