FinVolution Group (FINV) Risk Factors

The PRC legal system is based on written statutes and prior court decisions have limited value as precedents. Since the PRC legal system continues to rapidly evolve, the interpretations of many laws, regulations and rules are not always uniform and enforcement of these laws, regulations and rules involves uncertainties. In particular, PRC laws and regulations concerning the online consumer finance industry are still developing and evolving. Although we have taken measures to comply with the laws and regulations that are applicable to our business operations, including the regulatory principles raised by the China Banking and Insurance Regulatory Commission, and avoid conducting any non-compliant activities under the applicable laws and regulations, such as providing guarantee to institutional funding partners or sharing borrowers' personal information with institutional funding partners directly, the PRC government authority may promulgate new laws and regulations regulating the online consumer finance industry in the future. We cannot assure you that our business operations would not be deemed to violate any new PRC laws or regulations relating to online consumer finance. Moreover, developments in the online consumer finance industry may lead to changes in PRC laws, regulations and policies or in the interpretation and application of existing laws, regulations and policies, which in turn may limit or restrict online consumer finance platforms like us and could materially and adversely affect our business and operations. From time to time, we may have to resort to administrative and court proceedings to enforce our legal rights. However, since PRC administrative and court authorities have significant discretion in interpreting and implementing statutory and contractual terms, it may be more difficult to evaluate the outcome of administrative and court proceedings and the level of legal protection we enjoy than in more developed legal systems. Furthermore, the PRC legal system is based in part on government policies and internal rules (some of which are not published in a timely manner or at all) that may have retroactive effect. As a result, we may not be aware of our violation of these policies and rules until sometime after the violation. Such uncertainties, including uncertainty over the scope and effect of our contractual, property (including intellectual property) and procedural rights, could materially and adversely affect our business and impede our ability to continue our operations. The PRC government has significant oversight over the conduct of our business and it has exerted more oversight over offerings that are conducted overseas and/or foreign investment in China-based issuers. Any such action could significantly limit or completely hinder our ability to offer or continue to offer securities to investors and cause the value of such securities to significantly decline or be worthless.

We are a holding company incorporated under the laws of the Cayman Islands and as such rely on dividends and other distributions on equity from our PRC subsidiaries to satisfy part of our liquidity requirements. Pursuant to the Enterprise Income Tax Law of the PRC, a withholding tax rate of 10% currently applies to dividends paid by a PRC "resident enterprise" to a foreign enterprise investor, unless any such foreign investor's jurisdiction of incorporation has a tax treaty with China that provides for preferential tax treatment. Pursuant to the Arrangement between the Mainland China and the Hong Kong Special Administrative Region for the Avoidance of Double Taxation and Tax Evasion on Income, and the Notice of the State Administration of Taxation on the Issues concerning the Application of the Dividend Clauses of Tax Agreements issued by the State Administration of Taxation, such withholding tax rate may be lowered to 5% if the PRC enterprise is at least 25% held by a Hong Kong enterprise for at least 12 consecutive months prior to distribution of the dividends and is determined by the PRC tax authority to have satisfied other conditions and requirements under the above arrangement and other applicable PRC laws. Furthermore, under the Administrative Measures for Non-Resident Enterprises to Enjoy Treatments under Tax Treaties, which became effective in August 2015, the non-resident enterprises shall determine whether they are qualified to enjoy the preferential tax treatment under the tax treaties and file their report and materials with the tax authorities. There are also other conditions for enjoying the reduced withholding tax rate according to other tax rules and regulations. See "Item 10. Additional Information-E. Taxation-People's Republic of China Taxation." We cannot assure you that our determination regarding our qualification to enjoy the preferential tax treatment will not be challenged by the PRC tax authority or we will be able to complete the necessary filings with the PRC tax authority and enjoy the preferential withholding tax rate of 5% under the arrangement with respect to dividends to be paid by our PRC subsidiaries to our Hong Kong subsidiaries.

