The9 (NCTY) Risk Factors

The PRC government extensively regulates the internet industry, including foreign ownership of, and the licensing and permit requirements pertaining to, companies in the internet industry. These internet-related laws and regulations are evolving, and their interpretation and enforcement involve significant uncertainties. As a result, in certain circumstances it may be difficult to determine what actions or omissions may be deemed to be in violation of applicable laws and regulations. We only have contractual control over our websites. We do not directly own the websites due to the restriction of foreign investment in businesses providing value-added telecommunication services in the Chinese mainland, including internet information provision services. This may significantly disrupt our business, subject us to sanctions, compromise enforceability of related contractual arrangements, or have other harmful effects on us. The evolving PRC regulatory system for the internet industry may lead to the establishment of new regulatory agencies. For example, in May 2011, the State Council announced the establishment of a new department, the State Internet Information Office (with the involvement of the State Council Information Office, the MIIT, and the Ministry of Public Security). The primary role of this new agency is to facilitate the policy-making and legislative development in this field, to direct and coordinate with the departments in connection with online content administration and to deal with cross-ministry regulatory matters in relation to the internet industry. Shanghai IT, the variable interest entity operating our online gaming business, may be deemed to be providing commercial internet information services and transaction processing services, which would require Shanghai IT to obtain an ICP License. An ICP License is a value-added telecommunications business operating license required for provision of commercial internet information services. As of the date of this annual report, Shanghai IT has applied and obtained an ICP License. Furthermore, as we are providing mobile applications to mobile device users, it is uncertain if Shanghai IT will be required to obtain a separate value-added telecommunications business operating license with respect to the services provided through mobile devices in addition to the ICP License. Although we believe that not obtaining such separate license is in line with the current market practice, there can be no assurance that we will not be required to apply for an operating license for our mobile applications in the future. The Circular on Strengthening the Administration of Foreign Investment in and Operation of Value-added Telecommunications Business, issued by the MIIT in July 2006, prohibits domestic telecommunication service providers from leasing, transferring or selling telecommunications business operating licenses to any foreign investor in any form, or providing any resources, sites or facilities to any foreign investor for its illegal operation of a telecommunications business in the Chinese mainland. According to this circular, either the holder of a value-added telecommunication services operation permit or its shareholders must directly own the domain names and trademarks used by such license holders in their provision of value-added telecommunication services. The circular also requires each license holder to have the necessary facilities, including servers, for its approved business operations and to maintain such facilities in the regions covered by its license. Shanghai IT currently owns the domain names and trademarks in connection with our value-added telecommunications business and has the necessary personnel to operate our websites. If an ICP License holder fails to comply with the requirements and also fails to remedy such non-compliance within a specified period of time, the MIIT or its local counterparts have the discretion to take administrative measures against such license holder, including revoking its ICP License. The interpretation and application of existing laws, regulations and policies in the Chinese mainland and possible new laws, regulations or policies in the Chinese mainland relating to the internet industry have created substantial uncertainties regarding the legality of existing and future foreign investments in, and the businesses and activities of, internet businesses in the Chinese mainland, including our business. We cannot assure you that we have obtained all the permits or licenses required for conducting our business in the Chinese mainland or will be able to maintain our existing licenses or obtain new ones. If the PRC government considers that we were operating without the proper approvals, licenses or permits or promulgates new laws and regulations that require additional approvals or licenses or imposes additional restrictions on the operation of any part of our business, it has the power, among other things, to levy fines, confiscate our income, revoke our business licenses, and require us to discontinue our business or impose restrictions on the affected portion of our business. Any of these actions by the PRC government may have a material adverse effect on our business and results of operations.

We are an exempted company incorporated under the laws of the Cayman Islands. We no longer conduct substantially all of our operations in China and substantially all of our assets are no longer located in China. However, all our senior executive officers reside within China for a significant portion of the time. As a result, it may be difficult for you to effect service of process upon us or our management residing in China. In addition, China does not have treaties providing for reciprocal recognition and enforcement of judgments of courts with the Cayman Islands and many other countries and regions. Therefore, recognition and enforcement in China of judgments of a court in any of these non-Chinese mainland jurisdictions in relation to any matter not subject to a binding arbitration provision may be difficult or impossible.

