Cloopen Group Holding (RAASY) Risk Factors

We believe that litigation and negative publicity surrounding companies with operations in China that are listed in the United States have negatively impacted stock prices for such companies. Various equity-based research organizations have published reports on China-based companies after examining, among other things, their corporate governance practices, related party transactions, sales practices and financial statements that have led to special investigations and stock suspensions on national exchanges. Any similar scrutiny of us, regardless of its lack of merit, could result in a diversion of managerial resources, potential costs to defend ourselves against rumors, decreases and volatility in the ADS trading price, and increased directors and officers insurance premiums, and could have a material adverse effect upon our business, results of operations and financial condition.

Under PRC tax laws and regulations, enterprises are generally subject to enterprise income tax at the statutory rate of 25%, and revenues from cloud-based communications services and communications devices are generally subject to value-added tax at the rates of 6% and 13%. Preferential tax treatments are available to certain enterprises, industries and regions. For example, our PRC subsidiary and certain of our affiliated entities were recognized as "high and new technology enterprises," or HNTEs, and were entitled to a preferential enterprise income tax rate of 15%. The HNTE status must be reapplied every three years. During the three-year period, HNTEs must conduct a self-review each year to ensure they meet the HNTE criteria. We have renewed and intend to continue to renew our HNTE certificates upon the expiration of the three-year period. In addition, if the value-added taxes we actually paid for the sales of our qualified proprietary software exceed an amount equivalent to 3% of our revenues from such software, we are eligible to receive a refund of the excessive amount. However, if PRC government changes its tax policy of supporting new technology and software development, or if we cease to be eligible for any of these preferential tax treatments, we must pay tax at the standard rates, which would adversely affect our profitability.

