Privacy and data rules

By sector

Sector is the SEC's industry description of the company. Each count opens that sector's quotes below.

432 paragraphs · Finance Services show all sectors

•prevent, detect, respond to, or mitigate failures or breaches of privacy and security, including with respect to our bitcoin and our custodial partners;

Read in the 10-K filed Mar 19, 2026 ↗

•improper disclosure of data and violations of applicable data privacy and other laws; or

Read in the 10-K filed Mar 19, 2026 ↗

Attacks upon systems across a variety of industries, including industries related to bitcoin and financial services, are increasing in frequency, persistence, and sophistication, and, in many cases, are being conducted by sophisticated, well-funded and organized groups and individuals, including state actors. The techniques used to obtain unauthorized, improper or illegal access to systems and information (including personal data and digital assets), disable or degrade services, or sabotage systems are constantly evolving, may be difficult to detect quickly, and often are not recognized or detected until after they have been launched against a target. These attacks may occur on our systems or those of our third-party service providers or partners. In 2025, we have not identified any cybersecurity threats or incidents, including those resulting from any previous cybersecurity incidents, that have materially affected, or, to our knowledge, are reasonably likely to materially affect, us or our business strategy, results of operations or financial condition. However, we may, in the future, experience breaches of our security measures due to human error, malfeasance, insider threats, system errors or vulnerabilities or other irregularities. In particular, we expect that unauthorized parties will attempt to gain access to our systems and facilities, as well as those of our partners and third-party service providers, through various means, such as hacking, social engineering, phishing and fraud. Threats can come from a variety of sources, including criminal hackers, hacktivists, state-sponsored intrusions, industrial espionage, and insiders. In addition, certain types of attacks could harm us even if our systems are left undisturbed. For example, certain threats are designed to remain dormant or undetectable, sometimes for extended periods of time, until launched against a target and we may not be able to implement adequate preventative measures. Further, there has been an increase in such activities due to the increase in work-from-home arrangements. The risk of cyberattacks could also be increased by cyberwarfare in connection with the ongoing Russia-Ukraine and Israel-Hamas conflicts, or other future conflicts, including potential proliferation of malware into systems unrelated to such conflicts. Any future breach of our operations or those of others in the bitcoin or financial services industries, including third-party services on which we rely, could materially and adversely affect our financial condition and results of operations.

Read in the 10-K filed Mar 19, 2026 ↗

To the extent we pursue our Investment Policy, including through our announced international expansion initiatives in Asia (including in Japan and India), we will be exposed to various risks associated with digital assets, including the following: Bitcoin does not pay interest, dividends or other returns and we can only generate cash from our Bitcoin holdings if we sell them or implement strategies to create income streams or otherwise generate cash by using those holdings; our lack of control over decentralized or third-party blockchains, networks, and custodians that may experience downtime, cyberattacks, critical failures, errors, bugs, corrupted files, data losses, or other similar software failures, outages, breaches and losses, including those due to third-party actions; breaches of security or privacy; further reductions in mining rewards of Bitcoin or increases in the costs associated with Bitcoin mining; transaction congestion and fees associated with processing transactions on the Bitcoin networks; developments in mathematics or technology or new applications of current knowledge that could result in the cryptography used by the Bitcoin blockchains becoming insecure or ineffective; pressures on trading platforms and infrastructure that can lead to inadvertent suspension of services across parts of the platforms or the entire platforms, which may cause outages; and differences in prices of digital assets between exchanges.

Read in the 10-K filed Mar 19, 2026 ↗

Cybersecurity, data privacy and intellectual property risks: Cybersecurity incidents may compromise systems; intellectual property disputes or alleged infringements could disrupt our business; accounting for digital assets and fair value measurements; potential impairment charges; auditor transitions; internal control considerations.

Read in the 10-K filed Nov 21, 2025 ↗

Various other technical issues have also been uncovered from time to time that resulted in disabled functionalities, exposure of certain users’ personal information, theft of users’ assets, and other negative consequences, and which required resolution with the attention and efforts of their global miner, user, and development communities. If any such risks or other risks materialize, and in particular if they are not resolved, the development and growth of digital assets may be significantly affected and, as a result, our business, operating results, and financial condition could be adversely affected.

Read in the 10-K filed Nov 21, 2025 ↗

Various other technical issues have also been uncovered from time to time that resulted in disabled functionalities, exposure of certain users’ personal information, theft of users’ assets, and other negative consequences, and which required resolution with the attention and efforts of their global miner, user, and development communities. If any such risks or other risks materialize, and in particular if they are not resolved, the development and growth of digital assets may be significantly affected and, as a result, our business, operating results, and financial condition could be adversely affected.

Read in the 10-K filed Mar 27, 2026 ↗

result in exposure to claims for damages and other remedies by WhiteFiber’s customers and individuals whose personal data is the subject to a cybersecurity incident;

Read in the 10-K filed Mar 27, 2026 ↗

For example, California has enacted the California Consumer Privacy Act (“CCPA”) and the California Privacy Rights Act (“CPRA”), which, among other things, allows California consumers to request that certain companies disclose the types of personal information collected by such companies, to correct that information, to delete that information and to opt-out the sale or sharing of personal information for cross-context behavioral advertising. The California Privacy Protection Agency (“CPPA”) has proposed new regulations to require companies to conduct risk assessments, annual cybersecurity audits and set up notice and opt-out and access procedures for the use of automated decision-making technology. These proposed new requirements could increase our costs of compliance and impact our operations and the products and services we offer.

Read in the 10-K filed Mar 27, 2026 ↗

In addition, Iowa, Delaware, Maine, Virginia, Colorado, Utah, Oregon, Montana, Nebraska, New Hampshire, New Jersey, Texas, Utah and Connecticut enacted privacy and data protection laws in recent years that are currently in effect and grant similar rights and impose similar obligations as the CCPA. New privacy laws enacted in Maryland, Minnesota, Rhode Island, and Tennessee will take effect over the next couple years. Other states in the U.S. are also separately proposing laws to regulate privacy and security of personal data. Our failure, and/or the failure by the various third party vendors and service providers with which we do business, to comply with applicable privacy policies or federal or state laws or changes in applicable laws and regulations, or any compromise of security that results in the unauthorized release of personal information or other user data could damage our reputation and the reputation of our third party vendors and service providers, discourage potential users from trying their products and services and/or result in fines and/or proceedings by governmental agencies and/or consumers, any one or all of which could adversely affect our business, financial condition and results of operations and, as a result, our company. In addition, we, our subsidiaries or our business affiliates may not have adequate insurance coverage to compensate for losses.