On March 23, 2016, the Ministry of Finance and the SAT jointly issued the Circular on the Pilot Program for Overall Implementation of the Collection of Value Added Tax Instead of Business Tax, or Circular 36, which took effect on May 1, 2016. Pursuant to Circular 36, all companies operating in construction, real estate, finance, modern service or other sectors which were required to pay business tax are required to pay value added tax, or VAT, in lieu of business tax. As a result of Circular 36, the services provided by general VAT payers will be subject to VAT at the rate of 6%, and the services provided by small-scale VAT payers will be subject to VAT at the rate of 3%. While as general VAT payers may reduce their VAT payable amount by the VAT which they paid in connection with their purchasing activities, or the Input VAT, those companies as small-scale VAT payers may not reduce their VAT payable amount by their Input VAT. As a result, some of our subsidiaries and the variable interest entity may be subject to more unfavorable tax treatment as a result of the tax reform, and our business, financial condition and results of operations could be materially and adversely affected.

As the regulations regarding data privacy and cybersecurity are quickly evolving in China and globally, we may become subject to new laws and regulations applying to the solicitation, collection, processing or use of personal or consumer information that could affect how we store, process and share data with our customers, suppliers and third-party merchants. On August 20, 2021, the Standing Committee of the National People's Congress of China promulgated the Personal Information Protection Law, which integrates the scattered rules with respect to personal information rights and privacy protection and took effect on November 1, 2021. We do not collect user personal information. We do not collect any sensitive personal information or other excessive personal information that is not related to the corresponding services. We update our privacy policies from time to time to meet the latest regulatory requirements of the CAC and other authorities and adopt technical measures to protect data and ensure cybersecurity in a systematic way. Nonetheless, the Personal Information Protection Law raises the protection requirements for processing personal information, and many specific requirements of the Personal Information Protection Law remain to be clarified by the CAC, other regulatory authorities, and courts in practice. We may be required to make further adjustments to our business practices to comply with the personal information protection laws and regulations. See "Item 4. Information on the Company-B. Business Overview-Regulations." On December 28, 2021, thirteen ministries and commissions, including the National Internet Information Office, the National Development and Reform Commission, the Ministry of Industry and Information Technology, the Ministry of Public Security, the Ministry of National Security, the Ministry of Finance, the Ministry of Commerce, the People's Bank of China, the State Administration for Market Regulation, the State Administration of Radio and Television, the China Securities Regulatory Commission, the State Secret Service, and the State Cryptography Administration, issued the Measures for Cybersecurity Review (2021), which emphasized that operators of "critical information infrastructure" or data processors holding over one million users' personal information shall apply with the Cybersecurity Review Office for a cybersecurity review before any public offering at a foreign stock exchange. The Measures for Cybersecurity Review that took effect on February 15, 2022 provide that the purchase of network products and services by critical information infrastructure operator and the data processing activities carries out online platform operators, which affects or may affect national security, shall be subject to cybersecurity review in accordance with the present Measures. In connection with offering and listing in an overseas market, an online platform operator who possesses the personal information of more than one million users shall declare to the Office of Cybersecurity Review for cybersecurity review. On November 14, 2021, the CAC released the Regulations on the Network Data Security (Draft for Comments), or the Draft Regulations. The Draft Regulations provide that data processors refer to individuals or organizations that autonomously determine the purpose and the manner of processing data. In accordance with the Draft Regulations, data processors shall apply for a cybersecurity review for the following activities: (i) merger, reorganization or division of internet platform operators that have acquired a large number of data resources related to national security, economic development or public interests to the extent that affects or may affect national security; (ii) listing abroad of data processors which process over one million users' personal information; (iii) the listing of data processors in Hong Kong which affects or may affect national security; or (iv) other data processing activities that affect or may affect national security. However, there have been no clarifications from the authorities as of the date of this annual report as to the standards for determining such activities that "affects or may affect national security." See "Item 4. Information on the Company-B. Business Overview-Regulations." As of the date of this annual report, the Draft Regulations were released for public comment only, and their respective provisions and the anticipated adoption or effective date may be subject to change with substantial uncertainty. As of the date of this annual report, we have not been involved in any formal investigations on cybersecurity