The regulatory framework for the collection, use, safeguarding, sharing, transfer and other processing of data and personal information worldwide is rapidly evolving and is likely to remain uncertain for the foreseeable future. As the regulations regarding data protection, data security, cybersecurity and personal information protection are quickly evolving in China and globally, we may become subject to new laws and regulations applying to the solicitation, collection, processing or use of personal information that could affect how we store, process and share data of our borrowers. In particular, the PRC government has tightened the regulation of the storage, sharing, use, disclosure and protection of personal data and user data in recent years. PRC laws and regulations require internet service providers and other network operators to clearly state the authorized purpose, methods and scope of the collection and usage of personal data and obtain the consent of users for the processing of this personal data, as well as to establish user information protection systems with remedial measures. For details of these regulations, please refer to "Item 4. Information on the Company-B. Business Overview-Regulations in the PRC-Regulations Relating to Internet Companies-Regulations on internet security." On May 1, 2021, the Regulations on the Scope of Necessary Personal Information Collected by the Frequently Used Mobile Applications came into effect. See "Item 4. Information on the Company-B. Business Overview-Regulations in the PRC-Regulations Relating to Internet Companies-Regulations on internet security." In 2021, the Ministry of Industry and Information Technology and its local branch decided that our PPDai mobile application was collecting users' personal information in a non-compliance way. We had taken remedial measures in a timely manner and reported our rectification measures to the governmental authorities. The authorities did not take any further follow-up inquiries or investigations into the identified issues after our adoption of remedial measures. However, if the authorities identify any new non-compliance issues related to data protection or cybersecurity in the future, they may order us to make additional rectifications. If our remedial measures at that time are not satisfactory to them, we may be subject to government fines, penalties, suspension of our non-compliant operations, or removal of our app from application stores, which could materially and adversely affect our business and operating results. On August 20, 2021, the Standing Committee of the National People's Congress of China promulgated the Personal Information Protection Law, effective on November 1, 2021, which further details the general rules and principles on personal information processing and further increases the potential liability of personal information processor. See "Item 4. Information on the Company-B. Business Overview-Regulations in the PRC-Regulations on internet security." Our mobile apps and websites only collect user personal information that we believe is necessary to provide the corresponding services. We update our privacy policies from time to time to meet the latest regulatory requirements of the Cyberspace Administration of China and other authorities and adopt technical measures to protect data and ensure cybersecurity in a systematic way. Nonetheless, the Personal Information Protection Law raises the protection requirements for processing personal information, and many specific requirements of the Personal Information Protection Law remain to be clarified by the Cyberspace Administration of China, other regulatory authorities, and courts in practice. If the Cyberspace Administration of China or other governmental authorities deem us as collecting excessive personal information, including the sensitive personal information, that beyond the necessity to provide the corresponding services, we will have to make adjustments to our business practices to comply with the personal information protection laws and regulations. On November 14, 2021, the Cyberspace Administration of China released the Regulations on the Network Data Security (Draft for Comments). See "Item 4. Information on the Company-B. Business Overview-Regulations in the PRC-Regulations Relating to Internet Companies-Regulations on internet security." As of the date of this annual report, the draft regulations were released for public comment only, and their respective provisions and the anticipated adoption or effective date may be subject to change with substantial uncertainty. The Draft Data Security Regulations remain unclear on whether the requirements will be applicable to companies that have been listed in the United States, such as us. We cannot predict the impact of the Draft Data Security Regulations, if any, at this stage, and we will closely monitor and assess any development in the rule-making process. If the enacted versions of the Draft Data Security Regulations mandate clearance of cybersecurity review and other specific actions to be completed by China-based companies listed on a U.S. stock exchange, such as us, we face uncertainties as to whether such clearance can be timely obtained, or at all. On January 4, 2022, the Cyberspace Administration of China, the National Development and Reform Commission, the Ministry of Industry and Information Technology, and several other administrations jointly published the amended Measures for Cybersecurity Review, which became effective on February 15, 2022. The amended Measures for Cybersecurity Review further restates and expands the applicable scope of the cybersecurity review. See "Item 4. Information on the Company-B. Business Overview-Regulations in the PRC-Regulations Relating to Internet Companies-Regulations on internet security." As of the date of this annual report, we have not been involved in any formal investigations on cybersecurity review made by the Cyberspace Administration of China on such basis. In anticipation of the strengthened implementation of cybersecurity laws and regulations and the continued expansion of our business, we face potential risks if we are deemed as a critical information infrastructure operator, or if our data processing activities raise "national security" concern under the amended Measures for Cybersecurity Review. In such case, if we are not able to comply with the cybersecurity and network data security requirements in a timely manner, or at all, we may be subject to government enforcement actions and investigations, fines, penalties, suspension of our non-compliant operations, or removal of our app from the application stores, among other sanctions, which could materially and adversely affect our business and results of operations. In addition to the cybersecurity review, the Cyberspace Administration of China released the Regulations on the Network Data Security (Draft for Comments) requires that data processors processing "important data" or listed overseas shall conduct an annual data security assessment by itself or commission a data security service provider to do so and submit the assessment report of the preceding year to the municipal cybersecurity department by the end of January each year. If a final version of these draft regulations is adopted, we may be subject to review when conducting data processing activities and annual data security assessment and may face challenges in addressing its requirements and make necessary changes to our internal policies and practices in data processing. The regulatory authorities in China continue to monitor websites and apps in relation to the protection of personal information and data, privacy and information security, and may impose additional requirements from time to time. There are uncertainties as to the interpretation and application of laws in one jurisdiction which may be interpreted and applied in a manner inconsistent to another jurisdiction and may conflict with our current policies and practices or require changes to the features of our system. As a result, we cannot assure that our existing user information protection system and technical measures will be considered sufficient under all applicable laws and regulations. If we are unable to address any information protection concerns, any compromise of security that results in unauthorized disclosure or transfer of personal data, or to comply with the then applicable laws and regulations, we may incur additional costs and liability and result in governmental enforcement actions, litigation, fines and penalties or adverse publicity and could cause our borrowers and institutional partners to lose trust in us, which could have a material adverse effect on our business, results of operations, financial condition and prospects.

