TuanChe (TC) Risk Analysis

The M&A Rules established additional procedures and requirements that could make merger and acquisition activities in China by foreign investors more time-consuming and complex. For example, MOFCOM must be notified in the event a foreign investor takes control of a PRC domestic enterprise. Moreover, certain acquisitions of domestic companies by offshore companies that are related to or affiliated with the same entities or individuals of the domestic companies, are subject to approval by the anti-monopoly law enforcement agency. In addition, the Implementing Rules Concerning Security Review on Mergers and Acquisitions by Foreign Investors of Domestic Enterprises, issued by MOFCOM in August 2011, require that mergers and acquisitions by foreign investors in "any industry with national security concerns" be subject to national security review by MOFCOM. Furthermore, any activities attempting to circumvent such review process, including structuring the transaction through a proxy or contractual control arrangement, are strictly prohibited. Moreover, in December 2020, the NDRC and the MOFCOM promulgated the Measures for Security Review of Foreign Investment, which became effective on January 18, 2021. Pursuant to the Measures for Security Review of Foreign Investment, any foreign investment activities falling in the scope such as important cultural products and services, important information technologies and internet products and services, important financial services, key technologies and other important fields that concern state security while obtaining the actual control over the enterprises invested in, a foreign investor or a party concerned in the PRC shall take the initiative to make a declaration to the working mechanism office prior to making the investment. See "Item 4. Information on the Company-B. Business Overview-Regulation-Regulations Relating to Foreign Investment in Value-added Telecommunications Companies" in this annual report. There is significant uncertainty regarding the interpretation and implementation of these regulations relating to merger and acquisition activities in China. In addition, complying with these requirements could be time-consuming, and the required notification, review or approval process may materially delay or affect our ability to complete merger and acquisition transactions in China. As a result, our ability to seek growth through acquisitions may be materially and adversely affected.

Under the PRC laws and regulations, a company is required to register a branch, whether in the form of a branch office or a subsidiary under the PRC laws, at each of the premises where it conducts business outside its registered domicile. As of the date of this annual report, we and the VIEs have registered certain regional offices, including those in Shenzhen, Chongqing, Tianjin, Hangzhou, Xi'an, Harbin, Hefei, Nanjing, Wuha, Chengdu, Zhengzhou and Shijiazhuang, as our and the VIEs' branches, and we and the VIEs' have not yet received any inquiry or investigation from any PRC government authority regarding the absence of any registration. However, we cannot assure you that we and the VIEs will set up all necessary branches in a timely manner due to complex procedural requirements and the relocation of branch offices from time to time, if the PRC regulatory authorities determine that we and the VIEs have failed to complete registration in a timely manner as required by the applicable laws and regulations, we and the VIEs may be subject to penalties, including fines, confiscation of income and suspension of operation, which may adversely affect our and the VIEs' business, results of operations, and financial condition.