review made by the CAC on such basis. However, if we are not able to comply with the cybersecurity and network data security requirements in a timely manner, or at all, we may be subject to government enforcement actions and investigations, fines, penalties, suspension of our non-compliant operations, or removal of our app from the application stores, among other sanctions, which could materially and adversely affect our business and results of operations. In addition to the cybersecurity review, the Draft Regulations requires that data processors processing "important data" or listed overseas shall conduct an annual data security assessment by itself or commission a data security service provider to do so, and submit the assessment report of the preceding year to the municipal cybersecurity department by the end of January each year. As of the date of this annual report, (i) we are not a critical information infrastructure operator, (ii) we collect less than one million users' information through our internet platform in China-the amount of registered users are approximately 100,000 as of the filing date of this annual report, and (iii) our business does not affect national security. Thus, our PRC legal counsel does not expect that, as of the date of this annual report, we are required to file an application for the cybersecurity review by CAC. On February 22, 2023, the CAC issued the Measures on the Standard Contract for Outbound Transfer of Personal Information, or the Measures, which took effect on June 1, 2023, and the Standard Contract for Outbound Transfer of Personal Information. The Measures consist of 13 articles, clarifying the scope of application, applicable conditions, requirements for supporting personal information protection impact assessments, record-keeping requirements, and other related matters for the Standard Contract for Outbound Transfer of Personal Information. If a personal information processor provides personal information to overseas parties by entering into standard contracts, it shall meet the following conditions at the same time: (1) it shall not be a operator of critical information infrastructure; (2) the number of individuals whose personal information is processed shall be less than 1 million; (3) the cumulative number of individuals whose personal information has been provided to overseas parties shall be less than 100,000 since January 1 of the previous year; and (4) the cumulative number of individuals whose sensitive personal information has been provided to overseas parties shall be less than 10,000 since January 1 of the previous year. As of the date of this annual report, we had not provided personal information to overseas organizations, and there is no situation of providing personal information to overseas data processors. However, the Measures do not clarify whether the regulations still apply to companies providing personal information of their own directors and senior executives (such as their names, ages, and addresses that need to be disclosed in prospectuses) to overseas intermediaries and regulatory authorities. Based on the foregoing, our PRC legal counsel does not expect that, as of the date of this annual report, the current applicable laws of the Chinese mainland on personal information export would have a material adverse impact on our business. In addition, we may need to comply with increasingly complex and rigorous regulatory standards enacted to protect business and personal data in the U.S., Europe and elsewhere. For example, the European Union adopted the General Data Protection Regulation, which became effective on May 25, 2018. The General Data Protection Regulation imposes additional obligations on companies regarding the handling of personal data and provides certain individual privacy rights to persons whose data is stored. Compliance with existing, proposed and recently enacted laws (including implementation of the privacy and process enhancements called for under the General Data Protection Regulation) and regulations can be costly; any failure to comply with these regulatory standards could subject us to legal and reputational risks. We generally comply with industry standards and are subject to the terms of our own privacy policies. Compliance with any additional laws could be expensive, and may place restrictions on the conduct of our business and the manner in which we interact with our customers. Any failure to comply with applicable regulations could also result in regulatory enforcement actions against us, and misuse of or failure to secure personal information could also result in violation of data privacy laws and regulations, proceedings against us by governmental authorities or other authorities, damage to our reputation and credibility and could have a negative impact on revenues and profits. Significant capital and other resources may be required to protect against information security breaches or to alleviate problems caused by such breaches or to comply with our privacy policies or privacy-related legal obligations. The resources required may increase over time as the methods used by hackers and others engaged in online criminal activities are increasingly sophisticated and constantly evolving. Any failure or failure we perceived in preventing information security breaches or to comply with privacy policies or privacy-related legal obligations, or any compromise of security that results in the unauthorized release or transfer of personally identifiable information or other customer data, could cause our customers to lose trust in us and could expose us to legal claims. Any perception by the public that online transactions or the privacy of user information are becoming increasingly unsafe or vulnerable to attacks could inhibit the growth of our business.