Read in the 10-K filed Mar 27, 2026 ↗

Foreign data privacy laws, such as the General Data Protection Regulation (“GDPR”) in the European Union and the United Kingdom Data Protection Act (“UK GDPR”) impose data privacy and security requirements that may impact our ability to collect and process personal information of residents of the EU and the UK. The transfer of personal information from such jurisdictions may be subject to additional restrictions and require the use of transfer mechanisms recognized by GDPR and UK GDPR, such as the use of Standard Contractual Clauses, which impose numerous obligations on data importers and exporters. Violations of the GDPR or UK GDPR could impose us to fines of up to €20 million, or up to 4% of the annual worldwide turnover of the preceding financial year, whichever is greater.

Read in the 10-K filed Mar 27, 2026 ↗

A successful cybersecurity incident or IT Systems failure could result in, among other things, (i) interruptions to our operations or services; (ii) loss of control or impaired operation of our equipment; (iii) misappropriation or loss of personal data, Confidential Information or other critical data; and (iv) loss, theft or irretrievable loss of bitcoin or other digital assets. Such incidents could materially harm our business and reputation, require significant incident response, remediation or system restoration efforts and expenses, and expose us to governmental or regulatory investigations,

Read in the 10-K filed Feb 24, 2026 ↗

enforcement actions, litigation (including class actions), fines, penalties or other liabilities. In addition, a data breach or cybersecurity incident may trigger mandatory notification obligations under applicable privacy and data protection laws, which could result in negative publicity and a loss of confidence in our security measures.

Read in the 10-K filed Feb 24, 2026 ↗

privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such

Read in the 10-K filed Mar 2, 2026 ↗

We may incur significant costs or modify our business activities to try to protect against security incidents. Certain data privacy

Read in the 10-K filed Mar 2, 2026 ↗

security measures to protect our digital assets, sensitive information, and information technology systems, Applicable data privacy and

Read in the 10-K filed Mar 2, 2026 ↗

liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security

Read in the 10-K filed Mar 2, 2026 ↗

standards, policies and other obligations related to data privacy and security. Our actual or perceived failure to comply with such

Read in the 10-K filed Mar 2, 2026 ↗

The Company processes personal data and other sensitive and confidential information, which subjects it to various obligations

Read in the 10-K filed Mar 2, 2026 ↗

related to data privacy and security. In the ordinary course of business, we collect, receive, store, process, generate, use, transfer,

Read in the 10-K filed Mar 2, 2026 ↗

disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, process) personal data and other sensitive

Read in the 10-K filed Mar 2, 2026 ↗

Our data processing activities subject us to numerous data privacy and security obligations, such as various laws, regulations,

Read in the 10-K filed Mar 2, 2026 ↗

guidance, industry standards, external and internal privacy and security policies, contractual requirements, and other obligations

Read in the 10-K filed Mar 2, 2026 ↗

In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data

Read in the 10-K filed Mar 2, 2026 ↗

breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act),

Read in the 10-K filed Mar 2, 2026 ↗

and other similar laws (e.g., wiretapping laws). Numerous U.S. states have enacted comprehensive privacy laws that impose certain

Read in the 10-K filed Mar 2, 2026 ↗

obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain

Read in the 10-K filed Mar 2, 2026 ↗

rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal

Read in the 10-K filed Mar 2, 2026 ↗

for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state

Read in the 10-K filed Mar 2, 2026 ↗

laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018 (“CCPA”) applies to

Read in the 10-K filed Mar 2, 2026 ↗

personal data of consumers, business representatives, and employees who are California residents, and requires businesses to provide

Read in the 10-K filed Mar 2, 2026 ↗

specific disclosures in privacy notices and honor requests of such individuals to exercise certain privacy rights. The CCPA provides

Read in the 10-K filed Mar 2, 2026 ↗

Our use of AI/ML technologies may be subject to certain privacy obligations. Other laws governing certain data or sectors may

Read in the 10-K filed Mar 2, 2026 ↗

apply to our operations. We may be unable to transfer personal data from Europe and other jurisdictions to the United States or other

Read in the 10-K filed Mar 2, 2026 ↗

and policies related to data privacy and security, and our efforts to comply with such obligations may not be successful. We publish

Read in the 10-K filed Mar 2, 2026 ↗

privacy policies, marketing materials, whitepapers, and other statements, concerning data privacy, and security. Regulators in the

Read in the 10-K filed Mar 2, 2026 ↗

Obligations related to data privacy and security are quickly changing, becoming increasingly stringent, and creating uncertainty.

Read in the 10-K filed Mar 2, 2026 ↗

personal data on our behalf. We may at times fail (or perceived to have failed) in our efforts to comply with our data privacy and

Read in the 10-K filed Mar 2, 2026 ↗

whom we work with to comply with applicable data privacy and security obligations could subject us to litigation (including class

Read in the 10-K filed Mar 2, 2026 ↗

regulators; additional reporting requirements and/or oversight; bans or restrictions on processing personal data; and orders to destroy

Read in the 10-K filed Mar 2, 2026 ↗

•improper disclosure of data and violations of applicable data privacy and other laws; or