We may from time to time distribute rights to our shareholders, including rights to acquire our securities. However, we cannot make such rights available to you in the United States unless we register both the rights and the securities to which the rights relate under the Securities Act of 1933, as amended, or the Securities Act, or an exemption from the registration requirements is available. Under the deposit agreement, the depositary will not make rights available to you unless both the rights and the underlying securities to be distributed to ADS holders are either registered under the Securities Act or exempt from registration under the Securities Act. We are under no obligation to file a registration statement with respect to any such rights or securities or to endeavor to cause such a registration statement to be declared effective and we may not be able to establish a necessary exemption from registration under the Securities Act. Accordingly, you may be unable to participate in our rights offerings in the future and may experience dilution in your holdings.

We also face indirect technology, cybersecurity and operational risks relating to the third parties upon whom we rely to facilitate or enable our business activities, such as third-party online payment service providers who manage accounts for certain borrower and institutional funding partner funds. As a result of increasing consolidation and interdependence of technology systems, a technology failure, cyber-attack or other information or security breach that significantly compromises the systems of one entity could have a material impact on its counterparties. Although our agreements with third-party payment service providers provide that each party is responsible for the cybersecurity of its own systems, any cyber-attack, computer viruses, physical or electronic break-ins or similar disruptions of such third-party payment service providers could, among other things, adversely affect our ability to serve our users, and could even result in misappropriation of funds of our borrowers and institutional funding partners. If that were to occur, both we and third-party payment service providers could be held liable to borrowers and institutional funding partners who suffer losses from the misappropriation. Our business depends on third-party service providers to interact with potential borrowers and institutional funding partners, process large numbers of transactions and support the loan collection process, all of which involve the use and disclosure of personal information. Compliance with applicable data protection laws and regulations is a rigorous and time-intensive process. We have established a comprehensive administrative mechanism and standardized employee training system for stringent information security management, and we have received ISO 27001 Information Security Management System Certification, ISO 9001 Quality Management System Certification, and ISO 27701 Privacy Management System Certification. We have also been deploying innovative technologies to promote user data protection. For example, we are a member of the National Information Security Standardization Technical Committee, maintaining up to date knowledge and compliant regarding the latest cyber-security regulatory requirements. For credit assessment purposes, we collaborate with third-party data providers to obtain borrowers' credit and behavioral data, with their general consent. Although we require these providers to guarantee that data provided is lawfully collected and authorized, and that their collaboration with us complies with all applicable laws and regulations, we cannot assure you of strict compliance during the entire data collection, usage, storage, and processing process. To ensure compliance with regulatory requirements regarding "disconnecting direct connection," most of our data partners collaborate with a licensed credit reference agency to provide borrowers' personal credit information to us. The licensed credit reference agency undertakes that the products and service it provides to us is in compliance with applicable laws and regulations. If the licensed credit reference agency or any of our third-party data providers fails to comply with applicable data protection laws and regulations, our reputation could suffer and we could become subject to regulatory intervention. Furthermore, our collaboration with third-party data providers may subject us to significant civil or criminal penalties and negative publicity or result in the delayed or halted processing of personal data that we need to undertake to carry on our business, which could have a material adverse effect on our business, financial condition and results of operations. See "-Cyber-attacks, computer viruses, physical or electronic break-ins or similar disruptions of us or of a third party could result in disclosure or misuse of confidential information and misappropriation of funds of our borrowers and institutional funding partners, subject us to liabilities, cause reputational harm and adversely impact our results of operations and financial condition."