We will be classified as a "passive foreign investment company," or PFIC, if, in the case of any particular fiscal year, either (1) 75.0% or more of our gross income for such year consists of certain types of passive income, or (2) 50.0% or more of the average quarterly value of our assets during such year produce or are held for the production of passive income. Although the law in this regard is unclear, we treat the VIEs as being owned by us for United States federal income tax purposes, not only because we exercise significant influence over the operation of such entities but also because we are entitled to substantially all of their economic benefits, and, as a result, we consolidate their results of operation in our financial statements. Assuming that we are the owner of the VIEs for United States federal income tax purposes, and based upon our historical and current income and assets, we do not believe that we were classified as a PFIC for the fiscal year ended December 31, 2023, and we do not expect to be classified as a PFIC for the current fiscal year. The determination of whether we are or will become a PFIC will depend upon the composition of our income (which may differ from our historical results and current projections) and assets and the value of our assets from time to time, including, in particular, the value of our goodwill and other unbooked intangibles (which may depend upon the market value of the ADSs or ordinary shares from time-to-time and may be volatile). Among other matters, if our market capitalization declines, we may be classified as a PFIC for the current fiscal year or future fiscal years. It is also possible that the IRS, may challenge our classification or valuation of our goodwill and other unbooked intangibles, which may result in our company being, or becoming classified as, a PFIC for the current fiscal year or future fiscal years. While we do not expect to become a PFIC in the current fiscal year, the determination of whether we will be or become a PFIC may also depend, in part, on how, and how quickly, we use our liquid assets and cash. Under circumstances where we retain significant amounts liquid assets, or if the VIEs were not treated as owned by us for United States federal income tax purposes, our risk of being classified as a PFIC may substantially increase. Because there are uncertainties in the application of the relevant rules and PFIC status is a factual determination made annually after the close of each fiscal year, we cannot assure you that we will not be a PFIC for the current fiscal year or any future fiscal year. If we are classified as a PFIC in any fiscal year, a U.S. Holder (as defined in "Item 10. Additional Information-E. Taxation-United States Federal Income Taxation") may incur significantly increased United States federal income tax on gain recognized on the sale or other disposition of the ADSs, ordinary shares, the Warrants or the Pre-Funded Warrants and on the receipt of distributions on the ADSs or ordinary shares (and, if applicable, the Warrants or the Pre-Funded Warrants) to the extent such gain or distribution is treated as an "excess distribution" under the United States federal income tax rules, and such holders may be subject to burdensome reporting requirements. Further, if we are classified as a PFIC for any year during which a U.S. Holder holds the ADSs, ordinary shares, the Warrants or the Pre-Funded Warrants, we generally will continue to be treated as a PFIC for all succeeding years during which such U.S. Holder holds the ADSs, ordinary shares, the Warrants or the Pre-Funded Warrants. For more information, see "Item 10. Additional Information-E. Taxation-United States Federal Income Taxation."

We and the VIEs are subject to PRC laws and regulations governing the collecting, storing, sharing, using, processing, disclosure and protection of data on the internet and mobile platforms as well as cybersecurity. The PRC regulators, including the MIIT and the CAC, have been increasingly focused on regulation in the areas of cybersecurity and data protection and governmental authorities have enacted a series of laws and regulations to enhance the protection of privacy and data, which require certain authorization or consent from users prior to collection, use or disclosure of their personal data and also protection of the security of the personal data of such users. The MIIT issued the Order for the Protection of Telecommunications and Internet User Personal Information on July 16, 2013, requiring internet service providers to establish and publish protocols relating to the collection or use of personal information, keep any collected information strictly confidential and take technological and other measures to maintain the security of such information. Institutions and their employees are prohibited from selling or otherwise illegally disclosing a person's personal information obtained during the course of performing duties or providing services. Pursuant to the PRC Cybersecurity Law, effective on June 1, 2017, network operators are required to fulfill certain obligations to safeguard cyber security and enhance network information management. See "Item 4. Information on the Company - B. Business Overview - Regulations - Regulations relating to internet information security and privacy protection" in this annual report. Moreover, existing PRC privacy, cybersecurity and data protection-related laws and regulations are evolving and subject to potentially differing interpretations, and various legislative and regulatory bodies may expand current or enact new laws and regulations regarding privacy, cybersecurity and data protection-related matters. These developments could adversely affect our and the VIEs' business, operating results and financial condition. Any failure or perceived failure by us or the VIEs to comply with new or existing PRC privacy, cybersecurity or data protection laws, regulations, policies, industry standards or legal obligations, or any systems failure or security incident that results in the unauthorized access to, or acquisition, release