TROOPS, Inc. (TROO) Risk Factors

Although we conduct substantial operations through our subsidiaries in Hong Kong, we also have an indirect wholly-owned subsidiary with no operations in China, which may subject us to certain laws and regulations in China. The Chinese government has exercised and continues to exercise substantial control over virtually every sector of the Chinese economy through regulation and state ownership. Our ability to operate in China may be harmed by changes in its laws and regulations, including those relating to taxation, environmental regulations, land use rights, property and other matters. The central or local governments of these jurisdictions may impose new, stricter regulations or interpretations of existing regulations that would require additional expenditures and efforts on our part to ensure our compliance with such regulations or interpretations. Accordingly, government actions in the future, including any decision not to continue to support recent economic reforms and to return to a more centrally planned economy or regional or local variations in the implementation of economic policies, could have a significant effect on economic conditions in China or particular regions thereof, and could require us to divest ourselves of any interest we then hold in Chinese properties. For example, the Chinese cybersecurity regulator announced on July 2, 2021 that it had begun an investigation of Didi Global Inc. (NYSE: DIDI) and two days later ordered that the company's app be removed from smartphone app stores. On July 24, 2021, the General Office of the Communist Party of China Central Committee and the General Office of the State Council jointly released the Guidelines for Further Easing the Burden of Excessive Homework and Off-campus Tutoring for Students at the Stage of Compulsory Education, pursuant to which foreign investment in such firms via mergers and acquisitions, franchise development, and variable interest entities are banned from this sector. As such, our business segments may be subject to various government and regulatory interference in the provinces in which they operate. We could be subject to regulations by various political and regulatory entities, including various local and municipal agencies and government sub-divisions, and these regulations may be interpreted and applied inconsistently by different agencies or authorities. We may incur increased costs necessary to comply with existing and newly adopted laws and regulations or penalties for any failure to comply, and such compliance or any associated inquiries or investigations or any other government actions may: - delay or impede our development;- result in negative publicity or increase our operating costs;- require significant management time and attention; and - subject our Company to remedies, administrative penalties and even criminal liabilities that may harm our business, including fines assessed for our current or historical operations, or demands or orders that we modify or even cease our business practices. The regulatory framework for the collection, use, safeguarding, sharing, transfer and other processing of personal information and important data worldwide is rapidly evolving in PRC and is likely to remain uncertain for the foreseeable future. Regulatory authorities in China have implemented and are considering a number of legislative and regulatory proposals concerning data protection. For example, the PRC Cybersecurity Law, which became effective in June 2017, established China's first national-level data protection for "network operators," which may include all organizations in China that connect to or provide services over the internet or other information network. The PRC Data Security Law, which was promulgated by the Standing Committee of PRC National People's Congress, or the SCNPC, on June 10, 2021 and became effective on September 1, 2021, outlines the main system framework of data security protection. As of the date of this registration statement, we have not been involved in any investigations on data security compliance made in connection with the PRC Data Security Law, and we have not received any inquiry, notice, warning, or sanctions in such respect. Based on the foregoing, we do not expect that, as of the date of this annual report, the PRC Data Security Law would have a material adverse impact on our business. In August 2021, the Standing Committee of the National People's Congress of China promulgated the Personal Information Protection Law which became effective on November 1, 2021. The Personal Information Protection Law provides a comprehensive set of data privacy and protection requirements that apply to the processing of personal information and expands data protection compliance obligations to cover the processing of personal information of persons by organizations and individuals in China, and the processing of personal information of persons outside of China if such processing is for purposes of providing products and services to, or analyzing and evaluating the behavior of, persons in China. The Personal Information Protection Law also provides that critical information infrastructure operators and personal information processing entities who process personal information meeting a volume