Roan Holdings Group (RAHGF) Risk Analysis

The Health Insurance Portability and Accountability Act of 1996, as amended, and the regulations that have been issued under it, or collectively HIPAA, and similar laws outside the United States, contain substantial restrictions and requirements with respect to the use and disclosure of individuals' protected health information. The HIPAA privacy rules prohibit "covered entities," such as healthcare providers and health plans, from using or disclosing an individual's protected health information, unless the use or disclosure is authorized by the individual or is specifically required or permitted under the privacy rules. Under the HIPAA security rules, covered entities must establish administrative, physical and technical safeguards to protect the confidentiality, integrity and availability of electronic protected health information maintained or transmitted by them or by others on their behalf. While we do not believe that we will be a covered entity under HIPAA, we believe many of our customers will be covered entities subject to HIPAA. Such customers may require us to enter into business associate agreements, which will obligate us to safeguard certain health information we obtain in the course of our relationship with them, restrict the manner in which we use and disclose such information and impose liability on us for failure to meet our contractual obligations. In addition, under The Health Information Technology for Economic and Clinical Health Act of 2009, or HITECH, which was signed into law as part of the U.S. stimulus package in February 2009, certain of HIPAA's privacy and security requirements are now also directly applicable to "business associates" of covered entities and subject them to direct governmental enforcement for failure to comply with these requirements. We may be deemed as a "business associate" of some of our customers. As a result, we may be subject as a "business associate" to civil and criminal penalties for failure to comply with applicable privacy and security rule requirements. Moreover, HITECH created a new requirement obligating "business associates" to report any breach of unsecured, individually identifiable health information to their covered entity customers and imposes penalties for failing to do so. In addition to HIPAA, most U.S. states have enacted patient confidentiality laws that protect against the disclosure of confidential medical information, and many U.S. states have adopted or are considering adopting further legislation in this area, including privacy safeguards, security standards, and data security breach notification requirements. These U.S. state laws, which may be even more stringent than the HIPAA requirements, are not preempted by the federal requirements, and we are therefore required to comply with them to the extent they are applicable to our operations. These and other possible changes to HIPAA or other U.S. federal or state laws or regulations, or comparable laws and regulations in countries where we conduct business, could affect our business and the costs of compliance could be significant. Failure by us to comply with any of the standards regarding patient privacy, identity theft prevention and detection, and data security may subject us to penalties, including civil monetary penalties and in some circumstances, criminal penalties. In addition, such failure may damage our reputation and adversely affect our ability to retain customers and attract new customers. The protection of personal data, particularly patient data, is subject to strict laws and regulations in many countries. The collection and use of personal health data in the European Union (the "EU") is governed by the provisions of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, commonly known as the Data Protection Directive. The Data Protection Directive imposes a number of requirements including an obligation to seek the consent of individuals to whom the personal data relates, the information that must be provided to the individuals, notification of data processing obligations to the competent national data protection authorities of individual EU Member States and the security and confidentiality of the personal data. The Data Protection Directive also imposes strict rules on the transfer of personal data out of the EU to the U.S. Failure to comply with the requirements of the Data Protection Directive and the related national data protection laws of the EU Member States may result in fines and other administrative penalties and harm our business. We may incur extensive costs in ensuring compliance with these laws and regulations, particularly if we are considered to be a data controller within the meaning of the Data Protection Directive. We will be highly dependent on information technology networks and systems, including the Internet, to securely process, transmit and store this critical information. Security breaches of this infrastructure, including physical or electronic break-ins, computer viruses, attacks by hackers and similar breaches, can create system disruptions, shutdowns or unauthorized disclosure or modification of confidential information. The secure processing, storage, maintenance and transmission of this critical information will be vital to our operations and business strategy, and we plan to devote significant resources to protecting such information. Although we will take measures to protect sensitive information from unauthorized access or disclosure, our information technology and infrastructure, and that of our third-party providers, may be vulnerable to attacks by hackers or viruses or breached due to employee error, malfeasance or other disruptions. Any breach or interruption could compromise our networks or those of our third-party providers, and the information stored there could be inaccessible or could be accessed by unauthorized parties, publicly disclosed, lost or stolen. Any such interruption in access, improper access, disclosure or other loss of information could result in legal claims or proceedings, liability under laws that protect the privacy of personal information, such as HIPAA, and regulatory penalties. Unauthorized access, loss or dissemination could also disrupt our operations, including our ability to perform tests, provide test results, bill payers or patients, process claims and appeals, provide customer assistance services, conduct research and development activities, collect, process and prepare company financial information, provide information about our current and future products and other patient and clinician education and outreach efforts through our website, and manage the administrative aspects of our business and damage our reputation, any of which could adversely affect our business. Any such breach could also result in the compromise of our trade secrets and other proprietary information, which could adversely affect our competitive position. In addition, the interpretation and application of consumer, health-related, privacy and data protection laws in the U.S., the EU and elsewhere are often uncertain, contradictory and in flux. It is possible that these laws may be interpreted and applied in a manner that is inconsistent with our practices. If so, this could result in government-imposed fines or orders requiring that we change our practices, which could adversely affect our business. Complying with these various laws could cause us to incur substantial costs or require us to change our business practices and compliance procedures in a manner adverse to our business.