or transfer of, personally identifiable information or other data relating to customers or individuals may result in governmental investigations, inquiries, enforcement actions and prosecutions, private claims and litigation, fines and penalties, adverse publicity or potential loss of business. For example, on June 10, 2021, the Standing Committee of the National People's Congress (the "Standing Committee of the NPC"), promulgated the PRC Data Security Law, which took effect in September 2021. The PRC Data Security Law provides for data security obligations on entities and individuals carrying out data activities. The PRC Data Security Law also introduces a national security review procedure for those data activities which may affect national security and imposes export restrictions on certain data information. Furthermore, along with the promulgation of the Opinions on Strictly Cracking Down Illegal Securities Activities in accordance with the Law, overseas-listed China-based companies are experiencing a heightened scrutiny over their compliance with laws and regulations regarding data security, cross-border data flow and management of confidential information from PRC regulatory authorities. On August 20, 2021, the Standing Committee of the NPC issued the Personal Information Protection Law, which has been effective from November 1, 2021 and reiterates the circumstances under which a personal information processor could process personal information and the requirements for such circumstances. The Personal Information Protection Law clarifies the scope of application, the definition of personal information and sensitive personal information, the legal basis of personal information processing and the basic requirements of notice and consent. On October 29, 2021, the CAC publicly solicited opinions on the Measures for the Security Assessment of Data Cross-border Transfer (Draft for Comments), which requires that any data processor who provides to an overseas recipient important data collected and generated during operations within the territory of the PRC or personal information that should be subject to security assessment shall conduct security assessment. The Measures for the Security Assessment of Data Cross-border Transfer was adopted on July 7, 2022 and took effect on September 1, 2022. On November 14, 2021, the CAC publicly solicited opinions on the Administrative Measures for Internet Data Security (Draft for Comments) (the "Draft Measures for Internet Data Security"), which requires that data processors processing "important data" or listed overseas shall conduct an annual data security assessment by itself or commission a data security service provider to do so and submit the assessment report for the preceding year to the municipal cybersecurity department by the end of January each year. As of the date of this annual report, the Draft Measures for Internet Data Security has not been formally adopted. However, if the Draft Measures for Internet Data Security were to be enacted in the current form, we, as an overseas listed company, will be required to conduct an annual data security review and comply with the relevant reporting obligations. Furthermore, according to the Draft Measures for Internet Data Security, data processors shall, in accordance with relevant state provisions, apply for cyber security review when carrying out the following activities: (1) the merger, reorganization or separation of internet platform operators that have acquired a large number of data resources related to national security, economic development or public interests, which affects or may affect national security, (2) data processors that handle the personal information of more than one million people intends to be listed abroad, (3) the data processor intends to be listed in Hong Kong, which affects or may affect national security, and (4) other data processing activities that affect or may affect national security. It remains uncertain whether the requirement of cybersecurity review applies to follow-on offerings of securities by an overseas-listed online platform operator that possesses personal data of more than one million users. We completed our initial public offering on November 23, 2018, and the ADSs have been listed on Nasdaq Capital Market since November 2018. Considering the substantial uncertainties existing with respect to the enactment timetable, final content, interpretation and implementation of the Draft Measures for Internet Data Security, in particular with respect to the explanation or interpretation for "affects or may affect national security," there remain uncertainties as to whether our data processing activities may be deemed to affect national security, thus subjecting us to a cybersecurity review. As of the date of this annual report, we have not received any formal notice from any cybersecurity regulator that we shall be subject to a cybersecurity review. On December 28, 2021, the CAC and 12 other government authorities published the Measures for Cybersecurity Review, which took effect on February 15, 2022. The Measures for Cybersecurity Review provides that certain operators of critical information infrastructure purchasing internet products and services or network platform operators carrying out data processing activities, which affect or may affect national security, must apply with the Cybersecurity Review Office for a cybersecurity review. On July 30, 2021, the State Council promulgated the Regulations on Protection of Critical Information Infrastructure, which became effective on September 1, 2021. Pursuant to the Regulations on Protection of Critical Information Infrastructure, critical information infrastructure shall mean any important network facilities or information systems of an important industry or field, such as public communication and information service, energy, communications, water conservation, finance, public services, e-government affairs and national defense science, and any other important network facilities or information system which may endanger national security, people's