Read in the 10-K filed Mar 30, 2026 ↗

Attacks upon systems across a variety of industries, including industries related to Solana, are increasing in frequency, persistence, and sophistication, and, in many cases, are being conducted by sophisticated, well organized groups and individuals, including state actors. The techniques used to obtain unauthorized, improper or illegal access to systems and information (including personal data and digital assets), disable or degrade services, or sabotage systems are constantly evolving, may be difficult to detect quickly, and often are not recognized or detected until after they have been launched against a target. These attacks may occur on our systems or those of our third-party service providers or partners. We may experience breaches of our security measures due to human error, malfeasance, insider threats, system errors or vulnerabilities or other irregularities. In particular, we expect that unauthorized parties will attempt to gain access to our systems and facilities, as well as those of our partners and third-party service providers, through various means, such as hacking, social engineering, phishing and fraud. Threats can come from a variety of sources, including criminal hackers, hacktivists, state intrusions, industrial espionage, and insiders. In addition, certain types of attacks could harm us even if our systems are left undisturbed. For example, certain threats are designed to remain dormant or undetectable, sometimes for extended periods of time, or until launched against a target and we may not be able to implement adequate preventative measures. Further, there has been an increase in such activities due to the increase in remote work arrangements. The risk of cyberattacks could also be increased by

Read in the 10-K filed Mar 30, 2026 ↗

•Failure to comply with anti-corruption, privacy, export control, import, or sanctions laws could harm our

Read in the 10-K filed Mar 11, 2026 ↗

privacy and security obligations, indemnification, dispute resolution procedures and regulatory requirements. Agreement

Read in the 10-K filed Mar 11, 2026 ↗

cybersecurity and data privacy. We could also inherit unforeseen liabilities, credit or compliance issues, or adverse

Read in the 10-K filed Mar 11, 2026 ↗

incorporate privacy-enhancing features and may from time to time support additional digital assets with similar

Read in the 10-K filed Mar 11, 2026 ↗

functionalities. These privacy-enhancing digital assets obscure the identities of sender and receiver and may prevent law

Read in the 10-K filed Mar 11, 2026 ↗

Public AI failures, inadequate AI governance, recordkeeping or auditability failures, data privacy violations, intellectual

Read in the 10-K filed Mar 11, 2026 ↗

be subject to significant additional regulation and obligations, including the handling of substantial personal information of

Read in the 10-K filed Mar 11, 2026 ↗

collection, use, retention, security and transfer of the personal data of individuals in those jurisdictions. We may become

Read in the 10-K filed Mar 11, 2026 ↗

subject to GDPR and U.K. GDPR, which impose stringent privacy and data protection requirements, and could increase the

Read in the 10-K filed Mar 11, 2026 ↗

GDPR (covering the European Economic Area), U.K. GDPR and Swiss data protection regimes impose strict rules on the

Read in the 10-K filed Mar 11, 2026 ↗

transfer of personal data out of the EU, U.K. or Switzerland to a “third country,” including to the United States. As an un-

Read in the 10-K filed Mar 11, 2026 ↗

hosted self-custody wallet provider, we do not process the personal data of our customers and therefore, compliance with

Read in the 10-K filed Mar 11, 2026 ↗

GDPR or U.K. GDPR in the future could further add to our compliance costs, limit how we process information, or lead to

Read in the 10-K filed Mar 11, 2026 ↗

the GDPR or U.K. GDPR, we may be subject to fines. We may also face civil claims, as well as associated costs, diversion

Read in the 10-K filed Mar 11, 2026 ↗

Aspects of the GDPR, U.K. GDPR, California Consumer Privacy Act, Swiss Secretariat for Economic Affairs and other

Read in the 10-K filed Mar 11, 2026 ↗

laws, regulations, industry standards and other obligations related to privacy, data protection and data security remain

Read in the 10-K filed Mar 11, 2026 ↗

Our efforts to comply with applicable laws, regulations and other obligations relating to privacy, data protection, and

Read in the 10-K filed Mar 11, 2026 ↗

standards relating to privacy and data protection in various jurisdictions, and we cannot determine the impact such laws,

Read in the 10-K filed Mar 11, 2026 ↗

improper disclosure of data and violations of applicable data privacy and other laws; or

Read in the 10-K filed Dec 11, 2025 ↗

Attacks upon systems across a variety of industries, including industries related to Solana, are increasing in frequency, persistence, and sophistication, and, in many cases, are being conducted by sophisticated, well-organized groups and individuals, including state actors. The techniques used to obtain unauthorized, improper or illegal access to systems and information (including personal data and digital assets), disable or degrade services, or sabotage systems are constantly evolving, may be difficult to detect quickly, and often are not recognized or detected until after they have been launched against a target. These attacks may occur on our systems or those of our third-party service providers or partners. We may experience breaches of our security measures due to human error, malfeasance, insider threats, system errors or vulnerabilities or other irregularities. In particular, we expect that unauthorized parties will attempt to gain access to our systems and facilities, as well as those of our partners and third-party service providers, through various means, such as hacking, social engineering, phishing and fraud. Threats can come from a variety of sources, including criminal hackers, hacktivists, state intrusions, industrial espionage, and insiders. In addition, certain types of attacks could harm us even if our systems are left undisturbed. For example, certain threats are designed to remain dormant or undetectable, sometimes for extended periods of time, or until launched against a target and we may not be able to implement adequate preventative measures. The risk of cyberattacks could also be increased by cyberwarfare in connection with the ongoing Russia and Israel conflicts, or other future conflicts, including potential proliferation of malware into systems unrelated to such conflicts. Any future breach of our operations or those of others in the Solana industry, including third-party services on which we rely, could materially and adversely affect our financial condition and results of operations.

Read in the 10-K filed Dec 11, 2025 ↗

In the ordinary course of our business, we and the third parties with whom we work, collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, process) proprietary, confidential, and sensitive data, including personal data (such as health-related data), intellectual property,

Read in the 10-K filed Mar 31, 2026 ↗

We rely on third parties to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, employee email, content delivery to customers, and other functions. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. If the third parties with whom we work experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if the third parties with whom we work fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award.

