China Pharma Holdings (CPHI) Risk Factors

Our operating subsidiary, Helpson, is incorporated under the laws of the PRC and substantially all of our assets are located in the PRC. Additionally, substantially all of our directors, executive officers and managers reside within the PRC, and substantially all assets of these persons are located within the PRC. As a result, it may not be possible to effect service of process within the United States or elsewhere outside the PRC upon certain of our directors, executive officers or managers, including with respect to matters arising under U.S. federal securities laws or applicable state securities laws. Moreover, the PRC does not have treaties providing for the reciprocal recognition and enforcement of judgments of courts with the United States, and many other countries. As a result, recognition and enforcement in the PRC of judgments of a court in the United States and any of the other jurisdictions in relation to any matter may be difficult or impossible. Furthermore, an original action may be brought in the PRC against us, our directors, executive officers or managers only if the actions are not required to be arbitrated by PRC law under Helpson's articles of association, and only if the facts alleged in the complaint give rise to a cause of action under PRC law. In connection with any such original action, a PRC court may impose civil liability, including monetary damages.

Under the new EIT law and its implementation rules, to the extent that we are considered a "resident enterprise" which is "domiciled" in China, PRC income tax at the rate of 10% is applicable to dividends payable by us to investors that are "non-resident enterprises" so long as such "non-resident enterprise" investors do not have an establishment or place of business in China or, despite the existence of such establishment or place of business in China, the relevant income is not effectively connected with such establishment or place of business in China. Similarly, any gain realized on the transfer of our shares by such investors is also subject to a 10% PRC income tax if such gain is regarded as income derived from sources within China and we are considered a "resident enterprise" which is domiciled in China for tax purposes. Additionally, there is a possibility that the relevant PRC tax authorities may take the view that our purpose is that of a holding company, and the capital gain derived by our overseas stockholders would be deemed China-sourced income, in which case such capital gain may be subject to PRC withholding tax at the rate of up to 10%. If we are required under the new EIT law to withhold PRC income tax on our dividends payable to our foreign stockholders who are "non-resident enterprises", or if you are required to pay PRC income tax on the transfer of our shares under the circumstances mentioned above, the value of your investment in our shares may be materially and adversely affected.