livelihoods and public interest in the event of damage, function loss or data leakage. In addition, relevant administrative departments of each critical industry and sector, shall be responsible to formulate eligibility criteria and determine the critical information infrastructure operator in the respective industry or sector. The operators shall be informed about the final determination as to whether they are categorized as critical information infrastructure operators. As of the date of this annual report, the exact scope of "critical information infrastructure operators" shall be subject to the recognition and notification of applicable governmental authorities, and we have not been informed that we are identified as a critical information infrastructure operator by any governmental authorities. Furthermore, since the Measures for Cybersecurity Review is relatively new and the determination of "affecting national security" are subject to further explanations and interpretations, there remain uncertainties as to whether our data processing activities may be deemed to affect national security and whether we would be required to apply for a cybersecurity review. In light of such uncertainties in relation to the interpretations and implementation of Measures for Cybersecurity Review, we cannot predict the impact of the Measures for Cybersecurity Review and will continue to closely monitor and assess the statutory developments in this regard. If we are identified as an operator of "critical information infrastructure," we would be required to fulfill various obligations as required under PRC cybersecurity laws and other applicable laws for such operators of "critical information infrastructure," and we may be subject to cybersecurity review procedure before making certain purchases of network products and services, which could lead to adverse impacts on our business and a diversion of time and attention of our management and our other resources. Furthermore, there can be no assurance that we will obtain the clearance or approval for these applications from the Cybersecurity Review Office and the relevant regulatory authorities in a timely manner, or at all. If we are found to be in violation of cybersecurity requirements of the PRC, the relevant governmental authorities may conduct investigations, levy fines, or require us to change our business practices in a manner materially adverse to our business. Any of these actions may disrupt our operations and adversely affect our business, results of operations and financial condition. Currently, the cybersecurity laws and regulations in force have not directly affected our or the VIEs' business and operations, but in anticipation of the strengthened implementation of cybersecurity laws and regulations and the expansion of our business, we face potential risks if we are deemed as a CIIO under the Cybersecurity Law. In such case, we must fulfill certain obligations as required under the Cybersecurity Law and other applicable laws, including, among others, storing personal information and important data collected and produced within the PRC territory during our operations in China, which we are already doing in our business, and we may be subject to review when purchasing internet products and services. As the Measures for Cybersecurity Review took effect in February 2022, we may be subject to review when conducting data processing activities, and may face challenges in addressing its requirements and make necessary changes to our internal policies and practices in data processing. As of the date of this annual report, we, our subsidiaries and the VIEs have not been involved in any investigations on cybersecurity review made by the CAC on such basis, and we, our subsidiaries and the VIEs have not received any inquiry, notice, warning, or sanctions in such respect. Based on the foregoing, we and our PRC legal counsel do not expect that, as of the date of this annual report, the applicable PRC laws on cybersecurity currently in effect would have a material adverse impact on our and the VIEs' business. On July 7, 2022, the CAC promulgated the Measures on Data Export Security Assessment, which came into effect on September 1, 2022. Such Measures on Data Export Security Assessment requires data processors to apply for a security assessment on data export. On February 24, 2023, the CSRC, the Ministry of Finance, the National Administration of State Secrets Protection and the National Archives Administration released the revised Provisions on Strengthening the Confidentiality and Archives Administration of Overseas Securities Offering and Listing by Domestic Companies, or the Provision on Confidentiality, which became effective on March 31, 2023. Complying with these obligations concerning data protection and cybersecurity could cause us and the VIEs to incur substantial costs. As the interpretation and application of cybersecurity laws, regulations and standards of the PRC are still uncertain and evolving, we and the VIEs may be required to make further adjustments to our and the VIEs' business practices to comply with the enacted form of the laws, which may increase our and the VIEs' compliance cost and adversely affect our business performance. We expect that there will continue to be new proposed laws, rules of self-regulatory bodies, regulations and industry standards concerning privacy, data protection and information security in the PRC, and we cannot yet determine the impact such future laws, rules, regulations and standards may have on our and the VIEs' business. Moreover, we and the VIEs may not disclose any personal data or information, unless required by the competent PRC authorities through certain procedures required by the laws, for the purpose of, among others, safeguarding the national security, investigating crimes, investigating infringement of information network communications rights, or cooperating with the supervision and inspection of telecommunications regulatory authorities. Failure to comply with these requirements could subject us and the VIEs to fines and penalties.