Read in the 10-K filed Mar 31, 2026 ↗

improper disclosure of data and violations of applicable data privacy and other laws; or

Read in the 10-K filed Mar 31, 2026 ↗

We and the third parties with whom we work are subject to stringent and evolving U.S. and foreign laws, regulations, rules, and industry standards, as well as policies, contracts and other obligations related to data privacy and security. Our (or the third parties with whom we work) actual or perceived failure to comply with such obligations could lead to enforcement or litigation (including class claims) and mass arbitration demands, fines or penalties, a disruption of clinical trials or commercialization of products, reputational harm, or other adverse business effects.

Read in the 10-K filed Mar 31, 2026 ↗

In the ordinary course of business, we process sensitive information. Accordingly, we are, and may in the future become, subject to numerous data privacy and security obligations, such as various federal, state, local and foreign data privacy and security laws, regulations, guidance, and industry standards as well as external and internal privacy and security policies, contracts and other obligations that apply to data privacy and security and our processing of personal data and the processing of personal data on our behalf.

Read in the 10-K filed Mar 31, 2026 ↗

In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act) and other similar laws (e.g., wiretapping laws). For example, the federal Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), as amended by the Health Information Technology for Economic and Clinical Health Act (“HITECH”), and their respective implementing regulations, imposes requirements relating to the privacy, security and transmission of individually identifiable health information. Among other things, HITECH, through its implementing regulations, makes certain of HIPAA’s privacy and security standards directly applicable to business associates, defined as a person or organization, other than a member of a covered entity’s workforce, that creates, receives, maintains or transmits protected health information for or on behalf of a covered entity for a function or activity regulated by HIPAA as well as their covered subcontractors.

Read in the 10-K filed Mar 31, 2026 ↗

In the past few years, numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018 (“CCPA”), applies to personal data of consumers, business representatives, and employees who are California residents, and requires covered companies to provide specific disclosures in privacy notices and honor requests of such individuals to exercise certain privacy rights. The CCPA provides for fines and allows private litigants affected by certain data breaches to recover significant statutory damages. The CCPA and other comprehensive U.S. state privacy laws exempt some data processed in the context of clinical trials, but these developments may further complicate compliance efforts, and increase legal risk and compliance costs for us and the third parties with whom we work. Such laws, if they become applicable to us in the future, may significantly impact our business activities, exemplifying the vulnerability of our business to evolving regulatory environment related to personal data and protected health information. Similar laws are being considered in other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future.

Read in the 10-K filed Mar 31, 2026 ↗

Outside the United States, an increasing number of laws, regulations and industry standards govern privacy, data protection, information security and cross-border personal data transfers. For example, the European Union’s General Data Protection Regulation (“EU GDPR”) and the United Kingdom’s GDPR (“UK GDPR”) (collectively, “GDPR”) impose strict requirements for processing personal data. Under the GDPR, companies may face temporary or definitive bans on data processing and other corrective actions; fines of up to €20,000,000 under the EU GDPR / 17.5 million pounds sterling under the UK GDPR, or up to 4% annual total revenue, in each case, whichever is greater; or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests.

Read in the 10-K filed Mar 31, 2026 ↗

In the ordinary course of business, we transfer personal data from Europe and other jurisdictions to the United States or other countries. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries. In particular, the European Economic Area (“EEA”) and the United Kingdom (“UK”) have significantly restricted the transfer of personal data to the United States and other countries whose privacy laws it generally believes are inadequate. Some jurisdictions have adopted, and others may in the future adopt, similarly stringent data localization and cross-border data transfer laws. Although there are currently various mechanisms that may be used to transfer personal data from the EEA and UK to the United States in compliance with law, such as the EEA and UK’s standard contractual clauses, the UK’s International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework and the UK extension thereto (which allows for transfers for relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States. If there is no lawful manner for us to transfer personal data from the EEA, UK, or other jurisdictions to the United States, or if the requirements for a legally-compliant transfer are too onerous, we may face significant adverse consequences, including the interruption or degradation of our operations (such as by limiting our ability to conduct clinical trial activities in Europe and elsewhere), the need to relocate part of or all of our business or data processing activities to other jurisdictions (such as Europe) at significant expense, the inability to transfer data and work with partners, vendors and other third parties, increased exposure to regulatory actions, substantial fines and penalties, and injunctions against processing or transferring personal data necessary to operate our business. Additionally, companies that transfer personal data out of the EEA and UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups. Some European regulators have also ordered certain companies to suspend or permanently cease certain transfers out of Europe for allegedly violating the GDPR’s cross-border data transfer limitations.

Read in the 10-K filed Mar 31, 2026 ↗

Additionally, the U.S. Department of Justice issued a rule entitled the Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons, which places additional restriction on certain data transactions involving countries of concern (e.g., China, Russia, Iran) and covered persons (i.e., individuals and entities who are designated as such by the U.S. Attorney General or considered “foreign persons” and are majority owned by, organized under the laws of, a primary resident in, or a contractor of, a covered person or country of concern, as

Read in the 10-K filed Mar 31, 2026 ↗

In addition, privacy advocates and industry groups have proposed, and may in the future propose, standards with which we are legally or contractually bound to comply. We are also bound by contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful. We publish privacy notices and other statements regarding data privacy and security. Regulators in the United States are increasingly scrutinizing these statements, and if any of our privacy notices or related materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, misleading, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators or other adverse consequences.

Read in the 10-K filed Mar 31, 2026 ↗

Furthermore, our employees and personnel may use generative artificial intelligence (“AI”) technologies to perform their work, and the disclosure and use of personal data in such technologies is subject to various privacy laws and other privacy obligations. Governments have passed and are likely to pass additional laws and regulations regulating generative AI. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits. If we are unable to use AI technologies, it could make our business less efficient and result in competitive disadvantages.

Read in the 10-K filed Mar 31, 2026 ↗

Obligations related to data privacy and security (including individuals’ data privacy expectations) are quickly changing, becoming increasingly stringent, and creating uncertainty. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. As a result, preparing for and complying with these obligations requires significant resources and may necessitate changes to our information technologies, systems and practices, as well as those of any third parties that process personal data on our behalf.