Our business operations depend on the continued services of our senior management, particularly the executive officers named in this annual report. While we have provided different incentives to our management, we cannot assure you that we can continue to retain their services. For example, our former chief executive officer, Mr. Feng Zhang, resigned in March 2023 due to personal reasons, and our board of directors appointed Mr. Tiezheng Li, the then vice chairman of our board and president, to assume the position of chief executive officer. If any additional key executives were unable or unwilling to continue in their present positions, we may not be able to replace them easily or at all, our future growth may be constrained, our business may be severely disrupted and our financial condition and results of operations may be materially and adversely affected, and we may incur additional expenses to recruit, train and retain qualified personnel. In addition, although we have entered into confidentiality and non-competition agreements with our management, there is no assurance that any member of our management team will not join our competitors or form a competing business. If any dispute arises between our current or former officers and us, we may have to incur substantial costs and expenses in order to enforce such agreements or we may be unable to enforce them at all.

We earn a substantial majority of our revenues from the service fees that we collect from institutional funding partners or third-party guarantee companies on loans facilitated through our platforms, as well as the fees that we charge borrowers as guarantee fees. The fee rates may vary among different business models and third-party guarantee companies or institutional funding partners. Any material reduction in our fee rates could have a significant adverse effect on our business, results of operations and financial condition.

We have devoted significant resources to, and will continue to emphasize on, upgrading and marketing our existing products and services and enhancing their market awareness. We also incur expenses and expend resources upfront to develop, acquire and market new products and services that incorporate additional features, improve functionality or otherwise make our platforms more desirable to borrowers and institutional funding partners. New products and services must achieve high levels of market acceptance in order for us to recoup our investment in developing, acquiring and bringing them to market. Our existing and new products and services could fail to attain sufficient market acceptance for many reasons, including: -   borrowers may not find terms of our products, such as costs and credit limit, competitive or appealing;-   our failure to predict market demand accurately and provide products and services that meet this demand in a timely fashion;-   borrowers and institutional funding partners using our platforms may not like, find useful or agree with, any changes;-   defects, errors or failures on our platforms;-   negative publicity about our loan products or our platforms' performance or effectiveness;-   views taken by regulatory authorities that the new products, services or platform changes do not comply with laws, regulations or rules applicable to us; and -   the introduction or anticipated introduction of competing products by our competitors. If our existing and new products and services do not achieve adequate acceptance in the market, our competitive position, results of operations and financial condition could be harmed.

We are subject to the risk of fraudulent activity both on our platforms and associated with borrowers, institutional funding partners and other third parties handling borrower information. Our resources, technologies and fraud detection tools may be insufficient to accurately detect and prevent fraud. Significant increases in fraudulent activity could negatively impact our brand and reputation, result in losses suffered by the institutional funding partners, reduce the volume of loans facilitated through our platforms and lead us to take additional steps to reduce fraud risk, which could increase our costs and expenses. High profile fraudulent activity could even lead to regulatory intervention, and may divert our management's attention and cause us to incur additional expenses and costs. If any of the foregoing were to occur, our results of operations and financial condition could be materially and adversely affected.