Our and the VIEs' future success depends on the continued service of our and the VIEs' key executive officers, senior management, and other key employees. We and the VIEs benefit from the leadership of a strong management team with proven vision, rich professional work experience and extensive knowledge of China's automotive industry. We and the VIEs also rely on a number of key staff for the development and operation of our and the VIEs' business. In addition, we and the VIEs will need to continue attracting and retaining skilled and experienced staff for our and the VIEs' businesses to maintain our competitiveness. If one or more of our and the VIEs' key personnel are unable or unwilling to continue in their present positions, we and the VIEs may not be able to replace them easily or at all and may incur additional expenses to recruit and train new personnel. In addition, if any of our and the VIEs' executive officers, senior management, or key employees joins a competitor or forms a competing company, we and the VIEs may be disadvantaged in the competition and risk losing our and the VIEs' know-how, trade secrets, suppliers and customers. Substantially all of our and the VIEs' employees, including each of our and the VIEs' executive officers, senior management, and key employees, have entered into employment agreements with us and the VIEs, respectively, which contain customary non-compete provisions. Although non-compete provisions are generally enforceable under PRC laws, PRC legal practice regarding the enforceability of such provisions is not as well-developed as in countries such as the United States. Therefore, if we and the VIEs lose the services of any of our and the VIEs' key executive officers, senior management, or other key employees, or are unable to retain, recruit and hire experienced staff, our and the VIEs' ability to effectively manage and execute our and the VIEs' operations and meet our and the VIEs' strategic objectives could be harmed.

Short selling is the practice of selling securities that the seller does not own but rather has borrowed from a third party with the intention of buying identical securities back at a later date to return to the lender. The short seller hopes to profit from a decline in the value of the securities between the sale of the borrowed securities and the purchase of the replacement shares, as the short seller expects to pay less in that purchase than it received in the sale. As it is in the short seller's interest for the price of the security to decline, many short sellers publish, or arrange for the publication of, negative opinions regarding the relevant issuer and its business prospects in order to create negative market momentum and generate profits for themselves after selling a security short. These short attacks have, in the past, led to selling of shares in the market. Public companies that have substantially all of their operations in China have been the subject of short selling. Much of the scrutiny and negative publicity has centered on allegations of a lack of effective internal control over financial reporting resulting in financial and accounting irregularities and mistakes, inadequate corporate governance policies or a lack of adherence thereto and, in many cases, allegations of fraud. As a result, many of these companies are now conducting internal and external investigations into the allegations and, in the interim, are subject to shareholder lawsuits and/or SEC enforcement actions. It is not clear what effect such negative publicity could have on us. If we were to become the subject of any unfavorable allegations, whether such allegations are proven to be true or untrue, we could have to expend a significant amount of resources to investigate such allegations and/or defend ourselves. While we would strongly defend against any such short seller attacks, we may be constrained in the manner in which we can proceed against the relevant short seller by principles of freedom of speech, applicable state law or issues of commercial confidentiality. Such a situation could be costly and time-consuming, and could distract our management from growing our business. Even if such allegations are ultimately proven to be groundless, allegations against us could severely impact our and the VIEs' business operations, and any investment in the ADSs could be greatly reduced or even rendered worthless.