Read in the 10-K filed Mar 31, 2026 ↗

Although we endeavor to comply with our applicable privacy and security obligations, we may at times fail (or be perceived to have failed) to do so. Moreover, despite our efforts, we may not be successful in achieving compliance if our employees, third-party collaborators, service providers, contractors or consultants fail to comply with such obligations, which could negatively impact our business operations and compliance posture. If we or the third parties with whom we work fail, or are perceived to have failed, to address or comply with applicable obligations related to data privacy and security, we could face significant consequences including, but not limited to, government enforcement actions (e.g., investigations, fines, penalties, audits and inspections, and similar); litigation (including class-related claims) and mass arbitration demands; additional reporting requirements and/or oversight; temporary or permanent bans or restrictions on all or some processing of personal data; orders to destroy or not use personal data; and imprisonment of company officials. In particular, plaintiffs have become increasingly more active in bringing privacy-related claims against companies, including class claims and mass arbitration demands. Some of these claims allow for the recovery of statutory damages on a per violation basis, and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the number of violations. Any of these events could have a material adverse effect on our reputation, business, or financial condition, including but not limited to: interruptions or stoppages in our business operations (including clinical trials); inability to process personal data or to operate in certain jurisdictions; limited ability to develop or commercialize our products; expenditure of time and resources to defend any claim or inquiry; adverse publicity; or substantial changes to our business model or operations.

Read in the 10-K filed Mar 31, 2026 ↗

The Hyperliquid blockchain, exchange and related products launched in early 2023, and the HYPE token launched in November 2024. When we refer to HYPE, we are referring to HYPE tokens and liquid staking tokens derived from HYPE tokens (“LSTs”). We also hold other digital assets. Hyperliquid is an early-stage project with a limited operating history. Developers, validators, traders and market makers may not adopt Hyperliquid’s technology, and we believe that Hyperliquid’s adoption will likely depend on significant platform and product development and differentiation in a highly competitive market. A failure to scale, unexpected technical flaws, privacy issues or the lack of engagement could materially reduce demand for HYPE and adversely affect its value.

Read in the 10-K filed Mar 30, 2026 ↗

The secure processing, storage, maintenance and transmission of this critical information is vital to our operations and business strategy, and we devote significant resources to protecting such information. Although we take measures to protect sensitive information from unauthorized access or disclosure, our information technology and infrastructure may be vulnerable to attacks by hackers or viruses, breaches, interruptions due to employee error, malfeasance, faulty password management, lapses in compliance with privacy and

Read in the 10-K filed Mar 30, 2026 ↗

We may incorporate the use of AI into our business, operations and offerings in ways which present opportunities as well as challenges and risks, particularly as AI can produce hallucinations and AI agents may take undesired actions, if used.AI systems or input data issues could present inaccurate information, privacy, reputational and other issues and liability. A number of jurisdictions have implemented (or will implement) AI-related laws which may adversely effect our business. For example, the EU AI Act, which has extra-territorial effect like the GDPR, imposes penalties up to the greater of: (i) €35 million; or (ii) 7% of an entire group's total annual worldwide turnover.

Read in the 10-K filed Sep 28, 2026 ↗

In addition to the provisions in certain international laws restricting the transfer of personal information to the United States, a new U.S. law also restricts the transfer of certain kinds of personal data in certain situations outside of the United States to “countries of concern,” including but not limited to China. On April 8, 2025, the U.S. Department of Justice’s National Security Division implemented the Data Security Program Rule under Executive Order 14117 and the International Emergency Economic Powers Act. This rule establishes restrictions on certain data-related transactions involving U.S. persons and entities, particularly those that may result in access to U.S. government-related data or bulk sensitive personal data of U.S. persons by foreign adversaries or entities under their control. The rule effectively imposes export control-like restrictions on the transfer, sale, or sharing of sensitive data-including genomic, geolocation, biometric, health, financial, and other personal data-to or with entities in countries of concern, as well as entities and persons associated with those countries. It also imposes additional due diligence obligations on U.S. companies concerning personal data they collect, store, or transmit. Failure to comply with the Data Security Program Rule could result in civil or criminal penalties, reputational harm, and restrictions on our ability to engage in certain business activities. Compliance may require us to modify our data handling practices, implement new controls, or terminate existing relationships with certain foreign vendors, customers, or partners. These changes could increase our operational costs, limit our market opportunities, and adversely affect our financial performance. Additionally, the scope and interpretation of the rule may evolve, and future guidance or enforcement actions could impose further obligations or restrictions.

Read in the 10-K filed Feb 19, 2026 ↗

We provide sponsors with data that identifies which institutional players are researching Bitcoin infrastructure. Stricter enforcement of GDPR or the UK Data Protection Act specifically regarding financial/crypto interest data could limit our ability to monetize our audience. If generative AI models can effectively aggregate and synthesize specialist Bitcoin technical knowledge, the scarcity value of our intellectual property may be impaired.

Read in the 10-K filed Mar 30, 2026 ↗

BTC Inc publishes news, opinions, analysis, and commentary about individuals, companies, projects, and developments in the Bitcoin and digital asset industry. This industry is characterized by intense competition, disputed claims, controversial personalities, and significant financial stakes, which increases the likelihood that subjects of our coverage may take issue with our reporting. We may face claims of defamation, libel, invasion of privacy, misappropriation, or other content-related torts from individuals or entities who believe they have been harmed by our coverage. Even if such claims are without merit, defending against them can be expensive, time-consuming, and distracting to management. Adverse judgments or settlements could result in significant monetary damages and injunctive relief that restricts our ability to report on certain topics or individuals. Additionally, the threat of litigation may cause us to exercise excessive caution in our reporting, which could diminish the value and relevance of our editorial content. Our media liability insurance may not cover all claims or may be insufficient to cover the full extent of any damages awarded. Any of these outcomes could have a material adverse effect on our business, financial condition, and reputation.

Read in the 10-K filed Mar 30, 2026 ↗

Security Incidents or loss of private keys could result in partial or total loss of our Bitcoin or loss, unavailability, destruction, alteration, prevention of access to, disclosure, or dissemination of, or damage or unauthorized access to, our data (including trade secrets or other confidential information, intellectual property, proprietary business information, and personal information) or data that is processed or maintained on our behalf, or other assets, which could result in financial, legal, business, and reputational harm to us.