We have access to certain data and information of enterprises which use our solutions. We may also have access to certain personal data and information of our customers' end-users. We face risks inherent in handling and protecting such large volumes of data. In particular, we face a number of challenges relating to data protection, including: - protecting the data in and hosted on our solutions or infrastructure, including against attacks by third parties or fraudulent behaviors by our employees;- addressing concerns related to privacy and sharing, safety, security and other factors; and - complying with applicable laws, rules, regulations and contractual obligations relating to the collection, use, disclosure or security of personal information, including any request from regulatory and government authorities relating to such data. Any system failure or security breach or lapse that results in the release of data of our customers or their end-users could harm our reputation and brand and, consequently, our business, in addition to exposing us to potential legal liability. In addition, our customers and business partners as well as their employees may improperly use or disclose the data we disclose to them for our operations, and we have limited control over such actions. Any failure, or perceived failure, by us, our employees, our customers and business partners, or their employees to comply with privacy policies or with any regulatory requirements or privacy protection-related laws, rules, regulations and contractual obligations owed to our customers and other third parties could result in proceedings or actions against us by regulatory agencies or private parties. These proceedings or actions may subject us to significant penalties and negative publicity, require us to change our business practices, increase our costs and severely disrupt our business. Our practices regarding the use, retention, transfer, disclosure and security of confidential data could become the subject of enhanced regulations and increased public scrutiny in the future. The regulatory frameworks regarding privacy issues in many jurisdictions are constantly evolving and can be subject to significant changes from time to time. For instance, a growing number of legislative and regulatory bodies have adopted user notification requirements in the event of unauthorized access to or acquisition of certain types of data. The PRC regulators, including the Ministry of Industry and Information Technology, or the MIIT, and the Cyberspace Administration of China, have been increasingly focused on regulation in the areas of cybersecurity and data protection and governmental authorities have enacted a series of laws and regulations to enhance the protection of privacy and data, which require certain authorization or consent from users prior to collection, use or disclosure of their personal data and also protection of the security of the personal data of such users. The MIIT issued the Order for the Protection of Telecommunication and Internet User Personal Information on July 16, 2013, further requiring internet service providers to establish and publish protocols relating to the collection or use of personal information, keep any collected information strictly confidential and take technological and other measures to maintain the security of such information. Institutions and their employees are prohibited from selling or otherwise illegally disclosing a person's personal information obtained during the course of performing duties or providing services. Pursuant to the PRC Cybersecurity Law, effective on June 1, 2017, network operators are required to fulfill certain obligations to safeguard cyber security and enhance network information management. See "Item 4. Information on the Company-B. Business Overview-Regulations-Regulations relating to cyber security and privacy protection-Cyber security." Moreover, existing PRC privacy, cybersecurity and data protection-related laws and regulations are evolving and subject to potentially differing interpretations, and various legislative and regulatory bodies may expand current or enact new laws and regulations regarding privacy, cybersecurity and data protection-related matters. These developments could adversely affect our business, operating results and financial condition. Any failure or perceived failure by us, our products or our platform to comply with new or existing PRC privacy, cybersecurity or data protection laws, regulations, policies, industry standards or legal obligations, any failure to bind our suppliers and contractors to appropriate agreements or to manage their practices or any systems failure or security incident that results in the unauthorized access to, or acquisition, release or transfer of, personally identifiable information or other data relating to customers or individuals may result in governmental investigations, inquiries, enforcement actions and prosecutions, private claims and litigation, fines and penalties, adverse publicity or potential loss of business. In July 2020, the Standing Committee of the National People's Congress of China released a draft data security law, and then released the second consideration of draft data security law in April 2021, collectively the Draft Data Security Law, for public comment. The Draft Data Security Law provides for data security and privacy obligations on entities and individuals carrying out data activities. The Draft Data Security Law also introduces a national security review procedure for those data activities which may affect national security and imposes export restrictions on certain data information. In October 2020, the Standing Committee of the National People's Congress of China released a draft personal information protection law, and then released the second consideration of draft personal information protection law in April 2021, collectively the Draft Personal Information Protection Law, for public comment. The Draft Personal Information Protection Law provides for various requirements on personal information protection, including legal bases for data collection and processing, requirements on data localization and cross-border data transfer, requirements for consent and requirements on processing of sensitive personal information. Complying with these obligations could cause us to incur substantial costs. As the Draft Data Security Law and Draft Personal Information Protection Law remain subject to change, we may be required to make further adjustments to our business practices to comply with the enacted form of the laws, which may increase our compliance cost and adversely affect our business performance. We expect that there will continue to be new proposed laws, rules of self-regulatory bodies, regulations and industry standards concerning privacy, data protection and information security in the PRC, and we cannot yet determine the impact such future laws, rules, regulations and standards may have on our business. Moreover, we may not disclose any personal data or information, unless required by the competent PRC authorities through certain procedures required by the laws, for the purpose of, among others, safeguarding the national security, investigating crimes, investigating infringement of information network communications rights, or cooperating with the supervision and inspection of telecommunications regulatory authorities. Failure to comply with these requirements could subject us to fines and penalties. We also may be bound by contractual obligations relating to our collection, use and disclosure of personal, financial and other data or may find it necessary or desirable to join industry or other self-regulatory bodies or other privacy, cybersecurity or data protection-related organizations that require compliance with their rules pertaining to privacy and data protection. Further, in many cases we rely on the data processing, privacy, data protection and cybersecurity practices of our suppliers and contractors, including with regard to maintaining the confidentiality, security and integrity of data. If we fail to manage our suppliers or contractors or their relevant practices, or if our suppliers or contractors fail to meet any requirements with regard to data processing, privacy, data protection or cybersecurity required by applicable legal or contractual obligations that we face (including any applicable requirements of our clients), we may be liable in certain cases. Legal obligations relating to privacy, cybersecurity and data protection may require us to manage our suppliers and their practices and to enter into agreements with them in certain cases. We may face difficulties in binding our suppliers and contractors to these agreements and otherwise managing their relevant practices, which may subject us to claims, proceedings, and liabilities.

