Company: XTKG
Filing Date: 2025-04-25
Form Type: 20-F
Source: 0001213900-25-035626
Chunk: 59

Company: X3 Holdings Co., Ltd.
Filing Date: 2025-04-25
Form: 20-F
Item: Item 3
Chunk 59
---

laws and regulations in force at the time. Currently, we are not required to file for a cybersecurity review by the CAC for our past issuance
of securities to foreign investors and maintaining our listing status on the Nasdaq, since a company already listed in a foreign stock
exchange before promulgation of the latest Cybersecurity Review Measures is not required to file for a cybersecurity review by the CAC
to maintain its listing status on the foreign stock exchange on which its securities have been listed. As of the date of this Annual Report,
we have not been involved in any investigations or become subject to a cybersecurity review initiated by the CAC, and we have not received
any inquiry, notice, warning, sanctions in such respect or any regulatory objections to our listing status from the CAC.

The Regulations on Security
Protection of Critical Information Infrastructure that took effect on September 1, 2021 defines critical information infrastructure and
its operators, who must adhere to specific security requirements. As this regulation is newly issued, the governmental authorities, including
the administration departments for each critical industry and sector, may further formulate detailed rules or explanations with respect
to the interpretation and implementation of this regulation.

The PRC Personal Information
Protection Law, effective since November 2021, sets stringent rules for processing personal and sensitive information, which significantly
affects our data handling practices. Some information we collect, such as location and mobile numbers, may be deemed to be sensitive personal
information under the Personal Information Protection Law. As the interpretation and implementation of the Personal Information Protection
Law shall be determined in accordance with the laws and regulations in force at the time, we cannot assure you that we will be able to
comply with the Personal Information Protection Law in all respects, or that regulatory authorities will not order us to rectify or terminate
our current practice of collecting and processing sensitive personal information. We may also become subject to fines and other penalties
under the Personal Information Protection Law, which may have material adverse effect on our business, operations and financial condition.

On November 14, 2021, the
CAC published a discussion draft of Regulations on the Administration of Cyber Data Security for public comments. These measures, if and
when formalized, could impose additional cybersecurity review requirements for data processors, especially those involving national security
concerns. Based on the facts that, (i) the Revised Cybersecurity Review Measures were newly adopted and the discussion draft of Regulations
on the Administration of Cyber Data Security have not been formally adopted, and the