Company: MEGL
Filing Date: 2025-07-11
Form Type: F-1/A
Source: 0001641172-25-018709
Chunk: 25

Company: Magic Empire Global Ltd
Filing Date: 2025-07-11
Form: F-1/A
Chunk 25
---
, if an “online platform operator” that is in possession of personal data of more than one million users intends to list in a foreign country, it must apply for a cybersecurity review. Based on a set of Q&As published on the official website of the State Cipher Code Administration in connection with the issuance of the Revised Review Measures, an official of the said administration indicated that an online platform operator should apply for a cybersecurity review prior to the submission of its listing application with non-PRC securities regulators. Moreover, the CAC released the draft of the Regulations on Network Data Security Management in November 2021 for public consultation, which among other things, stipulates that a data processor listed overseas must conduct an annual data security review by itself or by engaging a data security service provider and submit the annual data security review report for a given year to the municipal cybersecurity department before January 31 of the following year. Given the recency of the issuance of the Revised Review Measures and their pending effectiveness, there is a general lack of guidance and substantial uncertainties exist with respect to their interpretation and implementation.

Given the nature of our subsidiaries’ business, we believe this risk is not significant. Our subsidiaries do not have any customers in Mainland China and is neither a CIIOs nor a DPO as defined in the Revised Review Measures. We do not currently expect the Revised Review Measures to have an impact on our subsidiaries’ business, operations or this offering as we do not believe that our subsidiaries are deemed to be operators of critical information infrastructure or data processors controlling personal information of no less than one million users, that are required to file for cybersecurity review before listing in the U.S. since (i) our subsidiaries are incorporated and operating in Hong Kong and the Revised Review Measures remain unclear whether they shall be applicable to a Hong Kong company; (ii) our subsidiaries operate without any subsidiary nor VIE structure in Mainland China; (iii) as of the date of this prospectus, our subsidiaries have collected less than 100 personal information of PRC individual clients; and (iv) as of the date of this prospectus, our subsidiaries have not been informed by any PRC governmental authority of any requirement that they file for a cybersecurity review. Therefore, we believe that our Operating Subsidiaries are not covered by the permission and requirements from the CSRC or the CAC.

Nevertheless, since these statements and regulatory actions are new, it is highly uncertain how soon the legislative or administrative regulation making bodies will respond and what existing or new laws or regulations or detailed implementations