In 2018, 2019 and 2020, our ten largest customers in terms of revenues contributed an aggregate of 27.7%, 25.5% and 21.6% of our total revenues for the same years, respectively. The high quality of our services and the time and expenses required for switching to other qualified cloud-based communications solution providers help us retain our customers. As we typically do not have long-term contracts with our customers, they may reduce their usage at any time or terminate their adoption of our solutions upon expiration of original terms. Although we have made considerable efforts to diversify our customer base and attract new customers, if any of our large customers cease or reduce their use of our solutions, or use our solutions on less favorable terms, our business, results of operations and financial condition could be materially and adversely affected.

Sales of substantial amounts of the ADSs in the public market, or the perception that these sales could occur, could adversely affect the market price of the ADSs and could materially impair our ability to raise capital through equity offerings in the future. The ADSs are freely tradable without restriction or further registration under the Securities Act of 1933, as amended, or the Securities Act, and shares held by our existing shareholders may also be sold in the public market in the future subject to the restrictions in Rule 144 and Rule 701 under the Securities Act and the applicable lock-up agreements. There are 23,319,284 ADSs (equivalent to 46,638,568 Class A ordinary shares) outstanding as of the date of this annual report. In connection with our initial public offering, we, our directors and executive officers, and existing shareholders have agreed not to sell, transfer or dispose of any ADSs, ordinary shares or similar securities for a period of 180 days after February 8, 2021, the date of our prospectus in connection with our initial public offering, without the prior written consent of the underwriters, subject to certain exceptions. However, the underwriters may release these securities from these restrictions at any time, subject to applicable regulations of the Financial Industry Regulatory Authority, Inc. We cannot predict what effect, if any, market sales of securities held by our significant shareholders or any other shareholder or the availability of these securities for future sale will have on the market price of the ADSs.

We store, process and transmit a large amount of data and communications in the ordinary course of business, which may be subject to improper disclosure and misappropriation by our employees, business partners and other third parties. As a result, our business may suffer and our brand image, business, results of operations and financial condition may be materially and adversely affected. We are exposed to the risk of other types of employee misconduct, including intentionally failing to comply with government regulations, engaging in unauthorized activities and misrepresentation during marketing activities, which could harm our reputation. It is not always possible to deter third-party misconduct, and the precautions we take to prevent and detect misconduct may not be effective in controlling unknown or unmanaged risks or losses, which could harm our business, results of operations and financial condition. In addition, our customers which deploy our solutions in their business communications may misuse them to make unauthorized calls and send unauthorized text messages and other content. Such misuses may subject us to potential risks, including liabilities or claims relating to consumer rights protection laws. As a provider of short message services, we are required to comply with relevant laws and regulations relating to internet information protections. For example, on May 19, 2015, the MIIT published the Provisions on the Administration of Short Message Services, which took effect on June 30, 2015, prohibiting the use of text messages in telemarketing or other commercial settings without consumers' proper request and consent. We could also be required to comply with relevant laws and regulations regarding the control and management of unauthorized calls, including, among others, establishing forbidden call lists to prevent telemarketing calls from reaching end-users who have formerly explicitly refused to be reached by telemarketing calls of a particular industry or business, and improving technological capability and risk precautions regarding the prevention and monitoring of unauthorized calls. The scope and interpretation of relevant laws and regulations that are or may be applicable to the delivery of text messages, calls and other content are continuously evolving. See "Item 4. Information on the Company-B. Business Overview-Regulations-Regulations relating to cyber security and privacy protection-Unauthorized calls and text messages." We have taken certain acts to reduce unauthorized text messages and calls, such as contract restrictions in our agreements with customers. However, as in practice we have little control over text messages, calls and other content delivered by our customers to their end-users, we cannot assure you that our current systems and acts will be sufficient or effective under applicable laws and regulations. If we do not comply with relevant laws and regulations or if we become liable under these laws and regulations, we could face direct liability and loss of customer confidence, which could materially harm our reputation, business, results of operations and financial condition.