China has implemented or will implement rules and is considering a number of additional proposals relating to data protection. China's new Data Security Law took effect in September 2021. The Data Security Law provides that the data processing activities must be conducted based on "data classification and hierarchical protection system" for the purpose of data protection and prohibits entities in China from transferring data stored in China to foreign law enforcement agencies or judicial authorities without prior approval by the Chinese government. Additionally, China's Cyber Security Law requires companies to take certain organizational, technical and administrative measures and other necessary measures to ensure the security of their networks and data stored on their networks. Specifically, the Cyber Security Law provides that China adopt a multi-level protection scheme (MLPS), under which network operators are required to perform obligations of security protection to ensure that the network is free from interference, disruption or unauthorized access, and prevent network data from being disclosed, stolen or tampered. Under the MLPS, entities operating information systems must have a thorough assessment of the risks and the conditions of their information and network systems to determine the level to which the entity's information and network systems belong-from the lowest Level 1 to the highest Level 5 pursuant to a series of national standards on the grading and implementation of the classified protection of cyber security. The grading result will determine the set of security protection obligations that entities must comply with. Entities classified as Level 2 or above should report the grade to the relevant government authority for examination and approval. The Company's management believes that they are currently classified as Level 1. Recently, the Cyberspace Administration of China has taken action against several Chinese internet companies in connection with their initial public offerings on U.S. securities exchanges, for alleged national security risks and improper collection and use of the personal information of Chinese data subjects. According to the official announcement, the action was initiated based on the National Security Law, the Cyber Security Law and the Measures on Cybersecurity Review, which are aimed at "preventing national data security risks, maintaining national security and safeguarding public interests." It is unclear at the present time how widespread the cybersecurity review requirement and the enforcement action will be and what effect they will have on our business. China's regulators may impose penalties for non-compliance ranging from fines or suspension of operations, and this could lead to us delisting from the U.S. stock market. Also, recently, the National People's Congress released the Personal Information Protection Law (the "PIPL"), which became effective on November 1, 2021. The PIPL creates a comprehensive set of data privacy and protection requirements that apply to the processing of personal information and expands data protection compliance obligations to cover the processing of personal information of persons by organizations and individuals in China, and the processing of personal information of persons in China outside of China if such processing is for purposes of providing products and services to, or analyzing and evaluating the behavior of, persons in China. The PIPL also provides that critical information infrastructure operators and personal information processing entities who process personal information meeting a volume threshold to-be-set by Chinese cyberspace regulators are also required to store in China personal information generated or collected in China, and to pass a security assessment administered by Chinese cyberspace regulators for any export of such personal information. Lastly, the PIPL provides significant fines for serious violations of up to RMB 50 million or 5% of annual revenues from the prior year and may also be ordered to suspend any related activity by competent authorities. On December 28, 2021, the CAC, and other twelve PRC regulatory authorities jointly revised and promulgated the Measures for Cyber Security Review, or the New Measures for Cyber Security Review, which came into effect on February 15, 2022 and replace the prior Measures for Cyber Security Review promulgated on April 13, 2020. The New Measures for Cyber Security Review provides that, among others, (i) the purchase of cyber products and services by critical information infrastructure operators and the network platform operators engaging in data processing activities that affects or may affect national security should be subject to the cybersecurity review by the Cybersecurity Review Office, the department which is responsible for the implementation of cybersecurity review under the CAC; (ii) network platform operators with personal information data of more than one million users are obliged to apply for a cybersecurity review by the Cybersecurity Review Office before listing abroad; and (iii) relevant governmental authorities in the PRC may initiate cybersecurity review if they determine the relevant network products or services or data processing activities affect or may affect national security. We believe that we are not subject to cybersecurity review, since we (i) are not network platform operators engaging in data processing activities that affect or may affect national security; (ii) are not critical information infrastructure operators purchasing cyber products or services that affect or may affect national security; (iii) are not network platform operators with personal information data of more than one million users and do not need to obtain any permission or approval from the CAC in accordance with the New Measures for Cyber Security Review. However, as PRC governmental authorities have significant discretion in interpreting and implementing statutory provisions and there remains significant uncertainty in the interpretation and enforcement of relevant PRC cybersecurity laws and regulations, we cannot guarantee the PRC government will have the same analysis and application of law as we expect. In November 2021, the CAC released the Measures of Regulations on the Network Data Security Administration (Draft for Comments), or the Draft Regulations on Network Data Security. The Draft Regulations on Network Data Security define "data processors" as individuals or organizations that can make autonomous decisions regarding the purpose and the manner of their data processing activities such as data collection, storage, utilization, transmission, publication and deletion. In accordance with the Draft Regulations on Network Data Security, data processors shall apply for a cybersecurity review for certain activities, including, among other things, (i) the listing abroad of data processors that process the personal information of more than one million users; (ii) merger, reorganization or division of internet platform operators that have acquired a large number of data resources related to national security, economic development or public interests affects or may affect national security; (iii) listing in Hong Kong which affects or may affect national security; or (iv) any data processing activity that affects or may affect national security. However, there have been no clarifications from the relevant authorities as of the date of this annual report as to the standards for determining whether an activity is one that "affects or may affect national security." In addition, the Draft Regulations on Network Data Security requires that data processors that process "important data" or are listed overseas must conduct an annual data security assessment by itself or authorize a data security service provider to do so, and submit the assessment report of the preceding year to the municipal cybersecurity department by the end of January each year. As of the date of this annual report, the Draft Regulations on Network Data Security has not been formally adopted, and their respective provisions and anticipated adoption or effective date may be subject to change with substantial uncertainty. Many of the data- and data privacy-related laws and regulations are relatively new and certain concepts thereunder remain subject to interpretation by the regulators. If any data that we possess belongs to data categories that are or may become subject to heightened scrutiny, we may be required to adopt stricter measures for protection and management of such data. The Cybersecurity Review Measures and the Draft Regulations on Network Data Security remain unclear on whether the relevant requirements will be applicable to companies that, like us, are already listed in the United States. We cannot predict the impact of the Cybersecurity Review Measures and the Draft Regulations on Network Data Security, if any, at this stage, and we will closely monitor and assess any developments in the rule-making process. If the Cybersecurity Review Measures and the enacted version of the Draft Regulations on Network Data Security mandate clearance of cybersecurity review and other specific actions to be taken by issuers like us, we may face uncertainties as to whether these additional procedures can be completed by us timely, or at all, which may subject us to government enforcement actions and investigations, fines, penalties, suspension of our non-compliant operations, or removal of our app from the relevant application stores, and materially and adversely affect our business and results of operations. In general, compliance with the existing PRC laws and regulations, as well as additional laws and regulations that PRC legislative and regulatory bodies may enact in the future, related to cybersecurity, data security and personal information protection, may be costly and result in additional expenses to us, and subject us to negative publicity, which could harm our reputation and business operations. There are also uncertainties with respect to how such laws and regulations will be implemented and interpreted in practice. In light of the fact that laws and regulations on cybersecurity, data privacy and personal information protection are evolving and uncertainty remains with respect to their interpretation and implementation, we cannot guarantee that we will be able to maintain full compliance at all times, or that our existing user information protection system and technical measures will be considered sufficient. Any non-compliance or perceived non-compliance with these laws, regulations or policies may lead to warnings, fines, investigations, lawsuits, confiscation of illegal gains, revocation of licenses, cancelation of filings or listings, closedown of websites, removal of apps and suspension of downloads, price drops in our securities or even criminal liabilities against us by government agencies or other individuals.