Company: XHG
Filing Date: 2025-01-22
Form Type: 20-F
Source: 0001213900-25-005499
Chunk: 5

Company: XChange TEC.INC
Filing Date: 2025-01-22
Form: 20-F
Item: Item 3
Chunk 5
---
, as advised by our PRC legal counsel, Beijing Kingdom Law Firm, we and the Current VIEs
have received all requisite permits, approvals and certificates from the PRC government authorities to conduct our business operations
in China. To our knowledge, no permission or approval has been denied or revoked. However, given the uncertainties of interpretation and
implementation of relevant laws and regulations and the enforcement practice by government authorities, we cannot be certain that relevant
policies in this regard will not change in the future, which may require us or our subsidiaries or Current VIEs to obtain additional licenses,
permits, filings or approvals for conducting our business in the PRC. If we or our subsidiaries or Current VIEs do not receive or maintain
required permissions or approvals, or inadvertently conclude that such permissions or approvals are not required, we may be subject to
governmental investigations or enforcement actions, fines, penalties, suspension of operations, or be prohibited from engaging in relevant
business or conducting securities offering, and these risks could result in a material adverse change in our operations, significantly
limit or completely hinder our ability to offer or continue to offer securities to investors, or cause such securities to significantly
decline in value or become worthless.

On December 28, 2021, CAC released the revised
Cybersecurity Review Measures (the “ Revised CAC Measures”) and became effective on February 15, 2022, which iterates that
any “online platform operators” controlling personal information of more than one million users which seeks to list on a foreign
stock exchange should also be subject to cybersecurity review. The Measures for Cybersecurity Review (2021 version) further elaborates
the factors to be considered when assessing the national security risks of the relevant activities, including, among others, (i) the risk
of core data, important data or a large amount of personal information being stolen, leaked, destroyed, and illegally used or exited the
country; and (ii) the risk of critical information infrastructure, core data, important data or a large amount of personal information
being affected, controlled, or maliciously used by foreign governments after listing abroad. Our PRC counsel, Beijing Kingdom Law Firm,
is of the view that because: (i) we are already listed on the Nasdaq Capital Market and do not “seek to list on any other foreign
stock exchange”; (ii) we and the Current VIEs do not hold personal information on more than one million users; and (iii) data processed