Our ability to attract new customers and increase revenues from existing customers depends in part on our ability to enhance and improve our existing solutions and introduce new ones. The success of any enhancement or new solution depends on a number of factors, including timely completion, adequate quality testing, consistently high actual performance, market-accepted pricing levels and overall market acceptance. Enhancements and new solutions that we develop may not be introduced in a timely or cost-effective manner, may contain errors or defects, may have interoperability difficulties or may not achieve the broad market acceptance necessary to generate significant revenues. We also have invested, and may continue to invest, in the acquisition of complementary businesses, technologies, services, products and other assets that benefit our innovation and overall business operations. Our investments may not result in enhancements or new solutions that will be accepted by existing or prospective customers. If we are unable to enhance or upgrade our existing solutions to meet the evolving customer requirements or develop new ones in a timely or cost-effective manner, we may not be able to maintain or increase our revenues or recoup our investments, and our business, results of operations and financial condition would be materially and adversely affected.

There has been substantial litigation in the cloud-based communications and related industries regarding intellectual property rights. Third parties may, from time to time, claim that we are infringing, misappropriating or otherwise violating their intellectual property rights, including patents, software copyrights and other intellectual property rights. Third parties may also claim that our employees have misappropriated or divulged their former employers' trade secrets or confidential information. We have been found, and may be found in the future, to have infringed upon third party's proprietary rights. For example, due to a dispute between the former chief executive officer of our affiliated entity, Ronglian Qimo, and his former employer on non-competition matters, Ronglian Qimo and such officer were sued in 2016 for unauthorized application of a source code in a call center software previously sold by Ronglian Qimo. We believe such source code was legally possessed and used by such officer according to his agreement with the former employer; however, a local court held us liable for infringement of software copyright in 2019. We ceased to deploy such source code in our solutions since 2016 and have fully fulfilled our obligations under the court judgment. Our broad range of proprietary technologies increases the likelihood that third parties may claim infringement by us of their intellectual property rights. Certain technologies necessary for our business may, in fact, be patented by other parties either now or in the future. If such technologies were held under a valid patent by a third party, we would have to negotiate a license for the use of that technology, which we may not be able to negotiate on commercially reasonable terms or at all. The existence of such a patent, or our inability to negotiate a license for any such technology on reasonable terms, could force us to cease using such technology and offering solutions incorporating such technology. In addition, even if we succeed in obtaining a license to continue using the relevant technology, we may incur substantial license fees, which could materially and adversely affect our business, results of operations and financial condition. If we are found to have infringed upon the intellectual property rights of any third party in legal or other proceedings that may be asserted against us, we could be subject to material monetary liabilities for such infringement. We could also be required to refrain from using, developing or selling certain solutions incorporating the affected intellectual property rights, which could materially and adversely affect our business and results of operations. We may continue to receive, in the future, notices of claims of infringement, misappropriation or misuse of other parties' proprietary rights. There can be no assurance that we will prevail in contesting these claims or that actions alleging infringement by us of third-party intellectual property rights will not be asserted or prosecuted against us. Furthermore, legal or other proceedings involving infringement of intellectual property rights may require significant time and expense to defend, may divert management's attention away from other aspects of our operations and, upon resolution, may have a material adverse effect on our business, results of operations, financial condition and cash flows. Any negative publicity about our claimed infringement of a third party's proprietary rights could also harm our business.