From time to time, we may implement new lines of business or offer new products and services within our existing lines of business. For example, in March 2019, we entered into a joint venture agreement with F&F relating to the design and development of electric vehicles. However, the electric vehicles business did not develop as we anticipated. We also operated an NFT business between 2021 and 2023 which we subsequently sold off. Currently, we are developing our cryptocurrency mining business, having begun cryptocurrency mining activities in February 2021. Since the beginning of 2024, we have been gradually stepping into the AI industry, by entering into a few strategic alliances. We may enter into new lines of business in the future. As a new entrant into new lines of business, we face significant challenges, uncertainties and risks, including, among other things, with respect to our ability to: - build a well-recognized and respected brand;- establish and expand our customer base;- improve and maintain our operational efficiency for new lines of business;- maintain a reliable, secure, high-performance and scalable technology infrastructure for our new lines of business;- anticipate and adapt to changing market conditions, including technological developments and changes in competitive landscape;- navigate an evolving and complex regulatory environment, such as licensing and compliance requirements; and - manage the resources and attention of management between our current core business and new lines of business. Moreover, there can be no assurance that the introduction and development of new lines of business or new products and services would not encounter significant difficulties or delay or would achieve the profitability as we expect. Failure to successfully manage these risks in the development and implementation of new lines of business or new products or services could have a material adverse effect on our business, results of operations and prospects. For example, with respect to our plan to develop our cryptocurrency mining business, we may not be able to acquire cryptocurrency mining machines at a reasonable cost, or at all. Due to our limited experience with cryptocurrency and its mining activities, we also face challenges and uncertainties relating to the possibility of success of our new business. We cannot assure you that our efforts in entry into new business sectors, such as our development of cryptocurrency mining business, will succeed. There can be no assurance that such operations will succeed or revert satisfactory results and our business, financial condition, results of operations and prospects may be materially and adversely affected. As we enter into new business sectors, we are also subject to competition from such industry. For example, the cryptocurrency industry is highly competitive despite its relatively short history. There can be no assurance that we are able to compete effectively with respect to our new businesses. If we fail to establish our strengths or maintain our competitiveness in those industries, our business prospects, results of operations and financial condition may be materially and adversely affected.

We may from time to time distribute rights to our shareholders, including rights to acquire our securities. However, we cannot make rights available to you in the United States unless we register the rights and the securities to which the rights relate under the Securities Act of 1933, as amended, or the Securities Act, or an exemption from the registration requirements is available. Also, under the deposit agreement, the depositary will not make rights available to you unless the distribution to ADS holders of both the rights and any related securities are either registered under the Securities Act, or exempt from registration under the Securities Act. We are under no obligation to file a registration statement with respect to any such rights or securities or to endeavor to cause such a registration statement to be declared effective. Moreover, we may not be able to establish an exemption from registration under the Securities Act. The depositary may, but is not required to, sell such undistributed rights to third parties in this situation. Accordingly, you may be unable to participate in our rights offerings and may experience dilution in your holdings.

We may transfer our digital asset from our wallet to digital asset exchanges prior to selling them. Digital assets not held in our wallet are subject to the risks encountered by digital asset exchanges including a dDoS Attack or other malicious hacking, a sale of the digital asset exchange, loss of the digital assets by the digital asset exchange and other risks similar to those described herein. While we may have a custodian agreement with various providers that hold our digital assets, these digital asset custodians provide only limited insurance over all crypto assets under their custody, and may lack the resources to protect against hacking and theft. If this were to occur, we may be materially and adversely affected. We hold mined Bitcoin as current assets. We may occasionally sell portion of mined Bitcoin to cover our operational costs. We may sell Bitcoin through various exchanges, including Binance. We received 20 previously pledged Bitcoins from Binance on April 12, 2024. As of the date of this annual report, we had 18 Bitcoins pledged to Binance, and therefore, they are temporarily held on NBTC Limited's account on Binance exchange. As for the Filecoin, we keep them in the hot wallet and use our holdings to participate in direct staking. We do not have immediate plans to sell Filecoin. In addition, as of the date of this annual report, we hold approximately 22 Ethereum on Binance exchange account for future sales.

Any failure to maintain satisfactory performances, reliability, security and availability of our network infrastructure may cause significant harm to our reputation and our ability to attract and maintain users. The system hardware for our operations is located in several cities in China. We maintain our backup system hardware and operate our back-end infrastructure in Shanghai. Server interruptions, breakdowns or system failures in the cities where we maintain our servers and system hardware, including failures that may be attributable to sustained power shutdowns, or other events within or outside our control that could result in a sustained shutdown of all or a material portion of our services, could adversely impact our ability to service our users. Our network systems are also vulnerable to damage from computer viruses, fire, flood, earthquake, power loss, telecommunications failures, computer hacking and similar events. We maintain property insurance policies covering our servers, but do not have business interruption insurance.