We conduct substantially all of our business in China, and substantially all of our assets are located in China. Accordingly, our business, results of operations and financial condition may be influenced to a significant degree by the political and social conditions in China in general and China's economic growth. While the Chinese economy has experienced significant growth in the past decades, there can be no assurance that the growth would be maintained or be even across sectors. In addition, any severe or prolonged slowdown in the rate of growth of the Chinese economy may adversely affect our and the VIEs' business and results of operations, leading to a reduction in demand for our and the VIEs' products and services and adversely affect our and the VIEs' competitive position. Various measures implemented by the PRC government to encourage economic growth may benefit the overall Chinese economy, while we cannot assure you how these measures would impact us and the VIEs. The PRC government has oversight and discretion over the conduct of our and the VIEs' business in accordance with relevant PRC laws and regulations and may influence our and the VIEs' operations. In addition, the PRC government has strengthened oversight over offerings that are conducted overseas and/or foreign investment in China-based issuers like us, and has implemented, and may continue to implement, relevant regulatory requirements. Our and the VIEs' failure to meet such requirements could significantly limit or hinder our ability to offer or continue to offer securities to investors and cause the value of our securities to significantly decline or become worthless. Any of the foregoing could result in a material adverse change in our business operations and/or the value of our securities. Our and the VIEs' ability to successfully maintain or grow business operations in China depends on various factors, which are beyond our and the VIEs' control. These factors include, among others, macro-economic and other market conditions, political stability, social conditions, measures to control inflation or deflation, changes in the rate or method of taxation, changes in laws, regulations and administrative directives or their interpretation, and changes in industry policies. If we fail to take timely and appropriate measures to adapt to any of the changes or challenges, our business, results of operations and financial condition could be materially and adversely affected.

We and the VIEs are vulnerable to natural disasters and other calamities. Fire, floods, typhoons, earthquakes, power loss, telecommunications failures, wars, riots, terrorist attacks or similar events may give rise to server interruptions, breakdowns, system failures or internet failures, which could cause the loss or corruption of data or malfunctions of software or hardware as well as adversely affect our and the VIEs' ability to provide our and the VIEs' services. Our and the VIEs' business could also be adversely affected by the effects of Ebola virus diseases, H1N1 flu, H7N9 flu, avian flu, Severe Acute Respiratory Syndrome (SARS), COVID-19 or other epidemics. Our and the VIEs' business operation could be disrupted if any of our and the VIEs' employees is suspected of having any of the aforementioned epidemics or another contagious disease or condition, since it could require our and the VIEs' employees to be quarantined and/or our and the VIEs' offices to be disinfected. In addition, our and the VIEs' business, results of operations and financial condition could be adversely affected to the extent that any of these epidemics harms the Chinese economy in general.

Internet, technology and media companies are frequently involved in litigation based on allegations of infringement of intellectual property rights, unfair competition, invasion of privacy, defamation and other violation of other parties' rights. We and the VIEs have not experienced any material claims on these issues against us or the VIEs in the past, but as we and the VIEs face increasing competition and as litigation becomes more common in China in resolving commercial disputes, we and the VIEs face a higher risk of being the subject of intellectual property infringement claims. We and the VIEs may be subject to legal proceedings and claims from time to time relating to the intellectual property of others in the ordinary course of our and the VIEs' business. We and the VIEs could also be subject to claims based upon the content that is displayed on our and the VIEs' websites or accessible from our and the VIEs' websites through links to other websites or information on our and the VIEs' websites supplied by third parties. Intellectual property claims and litigation are expensive and time-consuming to investigate and defend and may divert resources and management attention from the operation of our websites. Such claims, even if they do not result in liability, may harm our and the VIEs' reputation. Any resulting liability or expenses, or changes required of our and the VIEs' websites to reduce the risk of future liability, may have a material adverse effect on our and the VIEs' business, financial condition, and results of operations.

On January 21, 2021, our board of directors received a preliminary non-binding proposal letter from Mr. Wei Wen, our chairman and chief executive officer, proposing a "going-private" transaction. On November 12, 2021, Mr. Wei Wen withdrew the non-binding going-private proposal, in order to open up more opportunities for our company. We cannot assure you that Mr. Wei Wen or other members of our senior management team will not in the future propose similar going-private transactions and seek to acquire all of the outstanding ordinary shares of our company. Such transaction, whether or not consummated, may divert management focus, employee attention and resources from other strategic opportunities and from operational matters. Uncertainty about the future direction of our company may inhibit investors from buying the ADSs, which may reduce liquidity in the market for the ADSs.