Our physical infrastructure is subject to various points of failure. Problems with servers, routers, switches, cooling equipment, generators, uninterruptible power supply or other equipment, whether or not within our control, could result in service interruptions for our customers as well as equipment damages. Because our solutions leveraging cloud infrastructure do not require geographic proximity of our physical infrastructure to our customers, they are consolidated into a few facilities. Any failure or downtime in one of such facilities could affect a significant percentage of our customers. The total destruction or severe impairment of any of our facilities could result in significant downtime of our solutions and the loss of customer data. Because our ability to attract and retain customers depends on our ability to provide customers with highly reliable solutions, even minor interruptions could harm our reputation. Additionally, in connection with the expansion or consolidation of our existing facilities from time to time, there is an increased risk that service interruptions may occur as a result of server relocation or other unforeseen construction-related issues. We have taken and continue to take steps to improve our infrastructure to prevent business interruptions, including on-going maintenance and upgrade. However, business interruptions continue to be a significant risk for us and could have a material adverse impact on our business. Any future interruptions could: - cause our customers to seek damages for losses incurred;- require us to replace existing equipment or add redundant facilities;- affect our reputation as a reliable provider of communications solutions;- cause existing customers to cancel or elect to not renew their contracts; or - make it more difficult for us to attract new customers. Any of these events could materially increase our expenses or reduce our revenues, which would have a material adverse effect on our results of operations. We may be required to transfer our servers to new facilities if we are unable to renew our leases on acceptable terms, or at all, or the owners of the facilities decide to close their facilities or refuse to enter into lease agreements with us, and we may incur significant costs and possible service interruption in connection with doing so. In addition, any financial difficulties, such as bankruptcy or foreclosure, faced by our third-party facility operators, or any of the service providers with which we or they contract, may have negative effects on our business, the nature and extent of which are difficult to predict.

The global macroeconomic environment is facing challenges, including the end of quantitative easing by the U.S. Federal Reserve, the economic slowdown in the Eurozone since 2014 and uncertainties over the impact of Brexit. The Chinese economy has shown slower growth compared to the previous decade since 2012 and the trend may continue. There is considerable uncertainty over the long-term effects of the expansionary monetary and fiscal policies adopted by the central banks and financial authorities of some of the world's leading economies, including the United States and China. There have been concerns over unrest and terrorist threats in the Middle East, Europe and Africa, which have resulted in market volatility. There have also been concerns over the relationship between China and other countries, including the surrounding Asian countries. Recent international trade disputes, including tariff actions announced by the United States, China and certain other countries, and the uncertainties created by such disputes may cause disruptions in the international flow of goods and services and may adversely affect the Chinese economy as well as global markets and economic conditions. In addition, the market panics over the global outbreak of COVID-19 materially and negatively affected the global financial markets, which may lead to a prolonged downturn in the global economy. It is unclear whether these challenges and uncertainties will be contained or resolved and what effects they may have on the global political and economic conditions in the long term. Economic conditions in China are sensitive to global economic conditions, as well as changes in domestic economic and political policies and the expected or perceived overall economic growth rate in China. Any severe or prolonged slowdown in the global or Chinese economy may materially and adversely affect our business, financial condition, results of operations and prospects.

Recent international trade disputes, including those between China and the United States, and the uncertainties created by such disputes may disrupt the transnational flow of goods and significantly undermine the stability of the global and Chinese economy, thereby harming our business. International trade disputes could result in tariffs and other protectionist measures that could adversely affect our business. Tariffs could increase our operating costs as well as the cost of the goods and products which could affect our customer's discretionary spending level. In addition, any escalation in existing trade tensions or the advent of a trade war, or news and rumors of the escalation of a potential trade war, could affect consumer confidence and have a material adverse effect on our business, results of operations and, ultimately, the trading price of the ADSs. Political tensions between the United States and China have escalated due to, among other things, the COVID-19 outbreak, the PRC National People's Congress' passage of Hong Kong national security legislation, sanctions imposed by the U.S. Department of Treasury on certain officials of the Hong Kong Special Administrative Region and the central government of the PRC, and the executive orders issued by U.S. President in August 2020 that prohibit certain transactions with ByteDance Ltd., Tencent Holdings Ltd. and the respective subsidiaries of such companies. Rising political tensions could reduce levels of trades, investments, technological exchanges and other economic activities between the two major economies, which would have a material adverse effect on global economic conditions and the stability of global financial markets. Any of these factors could have a material adverse effect on our business, prospects, financial condition and results of operations. Furthermore, there have been media reports on deliberations within the U.S. government regarding potentially limiting or restricting China-based companies from accessing U.S. capital markets. If any such deliberations were to materialize, the resulting legislation may have a material and adverse impact on the stock performance of China-based issuers listed in the United States. It is currently unclear whether the proposed or additional legislations would be enacted that would have the effect of potentially limiting or restricting China-based companies from accessing U.S. capital markets.