Our business and prospect depend heavily upon the continued services of our senior executives. We rely on their expertise in business operations, technology support and sales and marketing and on their relationships with our shareholders and distributors. We do not maintain key-man life insurance for any of our key executives. If one or more of our key executives are unable or unwilling to continue in their present positions, we may not be able to replace them easily or at all. As a result, our business may be severely disrupted, our financial condition and results of operations may be materially and adversely affected, and we may incur additional expense to recruit and train personnel. Each of our executive officers has entered into an employment agreement with us, which contains confidentiality and non-competition provisions. If any disputes arise between our executive officers and us, we cannot assure you the extent to which any of these agreements could be enforced in China, where these executive officers reside and hold most of their assets, in light of uncertainties with the PRC legal system. See "Item 3. Key Information-D. Risk Factors-Risks Related to Doing Business in China-Uncertainties with respect to the PRC legal system could adversely affect us."

Because the PRC government restricts our ownership of ICP, internet culture operation and internet publishing businesses in the Chinese mainland, we primarily depend on Shanghai IT, in which we have no ownership interest, to operate our online game business and other ICP related businesses, and hold and maintain the requisite licenses. We have relied and expect to continue to rely on contractual arrangements to conduct business operations through contractual arrangements with Shanghai IT. Such contractual arrangements may not be as effective as direct ownership. From the legal perspective, if Shanghai IT fails to perform its obligations under the contractual arrangements, we may have to incur substantial costs and spend other resources to enforce such arrangements, and rely on legal remedies under laws of the Chinese mainland, including seeking specific performance or injunctive relief and claiming damages. For example, if the shareholders of Shanghai IT were to refuse to transfer their equity interests in Shanghai IT to us or our designee when we exercise the call option pursuant to the Call Option Agreement, or if such shareholders otherwise act in bad faith toward us, we may have to take legal action to compel it to fulfill their contractual obligations, which could be time consuming and costly. Despite the lack of legal majority ownership, we are able to direct the activities of and derive economic benefits from the consolidated variable interest entity and therefore our Cayman Island holding company is considered the primary beneficiary of the consolidated variable interest entity for accounting purposes and consolidates the variable interest entity and its subsidiaries as required by Accounting Standards Codification topic 810, Consolidation. Accordingly, we treat the consolidated variable interest entity as a consolidated entity under U.S. GAAP and we consolidate the financial results of the consolidated variable interest entity in our consolidated financial statements in accordance with U.S. GAAP. Neither The9 Limited nor its investors have an equity ownership in, direct foreign investment in, or control through such ownership or investment of, the consolidated variable interest entity, and the contractual arrangements are not equivalent to an equity ownership in the business of the consolidated variable interest entity. These contractual arrangements are governed by laws of the Chinese mainland and provide for the resolution of disputes through arbitration in the Chinese mainland. The legal environment in the Chinese mainland is not as developed as in some other jurisdictions, such as the United States. As a result, uncertainties in the PRC legal system could limit our ability to enforce these contractual arrangements. We have historically derived significant revenues from Shanghai IT. For the year ended December 31, 2021, 2022 and 2023, Shanghai IT contributed 0.9%, 0.6% and 0.1%, respectively, of our total revenues. In the event we are unable to enforce the contractual arrangements, we may not be able to have the power to direct the activities that most significantly affect the economic performance of Shanghai IT, and our ability to conduct our business may be negatively affected, and we may not be able to consolidate the financial results of Shanghai IT into our consolidated financial statements in accordance with U.S. GAAP. We believe that our option to purchase all or part of the equity interests in Shanghai IT, when and to the extent permitted by laws of the Chinese mainland, or request any existing shareholder of Shanghai IT to transfer all or part of the equity interest in Shanghai IT to another person or entity of the Chinese mainland we designate at any time in our discretion, and the rights under the Shareholder Voting Proxy Agreement that the shareholders of Shanghai IT have granted to us, effectively enable us to have the ability to cause the related contractual arrangements to be renewed when needed. However, if we are not able to effectively enforce these agreements or otherwise renew the agreements when they expire, our ability to receive the economic benefits of Shanghai IT may be adversely affected.