threshold to be set by Chinese cyberspace regulators are also required to store in China the personal information generated or collected in China, and to pass a security assessment administered by Chinese cyberspace regulators for any export of such personal information. Moreover, pursuant to the Personal Information Protection Law, persons who seriously violate this law may be fined for up to RMB50 million or 5% of annual revenues generated in the prior year and may also be ordered to suspend any related activity by competent authorities. Recent statements by the Chinese government have indicated an intent to exert more oversight and control over offerings that are conducted overseas and/or foreign investments in China-based issuers. On July 6, 2021, the General Office of the Communist Party of China Central Committee and the General Office of the State Council jointly issued a document to crack down on illegal activities in the securities market and promote the high-quality development of the capital market, which, among other things, requires the relevant governmental authorities to strengthen cross-border oversight of law-enforcement and judicial cooperation, to enhance supervision over China-based companies listed overseas, and to establish and improve the system of extraterritorial application of the PRC securities laws. On December 24, 2021, the CSRC published the Provisions of the State Council on the Administration of Overseas Securities Offering and Listing by Domestic Companies (the "Administration Provisions"), and the Administrative Measures for the Filing of Overseas Securities Offering and Listing by Domestic Companies (the "Measures"), which are now open for public comment. Furthermore, on July 10, 2021, the CAC issued a revised draft of the Measures for Cybersecurity Review for public comments, which required that, among others, in addition to "operator of critical information infrastructure", any "data processor" controlling personal information of no less than one million users which seeks to list in a foreign stock exchange should also be subject to cybersecurity review, and further elaborated the factors to be considered when assessing the national security risks of the relevant activities. On December 28, 2021, the CAC, the National Development and Reform Commission ("NDRC"), and several other administrations jointly issued the revised Measures for Cybersecurity Review, or the "Revised Review Measures", which became effective and replaced the existing Measures for Cybersecurity Review on February 15, 2022. According to the Revised Review Measures, if an "online platform operator" that is in possession of personal data of more than one million users intends to list in a foreign country, it must apply for a cybersecurity review. Based on a set of Q&A published on the official website of the State Cipher Code Administration in connection with the issuance of the Revised Review Measures, an official of the said administration indicated that an online platform operator should apply for a cybersecurity review prior to the submission of its listing application with non-PRC securities regulators. Moreover, the CAC released the draft of the Regulations on Network Data Security Management in November 2021 for public consultation, which among other things, stipulates that a data processor listed overseas must conduct an annual data security review by itself or by engaging a data security service provider and submit the annual data security review report for a given year to the municipal cybersecurity department before January 31 of the following year. Given the recency of the issuance of the Revised Review Measures and their pending effectiveness, there is a general lack of guidance and substantial uncertainties exist with respect to their interpretation and implementation. Currently, we, including our subsidiaries, are not required to obtain approval from Chinese authorities, including the China Securities Regulatory Commission, or CSRC, or Cybersecurity Administration Committee, or CAC, to operate and list on U.S. exchanges or issue securities to foreign investors. If approval is required in the future and we were denied permission from Chinese authorities to list on U.S. exchanges, we will not be able to operate or to continue listing on U.S. exchange, which would materially affect the interest of the investors. It is uncertain when and whether the Company will be required to obtain permission from the PRC government to continue to operate or to list on U.S. exchanges in the future, and even when such permission is obtained, whether it will be denied or rescinded. Although we are currently not required to obtain permission from any of the PRC federal or local government and has not received any denial to list on the U.S. exchange, our operations and ability to continue to list and issue securities to foreign investors may be adversely affected in the future, directly or indirectly, by existing or future laws and regulations relating to our PRC business operations. As a result, both you and us face uncertainty about future actions by the PRC government that could significantly affect our ability to offer or continue to offer securities to investors and cause the value of our securities to significantly decline or be worthless.