The PRC Labor Contract Law has reinforced the protection of employees who, under the PRC Labor Contract Law, have the right, among others, to have written employment contracts, to enter into employment contracts with no fixed term under certain circumstances, to receive overtime wages and to terminate or alter terms in labor contracts. Furthermore, the PRC Labor Contract Law sets forth additional restrictions and increases the costs involved with dismissing employees. To the extent that we need to significantly reduce our workforce, the PRC Labor Contract Law could adversely affect our ability to do so in a timely and cost-effective manner, and we could be subject to penalties or incur significant liabilities in connection with labor disputes or investigations. In addition, we are required by PRC laws and regulations to make social insurance registration and open housing fund account with relevant governmental authorities and pay various statutory employee benefits, including pension insurance, unemployment insurance, maternity insurance, work-related injury insurance, medical insurance and housing fund to designated government agencies for the benefit of our employees. The relevant government agencies may examine whether an employer has made adequate payments of the requisite statutory employee benefits, and those employers who fail to make adequate payments may be subject to late fees, fines and/or other penalties. Our social insurance and/or housing fund policies and practices may be found to have violated the relevant laws and regulations. See "-Risks Related to Regulatory Compliance-Failure to make adequate contributions to social insurance and housing fund as required by PRC regulations may subject us to penalties." For example, some of our PRC operating entities did not make adequate social insurance and housing fund contributions or did not make social insurance registration and open housing fund account in accordance with PRC laws and regulations. As a result, we may be subject to late fees, fines and/or other penalties, and our business, financial condition and results of operations may be adversely affected.

While we independently developed all the core features of and technologies underlying our cloud-based communications solutions, we outsource certain non-core software development activities in relation to our cloud-based UC&C solutions in order to enhance productivity and reduce labor costs. Typically, we enter into agreements with these outsourcing service providers on a project basis, pursuant to which they deliver software according to our specifications. We may experience operational difficulties because of our outsourcing service providers, including their failure to comply with software specifications, reduced capacity, insufficient quality control and failure to meet deadlines. As a result, we may fail to deliver our communications solutions to the satisfaction of our customers and in a timely manner, which may adversely affect our reputation and relationship with customers. In addition, if one or more of our outsourcing service providers experience business interruptions or are otherwise unable or unwilling to fulfill their agreements with us, we may suffer delays and additional expenses in arranging for alternative service providers meeting our requirements, and our business, results of operations and financial condition may be adversely affected.

We provide social security insurance, including pension insurance, unemployment insurance, maternity insurance, work-related injury insurance and medical insurance, as well as housing fund for our employees. We also purchased additional commercial health insurance to increase insurance coverage of our employees. However, as the insurance industry in China is still in an early stage of development, insurance companies in China currently offer limited business-related insurance products. We do not maintain property insurance policies covering our equipment, systems and other property that are essential to our business operations. We do not maintain business interruption insurance or general third-party liability insurance, nor do we maintain product liability insurance or key-man insurance. We consider our insurance coverage to be in line with that of other companies in the same industry of similar size in China, but we cannot assure you that our insurance coverage is sufficient to prevent us from any loss or that we will be able to successfully claim our losses under our current insurance policies on a timely basis, or at all. If we incur any loss that is not covered by our insurance policies, or the compensated amount is significantly less than our actual loss, our business, financial condition and results of operations could be materially and adversely affected.