Our business focuses on the Yangtze River Delta region and Pearl River Delta region China. Our future growth opportunities will depend on the growth and stability of the economy in these areas. A downturn in the economy of these areas or the implementation of provincial or local policies unfavorable to MSMEs may cause a decrease in the demand for our loan guaranty services and other services provided to MSMEs and may negatively affect borrowers' ability to repay their loans on a timely basis, both of which could have a negative impact on our profitability and business. Although we are working to develop business in more areas, we need more time to expand our business geographically.

The COVID-19 pandemic has negatively impacted the global economy, disrupted business operations of various industries, and created significant volatility and disruption of financial markets. In compliance with the government mandates, our Hangzhou, Shaoxing, Guangzhou and Urumqi offices closed and our operations temporarily halted in the spring of 2020. During the closure, employees had only limited access to our facilities and delayed our project timeline, which affected our operating results and financial condition. In December 2021, Shangyu District, Shaoxing City, Zhejiang Province, where the subsidiary company Zhejiang Jing Yu Xin Financing Guarantee Co., Ltd. is located, was closed and suspended due to the epidemic, resulting in delays in our services to some customers. Operations resumed after the lockdown was lifted on December 31, 2021. COVID-19, including any variants thereof such as the omicron variant, could continue to adversely affect our business and financial results in 2023. For example, resurgences in COVID-19 could cause significant disruptions to our operations, or the business of our customers, our logistics and service providers, or may negatively impact to the pricing of our products. We cannot predict the severity and duration of the impact from such current resurgence. COVID-19, any variants thereof, or any new pandemics could continue to have an adverse effect on our future business and financial performance. If any new outbreak of COVID-19 is not effectively and timely controlled, or if government responses to outbreaks or potential outbreaks are severe or long-lasting, our business operations and financial condition may be materially and adversely affected as a result of the deteriorating market outlook, the slowdown in regional and national economic growth, weakened liquidity and financial condition of our customers or other factors that we cannot foresee. Any of these factors and other factors beyond our control could have a material adverse effect on the overall business environment, cause uncertainties in the regions where we conduct business, and could materially and adversely impact our business, financial condition and results of operations.

Our subsidiaries have co-operation agreements with technology enterprises that have patent or other independent intellectual property rights which have been properly registered with regulatory agencies such as the State Intellectual Property Office and Trademark Office of China's State Administration for Industry and Commerce (SAIC). Our service and reputation significantly rely on the third-party suppliers mentioned above. If (i) the PRC authorities invalidate these agreements for violation of PRC laws, rules, and regulations, (ii) the agreements are valid but cannot be performed, or (iii) any parties fail to perform their obligations under these agreements, our business operations in China would be materially and adversely affected, and the value of your stock may substantially decrease. If a third party fails to perform or defective perform its contractual obligations, it will lead to a failure to provide products or services according to meet our consumers' requirements, we may have to take legal action to compel them to fulfill their contractual obligations. We depend on third parties to a large extent and are unable to feasibly monitor their behavior to reasonably avoid contractual risks. Further, because intellectual property rights are owned by a third party, it is difficult for us to restrain third parties from infringing on intellectual property or disclosing trade secrets. This could harm our reputation and business position.