As a result of day to day operations GFS collects and retains and customer data, including personal information as its various information technology systems enter, process, summarize and report such data. On June 10, 2021, the Standing Committee of the National People's Congress of China, or the SCNPC, promulgated the PRC Data Security Law, which will take effect in September 2021. The PRC Data Security Law imposes data security and privacy obligations on entities and individuals carrying out data activities, and introduces a data classification and hierarchical protection system based on the importance of data in economic and social development, as well as the degree of harm it will cause to national security, public interests, or legitimate rights and interests of individuals or organizations when such data is tampered with, destroyed, leaked, or illegally acquired or used. The PRC Data Security Law also provides for a national security review procedure for data activities that may affect national security and imposes export restrictions on certain data and information. As uncertainties remain regarding the interpretation and implementation of these laws and regulations, we cannot assure you that GFS will comply with such regulations in all respects while providing its services in the PRC, and GFS may be ordered to rectify or terminate any actions that are deemed illegal by regulatory authorities. GFS may also become subject to fines and/or other sanctions which may have material adverse effect on our business, operations and financial condition.

We are subject to the reporting obligations under the U.S. securities laws. The Securities and Exchange Commission, or the SEC, as required under Section 404 of the Sarbanes-Oxley Act of 2002 ("Section 404"), has adopted rules requiring public companies to include a report of management on the effectiveness of such companies' internal control over financial reporting in their respective annual report. This annual report includes an attestation report of our registered public accounting firm regarding internal control over financial reporting that appears herein. Our management has concluded that under the rules of Section 404, our internal control over financial reporting was ineffective as of December 31, 2023. A material weakness is a deficiency, or a combination of deficiencies, in internal control such that there is a reasonable possibility that a material misstatement of our company's financial statements will not be prevented, or detected and corrected on a timely basis. A significant deficiency is a deficiency, or combination of deficiencies, in internal control that is less severe than a material weakness, yet important enough to merit attention by those charged with governance. The specific material weaknesses we identified in our internal control over financial reporting consist of the following: -The Company has inadequate documentation on internal control over financial reporting;-The Company does not maintain documentation on operating effectiveness tests of internal control over financial reporting;-The Company has limited written documentation on monitoring loan risk assessment on a regular basis;-The Company has lack of sufficient controls and policies on loan credit risk monitoring in post-loan management, on a regular basis;-The Company has inadequate control procedures on monitoring expired loans and overdue principal and interest payments;-The lack of sufficient qualified accounting personnel with appropriate understanding of U.S. GAAP and SEC reporting requirements commensurate with the Company's financial reporting requirements, which resulted in a number of internal control deficiencies. Also, as a small-scale company, the Company does not have sufficient internal control personnel to set up adequate review functions at each reporting level. We are in the process of implementing measures to resolve the material weakness and improve our internal and disclosure controls. However, we may not be able to successfully implement the remedial measures. The implementation of our remedial initiatives may not fully address the material weaknesses and significant deficiencies in our internal control over financial reporting. In addition, the process of designing and implementing an effective financial reporting system is a continuous effort that requires us to anticipate and react to changes in our business and economic and regulatory environments and to expend significant resources to maintain a financial reporting system that is adequate in satisfying our reporting obligations. We also expect to incur additional compensation expenses in connection with hiring additional accounting and internal control personnel. As a result, our business and financial condition, results of operations and prospects, as well as the trading price of our ordinary shares may be materially and adversely affected. Ineffective internal control over financial reporting could also expose us to increased risk of fraud or misuse of corporate assets, In turn, that could subject us to potential delisting from the stock exchange on which our ordinary shares are listed, regulatory investigations or civil or criminal sanctions.

We believe that the lending industry is an emerging market in Hong Kong. We may face growing competition in the lending industry, and we believe that the lending industry is becoming more competitive as this industry matures and begins to consolidate. We will compete, with traditional financial institutions, other lending companies, other microfinance companies, and some cash-rich state-owned companies or individuals. Some of these competitors have larger and more established borrower bases and substantially greater financial, marketing and other resources than we have. As a result, we could lose market share and its revenues could decline, thereby adversely affecting our earnings and potential for growth.

Our headquarters is based in Hong Kong and we have operations in Hong Kong. Accordingly, our business operation and financial conditions will be affected by the political and legal developments in Hong Kong. During the period covered by the financial information incorporated by reference into and included in this annual report, we maintain substantial operations in Hong Kong, especially through Giant Credit Limited. Any adverse economic, social and/or political conditions, material social unrest, strike, riot, civil disturbance or disobedience, as well as significant natural disasters, may affect the market may adversely affect the business operations of Giant Credit Limited and the Company. Hong Kong is a special administrative region of the PRC and the basic policies of the PRC regarding Hong Kong are reflected in the Basic Law, namely, Hong Kong's constitutional document, which provides Hong Kong with a high degree of autonomy and executive, legislative and independent judicial powers, including that of final adjudication under the principle of "one country, two systems". However, there is no assurance that there will not be any changes in the economic, political and legal environment in Hong Kong in the future. Since our operation is based in Hong Kong, any change of such political arrangements may pose immediate threat to the stability of the economy in Hong Kong, thereby directly and adversely affecting our results of operations and financial positions. Under the Basic Law of the Hong Kong Special Administrative Region of the People's Republic of China, Hong Kong is exclusively in charge of its internal affairs and external relations, while the government of the PRC is responsible for its foreign affairs and defense. As a separate customs territory, Hong Kong maintains and develops relations with foreign states and regions. Based on certain recent development including the Law of the People's Republic of China on Safeguarding National Security in the Hong Kong Special Administrative Region issued by the Standing Committee of the PRC National People's Congress in June 2020, the U.S. State Department has indicated that the United States no longer considers Hong Kong to have significant autonomy from China and at the time President Trump signed an executive order and Hong Kong Autonomy Act, or HKAA, to remove Hong Kong's preferential trade status and to authorize the U.S. administration to impose blocking sanctions against individuals and entities who are determined to have materially contributed to the erosion of Hong Kong's autonomy. The United States may impose the same tariffs and other trade restrictions on exports from Hong Kong that it places on goods from mainland China. These and other recent actions may represent an escalation in political and trade tensions involving the U.S, China and Hong Kong, which could potentially harm our business. Given the relatively small geographical size of Hong Kong, any of such incidents may have a widespread effect on our business operations, which could in turn adversely and materially affect our business, results of operations and financial condition. It is difficult to predict the full impact of the HKAA on Hong Kong and companies with operations in Hong Kong like us. Furthermore, legislative or administrative actions in respect of China-U.S. relations could cause investor uncertainty for affected issuers, including us, and the market price of our Ordinary Shares could be adversely affected.