Company: WCT
Filing Date: 2025-12-02
Form Type: F-1
Source: 0001213900-25-116978
Chunk: 45

Company: Wellchange Holdings Co Ltd
Filing Date: 2025-12-02
Form: F-1
Chunk 45
---
 persons, personal information processors
shall obtain the approval of the corresponding natural persons and advise them of the overseas receiver’s name, contact information,
processing purpose and methods, classification of personal information and information reception procedures, etc.

On December 28, 2021, the CAC, jointly with
the relevant authorities, formally published Measures for Cybersecurity Review (2021) which took effect on February 15, 2022
and replaced the former Measures for Cybersecurity Review (2020) issued on July 10, 2021. Measures for Cybersecurity Review
(2021) stipulates that in addition to “operator of critical information infrastructure,” any “data processor”
carrying out data processing activities that affect or may affect national security should also be subject to cybersecurity review, and
further elaborated the factors to be considered when assessing the national security risks of the relevant activities, including, among
others, (i) the risk of core data, important data or a large amount of personal information being stolen, leaked, destroyed, and
illegally used or transferred outside the country; and (ii) the risk of critical information infrastructure, core data, important
data or a large amount of personal information being affected, controlled, or maliciously used by foreign governments after listing abroad.
CAC has said that under the proposed rules, companies holding data on more than one million users must apply for cybersecurity approval
when seeking listings in other nations because of the risk that such data and personal information could be “affected, controlled,
and maliciously exploited by foreign governments.” The cybersecurity review will also investigate the potential national security
risks from overseas IPOs. Due to the lack of further interpretations, the exact scope of what constitutes an “operator of critical
information infrastructure” remains unclear. Further, the PRC government authorities may have wide discretion in the interpretation
and enforcement of these laws. In addition, the Measures for Cybersecurity Review (2021) stipulates that any online platform operators
holding more than one million users/users’ individual information shall be subject to cybersecurity review before listing abroad.
As of the date of this prospectus, we have not received any notice from any authorities identifying us as an “operator of critical
information infrastructure” or “data processor” or requiring us to undertake a cybersecurity review by the CAC. Further,
as of the date of this prospectus, we have not been subject to any penalties, fines, suspensions, or investigations from any competent
authorities for violation of the regulations or