Read in the 10-K filed Mar 30, 2026 ↗

Substantially all of our Bitcoin is held in custody accounts at institutional-grade digital asset custodians. Bitcoin and blockchain-based cryptocurrencies have been, and may continue to be, subject to Security Incidents and other malicious activities. While we have implemented security measures designed to protect against actual or reasonably suspected unauthorized access to, or use, acquisition, exfiltration, disclosure, alteration, loss, destruction, encryption, or other compromise of personal data, confidential information, or the confidentiality, integrity, or availability of our information technology systems, whether by external actors, insiders, or accidental events (collectively, “Security Incident(s)”), there can be no assurance that these measures will be effective in all circumstances. A successful Security Incident could result in: partial or total loss of our Bitcoin that may not be covered by insurance or custodial liability provisions; harm to our reputation and brand; improper disclosure of our and our customers’ data and violations of applicable data privacy laws; and significant regulatory scrutiny, investigations, fines, penalties, and other legal and financial exposure.

Read in the 10-K filed Mar 30, 2026 ↗

We are subject to HIPAA and other federal, state, and foreign data privacy and security laws, and failure to comply could result in significant liability and reputational harm.

Read in the 10-K filed Mar 30, 2026 ↗

We collect substantial amounts of personal health information subject to HIPAA and numerous other federal, state, and foreign data privacy and security laws. HIPAA establishes national privacy and security standards for the protection of protected health information (PHI) by covered entities and business associates. As a business associate under HIPAA, we are required to develop and maintain policies and procedures with respect to PHI, including administrative, physical, and technical safeguards. Violations of HIPAA may result in significant civil and criminal penalties, and state attorneys general may file suit on behalf of their residents. We are also subject to breach notification requirements under HIPAA, which require notification to affected individuals, HHS, and potentially the media depending on the scope of the breach.

Read in the 10-K filed Mar 30, 2026 ↗

There is also a risk that the third-party vendors that provide our data sets may fail to properly de-identify PHI under HIPAA or applicable state laws, some of which impose different standards for de-identification than those imposed by HIPAA. There is also a risk that clients and third-party vendors who are subject to HIPAA and interface with us may misunderstand the limits of our ability to conform to HIPAA, given our posture that we remain outside of the HIPAA regulation by virtue of de-identifying our data, and may inadvertently expose us to PHI that we need to then make efforts to excise from our systems. We are also required to ensure that such information remains de-identified, and our failure to do so could result in non-compliance with privacy laws and contractual obligations.

Read in the 10-K filed Mar 30, 2026 ↗

In addition to HIPAA, we are subject to the Federal Substance Abuse Confidentiality Regulations (42 C.F.R. Part 2), which impose confidentiality requirements on substance use disorder treatment records. Numerous other federal, state, and foreign laws protect the privacy, security, and integrity of health-related and personal information, many of which are more restrictive than HIPAA. These laws are subject to evolving interpretations and new regulations, and failure to comply could result in significant liabilities, government enforcement actions, and reputational harm. State attorneys general and the FTC actively enforce privacy requirements, and healthcare providers are also subject to information blocking prohibitions under the 21st Century Cures Act, with penalties up to $1,000,000 per violation.

Read in the 10-K filed Mar 30, 2026 ↗

We are subject to stringent and evolving U.S. and foreign data privacy and security laws, and failure to comply could result in regulatory investigations or actions; litigation (including class actions and mass arbitrations); fines and penalties; operational disruptions; reputational harm; loss of revenue or profits; and other significant adverse consequences.

Read in the 10-K filed Mar 30, 2026 ↗

In the ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, and otherwise handle personal data and other sensitive information, including PHI in connection with aspects of our healthcare operations. Our privacy and data security obligations include numerous federal, state, and foreign data privacy and security laws, including data breach notification laws, consumer protection laws, and comprehensive state privacy laws. These laws impose obligations including specific privacy notice disclosures, data subject rights (such as access, correction, and deletion rights), opt-out mechanisms for targeted advertising and profiling, and requirements for data privacy impact assessments. Complying with these obligations requires us to devote significant resources, which may necessitate changes to our services, information technologies, systems, and practices and to those of any third parties that process sensitive data on our behalf.

Read in the 10-K filed Mar 30, 2026 ↗

The regulatory landscape is constantly evolving and may be interpreted or applied in ways that harm our business. New or emerging regulatory frameworks addressing technologies such as AI, biometric data, or advanced analytics may further increase compliance complexity or restrict certain business practices. In addition, these laws, regulations, and other obligations may also be interpreted and applied inconsistently from jurisdiction to jurisdiction. Evolving enforcement priorities increase our risk profile. Federal and state regulators, including the FTC and state attorneys general, have pursued enforcement actions related to privacy disclosures, tracking technologies, sensitive data uses, security practices, breach response, and health-related data handled outside traditional HIPAA contexts. Adverse enforcement or private litigation outcomes could be material.

Read in the 10-K filed Mar 30, 2026 ↗

Certain of our websites and digital properties use advertising and analytics technologies (for example, cookies, pixels, tags, software development kits, and similar tools) that enable interest-based advertising and measurement. The deployment of these technologies has been the subject of increasing private litigation, including putative class actions and mass arbitrations alleging unauthorized disclosures or interception of communications, as well as claims under common-law privacy, wiretap, video privacy, and private nuisance theories. If our use of such technologies, or that of our service providers or partners, is found to be inconsistent with applicable laws, consents, or public statements, we could face injunctive relief, statutory damages, significant defense costs, and requirements to modify or discontinue certain practices.

Read in the 10-K filed Mar 30, 2026 ↗

Despite the security measures we implement, we have experienced, and expect to continue to experience, attempts to compromise our systems and those of our third parties. A Security Incident could result in unauthorized access to or loss of personal data, PHI, confidential information, or digital assets; service interruptions; theft or fraud; and other harm. We could incur substantial investigation, notification, remediation, and litigation costs; face regulatory inquiries and enforcement; suffer reputational damage; and experience revenue or client losses. The occurrence, frequency, and impact of these incidents are difficult to predict, and our insurance coverage may be inadequate to compensate for all losses.

