Company: XTKG
Filing Date: 2025-04-25
Form Type: 20-F
Source: 0001213900-25-035626
Chunk: 53

Company: X3 Holdings Co., Ltd.
Filing Date: 2025-04-25
Form: 20-F
Item: Item 3
Chunk 53
---
 According to the Revised Review Measures, if an “online platform operator”
that is in possession of personal data of more than one million users intends to list in a foreign country, it must apply for a cybersecurity
review. Based on a set of Q& A published on the official website of the State Cipher Code Administration in connection with the issuance
of the Revised Review Measures, an official of the said administration indicated that an online platform operator should apply for a cybersecurity
review prior to the submission of its listing application with non-PRC securities regulators. Given the recency of the issuance of the
Revised Review Measures, there is a general lack of guidance and substantial uncertainties exist with respect to their interpretation
and implementation. For example, it is unclear whether the requirement of cybersecurity review applies to follow-on offerings by an “online
platform operator” that is in possession of personal data of more than one million users where the offshore holding company of such
operator that is already listed overseas. Furthermore, the CAC released the draft of the Regulations on Network Data Security Management
(the “ Draft Regulations”) in November 2021 for public consultation, which among other things, stipulates that a data processor
listed overseas must conduct an annual data security review by itself or by engaging a data security service provider and submit the annual
data security review report for a given year to the municipal cybersecurity department before January 31 of the following year.

On July 7, 2022, CAC promulgated
Measures for the Security Assessment of Outbound Data Transfers, (the “ Data Cross Border Measures”), which became effective
on September 1, 2022 and provide that a data processor is required to apply for security assessment for cross-border data transfer in
any of the following circumstances: (i) where a data processor provides critical data to offshore entities and individuals; (ii) where
a CIIO or a data processor which processes personal information of more than one million individuals provides personal information to
offshore entities and individuals; (iii) where a data processor has provided personal information in the aggregate of more than 100,000
individuals or sensitive personal information of more than 10,000 individuals in total to offshore entities and individuals since January
1 of the previous year; or (iv) other circumstances prescribed by the CAC for which declaration for security assessment for cross-board
transfer of data is required. Furthermore, on August 31, 2022, the CAC promulgated the Guidelines for filing the Out