We believe that developing and maintaining awareness of our brand effectively is critical to attracting new and retaining existing borrowers and institutional funding partners to our platforms. This depends largely on the effectiveness of our marketing efforts and the success of the channels we use to promote our platforms. If any of our current marketing channels become less effective, if we are unable to continue to use any of these channels, if the cost of using these channels were to significantly increase or if we are not successful in generating new channels, we may not be able to attract new borrowers and institutional funding partners in a cost-effective manner or convert potential borrowers and institutional funding partners into active borrowers and institutional funding partners on our platforms. Our efforts to build our brand have caused us to incur significant expenses, and it is likely that our future marketing efforts will require us to incur significant additional expenses. These efforts may not result in increased revenues in the immediate future or at all and, even if they do, any increases in revenues may not offset the expenses incurred. If we fail to successfully promote and maintain our brand while incurring substantial expenses, our results of operations and financial condition would be adversely affected, which may impair our ability to grow our business.

The overwhelming majority of our operations are located in China. Accordingly, our business, prospects, financial condition and results of operations may be influenced to a significant degree by political, economic and social conditions in China generally and by continued economic growth in China as a whole. The Chinese economy differs from the economies of most developed countries in many respects, including the degree of government involvement, level of development, growth rate, control of foreign exchange and allocation of resources. Although the Chinese government has implemented measures emphasizing the utilization of market forces for economic reform, the reduction of state ownership of productive assets and the establishment of improved corporate governance in business enterprises, a substantial portion of productive assets in China are still owned or controlled by the government. In addition, the Chinese government continues to play a significant role in regulating industry development by imposing industrial policies. The Chinese government also exercises significant control over China's economic growth through allocating resources, controlling payment of foreign currency-denominated obligations, setting monetary policy, and providing preferential treatment to particular industries or companies. While the Chinese economy has experienced significant growth over the past decades, the growth rate has gradually slowed since 2010, and growth has been uneven, both geographically and among various sectors of the economy. The Chinese government has implemented various measures to encourage economic growth and guide the allocation of resources. Some of these measures may benefit the overall Chinese economy, but may have a negative effect on us. For example, our financial condition and results of operations may be adversely affected by government control over capital investments or changes in tax regulations. Any prolonged slowdown in the Chinese economy may reduce the demand for our products and services and materially and adversely affect our business and results of operations.

The conversion of Renminbi into other currencies, including U.S. dollars, is based on rates set by the People's Bank of China. The Renminbi has fluctuated against the U.S. dollar, at times significantly and unpredictably. The value of Renminbi against the U.S. dollar and other currencies is affected by changes in China's political and economic conditions and by China's foreign exchange policies, among other things. We cannot assure you that Renminbi will not appreciate or depreciate significantly in value against the U.S. dollar in the future. It is difficult to predict how market forces or PRC or U.S. government policy may impact the exchange rate between Renminbi and the U.S. dollar in the future. We receive the overwhelming majority of our net revenues in Renminbi. Any significant appreciation or depreciation of Renminbi may materially and adversely affect our revenues, earnings and financial position, and the value of, and any dividends payable on, our ADSs in U.S. dollars. For example, to the extent that we need to convert U.S. dollars we receive into Renminbi to pay our operating expenses in China, appreciation of Renminbi against the U.S. dollar would have an adverse effect on the Renminbi amount we would receive from the conversion. Conversely, a significant depreciation of Renminbi against the U.S. dollar may significantly reduce the U.S. dollar equivalent of our earnings, which in turn could adversely affect the price of our ADSs. Very limited hedging options are available in China to reduce our exposure to exchange rate fluctuations. In 2023, we did not enter into hedging transactions in an effort to reduce our exposure to foreign currency exchange risk. See "Item 11. Quantitative and Qualitative Disclosures about Market Risk-Foreign Exchange Risk" for more details. While we may decide to enter into hedging transactions in the future, the availability and effectiveness of these hedges may be limited and we may not be able to adequately hedge our exposure or at all. In addition, our currency exchange losses may be magnified by PRC exchange control regulations that restrict our ability to convert Renminbi into foreign currency. As a result, fluctuations in exchange rates may have a material adverse effect on your investment. In addition, our operations in the overseas markets expose us to the effects of fluctuations in currency exchange rates as we report our financials and key operational metrics in Renminbi. With respect to our operations in the overseas markets, we earn revenue denominated in local currencies of the overseas markets, while some of our costs and expenses are paid in the U.S. dollar. Fluctuations in the exchange rates of local currencies of the overseas markets against Renminbi and the U.S. dollar could cause fluctuations in our operational and financial results.