Read in the 10-K filed Mar 30, 2026 ↗

We may at times fail (or be perceived to have failed) in our efforts to comply with our data privacy and security obligations. Moreover, despite our efforts, our personnel or third parties upon which we rely may fail to comply with such obligations, which could negatively impact our business operations. If we or the third parties with whom we work fail, or are perceived to have failed, to address or comply with applicable data privacy and security obligations, we could face significant consequences, including but not limited to: government enforcement actions (e.g., investigations, fines (including regulatory fines and sanctions), penalties, audits, inspections, and similar); litigation (including class-action claims and mass arbitration demands); additional reporting requirements and/or oversight; bans on processing personal data; and orders to destroy or not use personal data. Any of these events could have a material adverse effect on our reputation, business, or financial condition.

Read in the 10-K filed Mar 30, 2026 ↗

a partial or total loss of our ETH and ETH-related digital assets in a manner that may not be covered by insurance or the liability provisions of the custody agreements with the custodians who hold our ETH and ETH-related digital assets; harm to our reputation and brand; improper disclosure of data and violations of applicable data privacy and other laws; or significant regulatory scrutiny, investigations, fines, penalties, and other legal, regulatory, contractual and financial exposure.

Read in the 10-K filed Mar 9, 2026 ↗

Attacks upon systems across a variety of industries, including industries related to ETH, are increasing in frequency, persistence, and sophistication, and, in many cases, are being conducted by sophisticated, well-funded and organized groups and individuals, including state actors. The techniques used to obtain unauthorized, improper or illegal access to systems and information (including personal data and digital assets), disable or degrade services, or sabotage systems are constantly evolving, may be difficult to detect quickly, and often are not recognized or detected until after they have been launched against a target. These attacks may occur on our systems or those of our third-party service providers or partners. We may experience breaches of our security measures due to human error, malfeasance, insider threats, system errors or vulnerabilities or other irregularities. Threats can come from a variety of sources, including criminal hackers, hacktivists, state-sponsored intrusions, industrial espionage, and insiders. In addition, certain types of attacks could harm us even if our systems are left undisturbed. For example, certain threats are designed to remain dormant or undetectable, sometimes for extended periods of time, or until launched against a target and we may not be able to implement adequate preventative measures. The risk of cyberattacks could also be increased by cyberwarfare in connection with the ongoing Russia-Ukraine and Israel-Hamas conflicts, or other future conflicts, including potential proliferation of malware into systems unrelated to such conflicts. Any future breach of our operations or those of others in the ETH industry, including third-party services on which we rely, could materially and adversely affect our business.

Read in the 10-K filed Mar 9, 2026 ↗

To the extent the operation of our systems relies on our third-party service providers, through either a connection to, or an integration with, third parties’ systems, the risk of cybersecurity attacks and loss, corruption, or unauthorized access to or publication of our information or the confidential information and personal data of customers and employees may increase. Third-party risks may include insufficient security measures, data location uncertainty, and the possibility of data storage in inappropriate jurisdictions where laws, security measures or other controls may be inadequate or in which there are uncertainties regarding governmental intervention and use of such data, and our ability to monitor our third-party service providers’ data security practices are limited. Although we generally have agreements relating to cybersecurity and data privacy in place with our third-party service providers, they are limited in nature and we cannot guarantee that such agreements will prevent the accidental or unauthorized access to or disclosure, loss, destruction, disablement or encryption of, use or misuse of or modification of data (including personal data) or enable us to obtain adequate or any reimbursement from our third-party service providers in the event we should suffer any such incidents. Due to applicable laws and regulations or contractual obligations, we may be held responsible for any information security failure or cybersecurity attack attributed to our vendors as they relate to the information we share with them. A vulnerability in or related to a third-party service provider’s software or systems, a failure of our third-party service providers’ safeguards, policies or procedures, or a breach of a third-party service provider’s software or systems could result in the compromise of the confidentiality, integrity or availability of our systems or the data housed in our third-party solutions.

Read in the 10-K filed Mar 9, 2026 ↗

The security of the information and technology systems used by us and our service providers may continue to be subjected to cybersecurity threats that could result in material failures or disruptions in our business. If these systems are compromised, become inoperable for extended periods of time or cease to function properly, we or a service provider may have to make a significant investment to fix or replace them. The failure of these systems or of disaster recovery plans for any reason could cause significant interruptions in operations and result in a failure to maintain the security, confidentiality or privacy of sensitive data, including personal information relating to stockholders (and the beneficial owners of stockholders). Such a failure could harm our reputation, subject us to legal claims and otherwise materially and adversely affect our investment and trading strategies and our value.

Read in the 10-K filed Mar 9, 2026 ↗

improper disclosure of data and violations of applicable data privacy and other laws; or

Read in the 10-K filed Feb 27, 2026 ↗

Attacks upon systems across a variety of industries, including industries related to SUI, are increasing in frequency, persistence, and sophistication, and, in many cases, are being conducted by sophisticated, well-funded and organized groups and individuals, including state actors. The techniques used to obtain unauthorized, improper or illegal access to systems and information (including personal data and digital assets), disable or degrade services, or sabotage systems are constantly evolving, may be difficult to detect quickly, and often are not recognized or detected until after they have been launched against a target. These attacks may occur on our systems or those of our third-party service providers or partners. We may experience breaches of our security measures due to human error, malfeasance, insider threats, system errors or vulnerabilities or other irregularities. In particular, we expect that unauthorized parties will attempt to gain access to our systems and facilities, as well as those of our partners and third-party service providers, through various means, such as hacking, social engineering, phishing and fraud. Threats can come from a variety of sources, including criminal hackers, hacktivists, state-sponsored intrusions, industrial espionage, and insiders. In addition, certain types of attacks could harm us even if our systems are left undisturbed. For example, certain threats are designed to remain dormant or undetectable, sometimes for extended periods of time, or until launched against a target and we may not be able to implement adequate preventative measures. Further, there has been an increase in such activities due to the increase in work-from-home arrangements. The risk of cyberattacks could also be increased by cyberwarfare in connection with the ongoing Russia-Ukraine and Israel-Hamas conflicts, or other future conflicts, including potential proliferation of malware into systems unrelated to such conflicts. Any future breach of our operations or those of others in the Sui industry, including third-party services on which we rely, could materially adversely affect our financial condition and results of operations.