The insurance industry in China is still at an early stage of development. Insurance companies in China offer limited business insurance products. Additionally, we cease to possess significant operating assets located in China. As a result, we do not have any business liability or disruption insurance coverage for our operations in China. Any business disruption, litigation or natural disaster might result in our incurring substantial costs and the diversion of our resources. Our mining machines are located in the U.S., Canada, Kyrgyzstan and Kazakhstan. We are in the process to obtain insurance on our mining machines. We currently rely on the data center operators to insure their data centers, including, among other things, our mining machines. Operators of data centers are holders of their own insurance policies. We cannot guarantee that the data center operators have fulfilled their obligations to comply with the insurance coverage requirements. As of the date of this annual report, we do not have insurance coverage for our crypto assets or miners.

As an alternative to fiat currencies that are backed by central governments, digital assets such as Bitcoin, which are relatively new, are subject to supply and demand forces based upon the desirability of an alternative, decentralized means of buying and selling goods and services, and it is unclear how such supply and demand will be impacted by geopolitical conflicts. Nevertheless, political or economic crises may motivate large-scale acquisitions or sales of digital assets either globally or locally. Large-scale sales of digital assets would result in a reduction in their value and could adversely affect an investment in us. Further, deterioration in economic condition and escalation of geopolitical conflicts may create increased uncertainty and price changes. Inflation has caused the price of materials to increase leading to increased expenses to our business. Global crises and economic downturns may also have the effect of discouraging investment in Bitcoin as investors shift their investments to less volatile assets. Such shift could have a materially adverse effect on our business, operations and the value of the Bitcoin we mine or the institutional data center clients we host.

We operate and conduct business in different countries and regions. International transactions are subject to inherent risks and challenges that could adversely affect us, including: - the need to develop new supplier and manufacturer relationships;- the need to comply with additional U.S. and foreign laws and regulations;- changes in international laws, regulatory requirements, taxes and tariffs;- our limited experience with different local cultures and standards;- geopolitical conflicts, such as war and terrorist attacks; and - the additional resources and management attention required for such expansion. Our international business could expose us to penalties for non-compliance with laws applicable to international business and trade, which could have a material adverse effect on our business. Compliance with such laws and regulations will result in additional costs and may necessitate changes to our business practices, which may adversely affect our business. To the extent that we make purchases or sales denominated in foreign currencies, we would have foreign currency risks, which could have a material adverse effect on our financial results, business and prospects.

Proof of stake is an alternative method in validating cryptocurrency transactions. Should the algorithm shift from a proof of work validation method to a proof of stake method, mining would likely require less energy, which may render any company that maintains advantages in the current climate (for example, from lower priced electricity, processing, real estate, or hosting) less competitive. We, as a result of our efforts to optimize and improve the efficiency of our cryptocurrency mining operations, may be exposed to the risk in the future of losing the benefit of our capital investments and the competitive advantage we hope to gain from this as a result, and may be negatively impacted if a switch to proof of stake validation were to occur. Such events could have a material adverse effect on our ability to pursue our new strategy at all, which could have a material adverse effect on our business, prospects or operations and potentially the value of any Bitcoin or other cryptocurrencies we mine or otherwise acquire or hold for our own account.

Our subsidiary, NBTC US Ltd, has entered into a hosting agreement with a third-party data center by which the third party agreed to host our mining machines in its data center located at Pecos County, Texas. Under a 12-month hosting agreement, the third party provides electricity, hosting service, and other services to Company mining operations. We may occasionally sell a portion of its Bitcoin mined in Texas, including through third-party exchanges for its own account. Since January 2023, we no longer mints or offers NFTs, or provides any services related to previously minted NFTs. NFTs we previously issued may continue to be available on third-party trading sites that we do not operate or control. We may receive royalties from secondary sales of previously-issued NFTs and the amount is expected to be minimal. These secondary sales royalties only amounted to RMB26 thousand (US$3.7 thousand) in 2023. We continues to evaluate its U.S. compliance obligations in light of its evolving business lines.