On February 15, 2022, the amended Cybersecurity Review Measures (the "Cybersecurity Review Measures") came into effect, as published by the Cyberspace Administration of China (the "CAC") and 12 other relevant PRC government authorities on December 28, 2021. The final Cybersecurity Review Measures provide that a "network platform operator" that possesses personal information of more than one million users and seeks a listing in a foreign country must apply for a cybersecurity review. Further, the relevant PRC governmental authorities may initiate a cybersecurity review against any company if they determine certain network products, services, or data processing activities of such company effects or may effect national security. As of the date of this Annual Report, we have not received any notice from any authority indicating that we are a critical information infrastructure operator, or requiring us to pass the CAC's cyber security review. We believe that, based on the present situation, our operations and listings will not be affected, We do not expect a CAC cybersecurity review, because (1) our current business model is unlikely to be listed as a key information infrastructure operator by Chinese regulators; (2) as of the date of issuance of this Annual Report, the number of our individual customers is far less than one million and we do not have any plan to collect personal information from more than one million users in the near future, otherwise, we may be affected by the draft network security review measures; (3) the data processed in our business is unlikely to have a significant impact on critical information infrastructure supply chain security, network security, and data security, nor is it likely to have a significant impact on national security. It is therefore unlikely to be classified as core or important data by the authorities. However, there remains uncertainty about the interpretation or implementation of the Cybersecurity Review Measures and whether Chinese regulators, including the CAC, can adopt new laws, regulations, rules, or detailed implementation and interpretation related to the review method. If any such new laws, regulations, and rules affect us, we will take all reasonable measures and actions to comply with and minimize the adverse impact of these laws on us. However, we cannot guarantee that we will not be subject to cyber-security scrutiny in the future. We may be required to suspend operations or experience other business disruptions during the review period, which may have significant and adverse effects on our business, financial position, and results of operations.

We rely on communications and information systems to conduct our business to some extent, and in general our ability to protect our systems against damage from fire, power loss, telecommunication failure, severe weather, natural disasters, terrorism or other factors is important to our operations. Our computer systems and network infrastructure could be vulnerable to unforeseen problems. While we have a business continuity plan and other policies and procedures designed to prevent or limit the effect of a failure or interruption of our information systems, there can be no assurance that any such failures or interruptions will not occur or, if they do occur, that they will be adequately addressed. The occurrence of any failures or interruptions of our information systems could, among other things, damage our reputation or result in a loss of clients, which could have a material adverse effect on our results of operations.

We believe that the financial industry is an emerging market in China. We may face growing competition in the financial industry, and we believe that the financial industry is becoming more competitive as the industry matures and begins to consolidate. We will compete with other financial companies and some cash-rich state-owned companies or individuals that provide financial services to MSMEs. Some of these competitors have larger and more established customer bases and substantially greater financial, marketing and other resources than we have. As a result, we could lose market share and our revenues could decline, thereby adversely affecting our earnings and potential for growth.

Three of our customers represent approximately 48.22% of our revenue during the fiscal year ending December 31, 2022. These three customers are able to reduce the amount of their business with us at will or to cease doing business with us entirely at any time. Therefore, our continued revenue from these customers depends on their having continued needs that we are able to service in a manner they find more attractive than utilizing third parties. The loss or material reduction in revenue from either of these customers would have a material adverse effect on our revenue and profitability.

U.S. public companies that have substantially all of their operations in China have been the subject of intense scrutiny, criticism and negative publicity by investors, financial commentators and regulatory agencies, such as the SEC. Much of the scrutiny, criticism and negative publicity has centered on financial and accounting irregularities, a lack of effective internal controls over financial accounting, inadequate corporate governance policies or a lack of adherence thereto and, in many cases, allegations of fraud. As a result of the scrutiny, criticism and negative publicity, the publicly traded stock of many U.S. listed Chinese companies have sharply decreased in value and, in some cases, have become virtually worthless. Many of these companies are now subject to shareholder lawsuits and SEC enforcement actions and are conducting internal and external investigations into the allegations. It is not clear what effect this sector-wide scrutiny, criticism and negative publicity will have on our company and our business. If we become the subject of any unfavorable allegations, whether such allegations are proven to be true or untrue, we will have to expend significant resources to investigate such allegations and/or defend the Company. This situation may be a major distraction to our management. If such allegations are not proven to be groundless, our business operations will be severely hampered and investment in our ordinary shares and other securities could be rendered worthless.