Read in the 10-K filed Feb 27, 2026 ↗

We may use generative artificial intelligence and/or machine learning (collectively, “AI”) tools in our operations. If our peers use AI tools to optimize operations and we fail to utilize AI tools in a comparable manner, we may be competitively disadvantaged. However, while AI tools may facilitate optimization and operational efficiencies, they also have the potential for inaccuracy, bias, infringement or misappropriation of intellectual property, and risks related to data privacy and cybersecurity. The use of AI tools may introduce errors or inadequacies that are not easily detectable, including deficiencies, inaccuracies or biases in the data used for AI training, or in the content, analyses or recommendations generated by AI applications. The results of such errors or inadequacies may adversely affect our business, financial condition and results of operations. The legal requirements relating to AI continue to evolve and remain uncertain, including how legal developments could impact our business and ability to enforce our proprietary rights or protect against infringement of those rights. Cybersecurity threat actors may utilize AI tools to automate and enhance cybersecurity attacks against us. The integration of AI tools in the digital asset industry may present significant opportunities and risks for our vendors, investors or contract counterparties, similar to those risks described above.

Read in the 10-K filed Feb 27, 2026 ↗

a partial or total loss of our TRX tokens; harm to our reputation and brand; improper disclosure of data and violations of applicable data privacy and other laws; or significant regulatory scrutiny, investigations, fines, penalties, and other legal, regulatory, contractual and financial exposure.

Read in the 10-K filed Mar 25, 2026 ↗

Attacks upon systems across a variety of industries are increasing in frequency, persistence, and sophistication, and, in many cases, are being conducted by sophisticated, well-funded and organized groups and individuals, including state actors. The techniques used to obtain unauthorized, improper or illegal access to systems and information (including personal data and digital assets), disable or degrade services, or sabotage systems are constantly evolving, may be difficult to detect quickly, and often are not recognized or detected until after they have been launched against a target. These attacks may occur on our systems or those of our third-party service providers or partners. We may experience breaches of our security measures due to human error, malfeasance, insider threats, system errors or vulnerabilities or other irregularities. In particular, unauthorized parties have attempted, and we expect that they will continue to attempt, to gain access to our systems and facilities, as well as those of our partners and third-party service providers, through various means, such as hacking, social engineering, phishing and fraud. In the past, hackers have successfully employed a social engineering attack against one of our service providers and misappropriated our digital assets, although, to date, such events have not been material to our financial condition or operating results. Threats can come from a variety of sources, including criminal hackers, hacktivists, state-sponsored intrusions, industrial espionage, and insiders. In addition, certain types of attacks could harm us even if our systems are left undisturbed. For example, certain threats are designed to remain dormant or undetectable, sometimes for extended periods of time, or until launched against a target and we may not be able to implement adequate preventative measures. Further, there has been an increase in such activities due to the increase in work-from-home arrangements since the onset of the COVID-19 pandemic. The risk of cyberattacks could also be increased by cyberwarfare in connection with the ongoing Russia-Ukraine and Israel-Hamas conflicts, or other future conflicts, including potential proliferation of malware into systems unrelated to such conflicts. Any future breach of our operations or those of others in the digital asset industry, including third-party services on which we rely, could materially and adversely affect our business.

Read in the 10-K filed Mar 25, 2026 ↗

Furthermore, on July 10, 2021, the CAC issued a revised draft of the Measures for Cybersecurity Review for public comment, which required that, among others, in addition to any “operator of critical information infrastructure”, any “data processor” controlling personal information of no less than one million users which seeks to list in a foreign stock exchange should also be subject to cybersecurity review, and further elaborated the factors to be considered when assessing the national security risks of the relevant activities. On December 28, 2021, the CAC, the National Development and Reform Commission (“NDRC”), and several other administrations jointly issued the revised Measures for Cybersecurity Review, which became effective and replaced the existing Measures for Cybersecurity Review on February 15, 2022. According to the Revised Review Measures, if an “online platform operator” that is in possession of personal data of more than one million users intends to list in a foreign country, it must apply for a cybersecurity review. Based on a set of Q&A published on the official website of the State Cipher Code Administration in connection with the issuance of the Revised Review Measures, an official of the said administration indicated that an online platform operator should apply for a cybersecurity review prior to the submission of its listing application with non-PRC securities regulators. Moreover, the CAC released the draft of the Regulations on Network Data Security Management in November 2021 for public consultation, which among other things, stipulates that a data processor listed overseas must conduct an annual data security review by itself or by engaging a data security service provider and submit the annual data security review report for a given year to the municipal cybersecurity department before January 31 of the following year. Given the recency of the issuance of the Revised Review Measures and their pending effectiveness, there is a general lack of guidance and substantial uncertainties exist with respect to their interpretation and implementation. It remains unclear whether a Hong Kong company which collects personal information from PRC individuals shall be subject to the Revised Review Measures. We do not currently expect the Revised Review Measures to have an impact on our business, our operations or our offerings as we do not believe that our subsidiary would be deemed to be an “operator of critical information infrastructure” or a “data processor” controlling personal information of no less than one million users, that would be required to file for cybersecurity review before listing in the U.S.. However, there remains uncertainty in the interpretation and enforcement of relevant PRC cybersecurity laws and regulations. If the Revised Review Measures are adopted into law in the future and if our subsidiary is deemed to be an “operator of critical information infrastructure” or a “data processor” controlling personal information of no less than one million users, our operation and the listing of our Common Stock or other securities in the U.S. could be subject to CAC’s cybersecurity review.

Read in the 10-K filed Mar 25, 2026 ↗